Windows Analysis Report
IAdjMfB2A5.exe

Source: C:\Users\user\Desktop\IAdjMfB2A5.exe	Code function: 0_2_00007FF6743C1000	0_2_00007FF6743C1000
Source: C:\Users\user\Desktop\IAdjMfB2A5.exe	Code function: 0_2_00007FF6743D5550	0_2_00007FF6743D5550
Source: C:\Users\user\Desktop\IAdjMfB2A5.exe	Code function: 0_2_00007FF67446580B	0_2_00007FF67446580B
Source: C:\Windows\msedge.exe	Code function: 13_2_00007FF848E1237F	13_2_00007FF848E1237F
Source: C:\Windows\msedge.exe	Code function: 13_2_00007FF848E116FF	13_2_00007FF848E116FF
Source: C:\Windows\msedge.exe	Code function: 13_2_00007FF848E160DF	13_2_00007FF848E160DF
Source: C:\Windows\msedge.exe	Code function: 13_2_00007FF848E16E8F	13_2_00007FF848E16E8F
Source: C:\Windows\msedge.exe	Code function: 13_2_00007FF848E10E90	13_2_00007FF848E10E90

Source: C:\Users\user\Desktop\IAdjMfB2A5.exe

Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 4324 -s 844

Source: IAdjMfB2A5.exe	Binary or memory string: OriginalFilename vs IAdjMfB2A5.exe
Source: IAdjMfB2A5.exe, 00000000.00000002.2069285543.00007FF674462000.00000008.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamemsedge.exe@ vs IAdjMfB2A5.exe
Source: IAdjMfB2A5.exe, 00000000.00000000.2025716296.00007FF674462000.00000008.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamemsedge.exe@ vs IAdjMfB2A5.exe
Source: IAdjMfB2A5.exe	Binary or memory string: OriginalFilenamemsedge.exe@ vs IAdjMfB2A5.exe

Source: IAdjMfB2A5.exe, type: SAMPLE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 0.2.IAdjMfB2A5.exe.7ff674462000.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 0.2.IAdjMfB2A5.exe.7ff674462000.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 0.0.IAdjMfB2A5.exe.7ff674462000.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 13.0.msedge.exe.a80000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 0.0.IAdjMfB2A5.exe.7ff674462000.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 0.2.IAdjMfB2A5.exe.7ff6743c0000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 0.0.IAdjMfB2A5.exe.7ff6743c0000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 0000000D.00000000.2036559031.0000000000A82000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000000.00000000.2025716296.00007FF674462000.00000008.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000000.00000002.2069285543.00007FF674462000.00000008.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: C:\Windows\msedge.exe, type: DROPPED	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT

Source: msedge.exe.0.dr, K3EtGcFLetA04ODNdK5g4Tlc3zyYrVKESf.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: msedge.exe.0.dr, q4EXxgqFBVfebrrJRQRZsnHCyCxnnRNNkx.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: msedge.exe.0.dr, q4EXxgqFBVfebrrJRQRZsnHCyCxnnRNNkx.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.0.IAdjMfB2A5.exe.7ff674462000.1.raw.unpack, K3EtGcFLetA04ODNdK5g4Tlc3zyYrVKESf.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.0.IAdjMfB2A5.exe.7ff674462000.1.raw.unpack, q4EXxgqFBVfebrrJRQRZsnHCyCxnnRNNkx.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.0.IAdjMfB2A5.exe.7ff674462000.1.raw.unpack, q4EXxgqFBVfebrrJRQRZsnHCyCxnnRNNkx.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.IAdjMfB2A5.exe.7ff674462000.1.raw.unpack, K3EtGcFLetA04ODNdK5g4Tlc3zyYrVKESf.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.IAdjMfB2A5.exe.7ff674462000.1.raw.unpack, q4EXxgqFBVfebrrJRQRZsnHCyCxnnRNNkx.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.IAdjMfB2A5.exe.7ff674462000.1.raw.unpack, q4EXxgqFBVfebrrJRQRZsnHCyCxnnRNNkx.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: 0.2.IAdjMfB2A5.exe.7ff674462000.1.raw.unpack, vgWlVAySzP7O3THtCP5fBBa6AikzpVbLuyqaYt6a7HYMS2pskOYRhMkSwgK.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 0.2.IAdjMfB2A5.exe.7ff674462000.1.raw.unpack, vgWlVAySzP7O3THtCP5fBBa6AikzpVbLuyqaYt6a7HYMS2pskOYRhMkSwgK.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: msedge.exe.0.dr, vgWlVAySzP7O3THtCP5fBBa6AikzpVbLuyqaYt6a7HYMS2pskOYRhMkSwgK.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: msedge.exe.0.dr, vgWlVAySzP7O3THtCP5fBBa6AikzpVbLuyqaYt6a7HYMS2pskOYRhMkSwgK.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.0.IAdjMfB2A5.exe.7ff674462000.1.raw.unpack, vgWlVAySzP7O3THtCP5fBBa6AikzpVbLuyqaYt6a7HYMS2pskOYRhMkSwgK.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 0.0.IAdjMfB2A5.exe.7ff674462000.1.raw.unpack, vgWlVAySzP7O3THtCP5fBBa6AikzpVbLuyqaYt6a7HYMS2pskOYRhMkSwgK.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()

Source: classification engine

Classification label: mal100.troj.evad.winEXE@41/6@2/3

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2140:120:WilError_03
Source: C:\Windows\msedge.exe	Mutant created: NULL
Source: C:\Windows\System32\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6336:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1988:120:WilError_03
Source: C:\Windows\msedge.exe	Mutant created: \Sessions\1\BaseNamedObjects\dJyrUNHFFGRQOvwi
Source: C:\Windows\System32\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess764

Source: C:\Windows\System32\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\1926a5e6-7e06-4447-841d-3213527583fa

Source: IAdjMfB2A5.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: IAdjMfB2A5.exe

Static file information: TRID: Win64 Executable Console Net Framework (206006/5) 46.24%

Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "EpicGamesLauncher.exe")
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "FortniteClient-Win64-Shipping_BE.exe")
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "FortniteClient-Win64-Shipping.exe")
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "x64dbg.exe")

Source: C:\Users\user\Desktop\IAdjMfB2A5.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: IAdjMfB2A5.exe

ReversingLabs: Detection: 57%

Source: IAdjMfB2A5.exe

String found in binary or memory: iphlpapi.dllif_nametoindexkernel32LoadLibraryExA\/AddDllDirectory

Source: unknown	Process created: C:\Users\user\Desktop\IAdjMfB2A5.exe "C:\Users\user\Desktop\IAdjMfB2A5.exe"
Source: C:\Users\user\Desktop\IAdjMfB2A5.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\IAdjMfB2A5.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /IM EpicGamesLauncher.exe /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM EpicGamesLauncher.exe /F
Source: C:\Users\user\Desktop\IAdjMfB2A5.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /IM FortniteClient-Win64-Shipping_BE.exe /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM FortniteClient-Win64-Shipping_BE.exe /F
Source: C:\Users\user\Desktop\IAdjMfB2A5.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /IM FortniteClient-Win64-Shipping.exe /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM FortniteClient-Win64-Shipping.exe /F
Source: C:\Users\user\Desktop\IAdjMfB2A5.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /IM x64dbg.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM x64dbg.exe
Source: C:\Users\user\Desktop\IAdjMfB2A5.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c cls
Source: C:\Users\user\Desktop\IAdjMfB2A5.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c start C:\Windows\msedge.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\msedge.exe C:\Windows\msedge.exe
Source: C:\Users\user\Desktop\IAdjMfB2A5.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\user\Desktop\IAdjMfB2A5.exe" MD5 \| find /i /v "md5" \| find /i /v "certutil"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\certutil.exe certutil -hashfile "C:\Users\user\Desktop\IAdjMfB2A5.exe" MD5
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /i /v "md5"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /i /v "certutil"
Source: C:\Users\user\Desktop\IAdjMfB2A5.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c start cmd /C "color b && title Error && echo SSL connect error && timeout /t 5"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /C "color b && title Error && echo SSL connect error && timeout /t 5"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout /t 5
Source: C:\Users\user\Desktop\IAdjMfB2A5.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 4324 -s 844
Source: C:\Windows\msedge.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 764 -s 1576
Source: C:\Users\user\Desktop\IAdjMfB2A5.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /IM EpicGamesLauncher.exe /F	Jump to behavior
Source: C:\Users\user\Desktop\IAdjMfB2A5.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /IM FortniteClient-Win64-Shipping_BE.exe /F	Jump to behavior
Source: C:\Users\user\Desktop\IAdjMfB2A5.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /IM FortniteClient-Win64-Shipping.exe /F	Jump to behavior
Source: C:\Users\user\Desktop\IAdjMfB2A5.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /IM x64dbg.exe	Jump to behavior
Source: C:\Users\user\Desktop\IAdjMfB2A5.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c cls	Jump to behavior
Source: C:\Users\user\Desktop\IAdjMfB2A5.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c start C:\Windows\msedge.exe	Jump to behavior
Source: C:\Users\user\Desktop\IAdjMfB2A5.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\user\Desktop\IAdjMfB2A5.exe" MD5 \| find /i /v "md5" \| find /i /v "certutil"	Jump to behavior
Source: C:\Users\user\Desktop\IAdjMfB2A5.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c start cmd /C "color b && title Error && echo SSL connect error && timeout /t 5"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM EpicGamesLauncher.exe /F	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM FortniteClient-Win64-Shipping_BE.exe /F	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM FortniteClient-Win64-Shipping.exe /F	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM x64dbg.exe	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\msedge.exe C:\Windows\msedge.exe	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\certutil.exe certutil -hashfile "C:\Users\user\Desktop\IAdjMfB2A5.exe" MD5	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /i /v "md5"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /i /v "certutil"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /C "color b && title Error && echo SSL connect error && timeout /t 5"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout /t 5	Jump to behavior

Source: C:\Users\user\Desktop\IAdjMfB2A5.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\IAdjMfB2A5.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\IAdjMfB2A5.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\IAdjMfB2A5.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Users\user\Desktop\IAdjMfB2A5.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\IAdjMfB2A5.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\IAdjMfB2A5.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Users\user\Desktop\IAdjMfB2A5.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\IAdjMfB2A5.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\IAdjMfB2A5.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\IAdjMfB2A5.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\IAdjMfB2A5.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\IAdjMfB2A5.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\IAdjMfB2A5.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\IAdjMfB2A5.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\IAdjMfB2A5.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\IAdjMfB2A5.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\IAdjMfB2A5.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\msedge.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\msedge.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\msedge.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\msedge.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\msedge.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\msedge.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\msedge.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\msedge.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\msedge.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\msedge.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\msedge.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\msedge.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\msedge.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\msedge.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\msedge.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\msedge.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\msedge.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\msedge.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\msedge.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\msedge.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\msedge.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\msedge.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\msedge.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\msedge.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\msedge.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\msedge.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\msedge.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\msedge.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\msedge.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\msedge.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\msedge.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\certutil.exe	Section loaded: certcli.dll	Jump to behavior
Source: C:\Windows\System32\certutil.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\System32\certutil.exe	Section loaded: cryptui.dll	Jump to behavior
Source: C:\Windows\System32\certutil.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\certutil.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\certutil.exe	Section loaded: ntdsapi.dll	Jump to behavior
Source: C:\Windows\System32\certutil.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\certutil.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\certutil.exe	Section loaded: certca.dll	Jump to behavior
Source: C:\Windows\System32\certutil.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\certutil.exe	Section loaded: certca.dll	Jump to behavior
Source: C:\Windows\System32\certutil.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\certutil.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\System32\certutil.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\certutil.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\certutil.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\certutil.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\certutil.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\certutil.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\find.exe	Section loaded: ulib.dll	Jump to behavior
Source: C:\Windows\System32\find.exe	Section loaded: fsutilext.dll	Jump to behavior
Source: C:\Windows\System32\find.exe	Section loaded: ulib.dll	Jump to behavior
Source: C:\Windows\System32\find.exe	Section loaded: fsutilext.dll	Jump to behavior
Source: C:\Windows\System32\timeout.exe	Section loaded: version.dll	Jump to behavior

Source: C:\Windows\msedge.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\msedge.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

.NET source code contains method to dynamically call methods (often used by packers)

Source: IAdjMfB2A5.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: IAdjMfB2A5.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: IAdjMfB2A5.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: IAdjMfB2A5.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: IAdjMfB2A5.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: IAdjMfB2A5.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: IAdjMfB2A5.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: IAdjMfB2A5.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: IAdjMfB2A5.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: Microsoft.VisualBasic.ni.pdb source: WERFB01.tmp.dmp.26.dr
Source:	Binary string: System.Xml.ni.pdb source: WERFB01.tmp.dmp.26.dr
Source:	Binary string: System.ni.pdbRSDS source: WERFB01.tmp.dmp.26.dr
Source:	Binary string: System.pdbh source: WERFB01.tmp.dmp.26.dr
Source:	Binary string: System.Configuration.ni.pdb source: WERFB01.tmp.dmp.26.dr
Source:	Binary string: mscorlib.ni.pdbRSDS7^3l source: WERFB01.tmp.dmp.26.dr
Source:	Binary string: Microsoft.VisualBasic.ni.pdbRSDS& source: WERFB01.tmp.dmp.26.dr
Source:	Binary string: System.Configuration.pdb source: WERFB01.tmp.dmp.26.dr
Source:	Binary string: System.Core.pdbH source: WERFB01.tmp.dmp.26.dr
Source:	Binary string: System.Configuration.pdb`zX source: WERFB01.tmp.dmp.26.dr
Source:	Binary string: System.Xml.pdb source: WERFB01.tmp.dmp.26.dr
Source:	Binary string: System.pdb source: WERFB01.tmp.dmp.26.dr
Source:	Binary string: mscorlib.pdbP<J source: WERFB01.tmp.dmp.26.dr
Source:	Binary string: System.Xml.ni.pdbRSDS# source: WERFB01.tmp.dmp.26.dr
Source:	Binary string: System.Core.ni.pdb source: WERFB01.tmp.dmp.26.dr
Source:	Binary string: Microsoft.VisualBasic.pdb source: WERFB01.tmp.dmp.26.dr
Source:	Binary string: mscorlib.pdb source: WERFB01.tmp.dmp.26.dr
Source:	Binary string: System.Management.ni.pdbRSDSJ< source: WERFB01.tmp.dmp.26.dr
Source:	Binary string: C:\Users\Admin\Downloads\Permanent Spoofer\Permanent Spoofer\x64\Release\Permanent Spoofer.pdb source: IAdjMfB2A5.exe
Source:	Binary string: System.Management.pdb source: WERFB01.tmp.dmp.26.dr
Source:	Binary string: mscorlib.ni.pdb source: WERFB01.tmp.dmp.26.dr
Source:	Binary string: System.Management.ni.pdb source: WERFB01.tmp.dmp.26.dr
Source:	Binary string: System.Core.pdb source: WERFB01.tmp.dmp.26.dr
Source:	Binary string: System.Configuration.ni.pdbRSDScUN source: WERFB01.tmp.dmp.26.dr
Source:	Binary string: System.ni.pdb source: WERFB01.tmp.dmp.26.dr
Source:	Binary string: System.Core.ni.pdbRSDS source: WERFB01.tmp.dmp.26.dr

Source: IAdjMfB2A5.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: IAdjMfB2A5.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: IAdjMfB2A5.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: IAdjMfB2A5.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: IAdjMfB2A5.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Data Obfuscation

Source: msedge.exe.0.dr, s1zDChMR3v6pFTdTev1irCmHmU1wJwIWDbDCRbkB04x0k5VFirFGX15ek7YyWoQgechSINTmzW2Z0zYsJQCYgEg0npXA.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[5]{fZxKo0R9gHXQ0DMv7wrFv6fFWuutND4Wdo1mB77p7ZNRdJblVPPI5huPpT2DEdZ2Ht289mbNLK.JbOHglQ9dsuk0asel3ZQBx8t0XxauzWHZ0iVgriXmoLXTDOAfogfZ6J0VaL,fZxKo0R9gHXQ0DMv7wrFv6fFWuutND4Wdo1mB77p7ZNRdJblVPPI5huPpT2DEdZ2Ht289mbNLK.urjmjtyXMjjqUuxmGSX8DvnJt7L5rn2UYw7FOEIz4Jj7DgbN4uYId15OpEz,fZxKo0R9gHXQ0DMv7wrFv6fFWuutND4Wdo1mB77p7ZNRdJblVPPI5huPpT2DEdZ2Ht289mbNLK._0QXDDIcMePIpaFmwco6GJwFQCWiCYGoAiaBnMfi9prcNtM3UVTo0vyL62gT,fZxKo0R9gHXQ0DMv7wrFv6fFWuutND4Wdo1mB77p7ZNRdJblVPPI5huPpT2DEdZ2Ht289mbNLK.EoxDFBiSVCATpnUnykM8g2wIgGIPzE9FNAOhdX5GYerIPWFhfs5DtJ9oVmv,q4EXxgqFBVfebrrJRQRZsnHCyCxnnRNNkx.nsViMGxwMKDNjFQTFSDcQ1aCxmSeRXrbca()}}, (string[])null, (Type[])null, (bool[])null, true)
Source: msedge.exe.0.dr, s1zDChMR3v6pFTdTev1irCmHmU1wJwIWDbDCRbkB04x0k5VFirFGX15ek7YyWoQgechSINTmzW2Z0zYsJQCYgEg0npXA.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[2]{Q9h4v1xukw8IN2MqhoT5B0fpc2nvnaynMN[2],q4EXxgqFBVfebrrJRQRZsnHCyCxnnRNNkx.zpUDfbcYJISXjCYnOL5NqR99uLjNRA1rQM(Convert.FromBase64String(Q9h4v1xukw8IN2MqhoT5B0fpc2nvnaynMN[3]))}}, (string[])null, (Type[])null, (bool[])null, true)
Source: msedge.exe.0.dr, s1zDChMR3v6pFTdTev1irCmHmU1wJwIWDbDCRbkB04x0k5VFirFGX15ek7YyWoQgechSINTmzW2Z0zYsJQCYgEg0npXA.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[1] { Q9h4v1xukw8IN2MqhoT5B0fpc2nvnaynMN[2] }}, (string[])null, (Type[])null, (bool[])null, true)
Source: 0.0.IAdjMfB2A5.exe.7ff674462000.1.raw.unpack, s1zDChMR3v6pFTdTev1irCmHmU1wJwIWDbDCRbkB04x0k5VFirFGX15ek7YyWoQgechSINTmzW2Z0zYsJQCYgEg0npXA.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[5]{fZxKo0R9gHXQ0DMv7wrFv6fFWuutND4Wdo1mB77p7ZNRdJblVPPI5huPpT2DEdZ2Ht289mbNLK.JbOHglQ9dsuk0asel3ZQBx8t0XxauzWHZ0iVgriXmoLXTDOAfogfZ6J0VaL,fZxKo0R9gHXQ0DMv7wrFv6fFWuutND4Wdo1mB77p7ZNRdJblVPPI5huPpT2DEdZ2Ht289mbNLK.urjmjtyXMjjqUuxmGSX8DvnJt7L5rn2UYw7FOEIz4Jj7DgbN4uYId15OpEz,fZxKo0R9gHXQ0DMv7wrFv6fFWuutND4Wdo1mB77p7ZNRdJblVPPI5huPpT2DEdZ2Ht289mbNLK._0QXDDIcMePIpaFmwco6GJwFQCWiCYGoAiaBnMfi9prcNtM3UVTo0vyL62gT,fZxKo0R9gHXQ0DMv7wrFv6fFWuutND4Wdo1mB77p7ZNRdJblVPPI5huPpT2DEdZ2Ht289mbNLK.EoxDFBiSVCATpnUnykM8g2wIgGIPzE9FNAOhdX5GYerIPWFhfs5DtJ9oVmv,q4EXxgqFBVfebrrJRQRZsnHCyCxnnRNNkx.nsViMGxwMKDNjFQTFSDcQ1aCxmSeRXrbca()}}, (string[])null, (Type[])null, (bool[])null, true)
Source: 0.0.IAdjMfB2A5.exe.7ff674462000.1.raw.unpack, s1zDChMR3v6pFTdTev1irCmHmU1wJwIWDbDCRbkB04x0k5VFirFGX15ek7YyWoQgechSINTmzW2Z0zYsJQCYgEg0npXA.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[2]{Q9h4v1xukw8IN2MqhoT5B0fpc2nvnaynMN[2],q4EXxgqFBVfebrrJRQRZsnHCyCxnnRNNkx.zpUDfbcYJISXjCYnOL5NqR99uLjNRA1rQM(Convert.FromBase64String(Q9h4v1xukw8IN2MqhoT5B0fpc2nvnaynMN[3]))}}, (string[])null, (Type[])null, (bool[])null, true)
Source: 0.0.IAdjMfB2A5.exe.7ff674462000.1.raw.unpack, s1zDChMR3v6pFTdTev1irCmHmU1wJwIWDbDCRbkB04x0k5VFirFGX15ek7YyWoQgechSINTmzW2Z0zYsJQCYgEg0npXA.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[1] { Q9h4v1xukw8IN2MqhoT5B0fpc2nvnaynMN[2] }}, (string[])null, (Type[])null, (bool[])null, true)
Source: 0.2.IAdjMfB2A5.exe.7ff674462000.1.raw.unpack, s1zDChMR3v6pFTdTev1irCmHmU1wJwIWDbDCRbkB04x0k5VFirFGX15ek7YyWoQgechSINTmzW2Z0zYsJQCYgEg0npXA.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[5]{fZxKo0R9gHXQ0DMv7wrFv6fFWuutND4Wdo1mB77p7ZNRdJblVPPI5huPpT2DEdZ2Ht289mbNLK.JbOHglQ9dsuk0asel3ZQBx8t0XxauzWHZ0iVgriXmoLXTDOAfogfZ6J0VaL,fZxKo0R9gHXQ0DMv7wrFv6fFWuutND4Wdo1mB77p7ZNRdJblVPPI5huPpT2DEdZ2Ht289mbNLK.urjmjtyXMjjqUuxmGSX8DvnJt7L5rn2UYw7FOEIz4Jj7DgbN4uYId15OpEz,fZxKo0R9gHXQ0DMv7wrFv6fFWuutND4Wdo1mB77p7ZNRdJblVPPI5huPpT2DEdZ2Ht289mbNLK._0QXDDIcMePIpaFmwco6GJwFQCWiCYGoAiaBnMfi9prcNtM3UVTo0vyL62gT,fZxKo0R9gHXQ0DMv7wrFv6fFWuutND4Wdo1mB77p7ZNRdJblVPPI5huPpT2DEdZ2Ht289mbNLK.EoxDFBiSVCATpnUnykM8g2wIgGIPzE9FNAOhdX5GYerIPWFhfs5DtJ9oVmv,q4EXxgqFBVfebrrJRQRZsnHCyCxnnRNNkx.nsViMGxwMKDNjFQTFSDcQ1aCxmSeRXrbca()}}, (string[])null, (Type[])null, (bool[])null, true)
Source: 0.2.IAdjMfB2A5.exe.7ff674462000.1.raw.unpack, s1zDChMR3v6pFTdTev1irCmHmU1wJwIWDbDCRbkB04x0k5VFirFGX15ek7YyWoQgechSINTmzW2Z0zYsJQCYgEg0npXA.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[2]{Q9h4v1xukw8IN2MqhoT5B0fpc2nvnaynMN[2],q4EXxgqFBVfebrrJRQRZsnHCyCxnnRNNkx.zpUDfbcYJISXjCYnOL5NqR99uLjNRA1rQM(Convert.FromBase64String(Q9h4v1xukw8IN2MqhoT5B0fpc2nvnaynMN[3]))}}, (string[])null, (Type[])null, (bool[])null, true)
Source: 0.2.IAdjMfB2A5.exe.7ff674462000.1.raw.unpack, s1zDChMR3v6pFTdTev1irCmHmU1wJwIWDbDCRbkB04x0k5VFirFGX15ek7YyWoQgechSINTmzW2Z0zYsJQCYgEg0npXA.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[1] { Q9h4v1xukw8IN2MqhoT5B0fpc2nvnaynMN[2] }}, (string[])null, (Type[])null, (bool[])null, true)

.NET source code contains potential unpacker

Source: msedge.exe.0.dr, s1zDChMR3v6pFTdTev1irCmHmU1wJwIWDbDCRbkB04x0k5VFirFGX15ek7YyWoQgechSINTmzW2Z0zYsJQCYgEg0npXA.cs	.Net Code: DGOhZm2kY6a41lNzUAO7Jv94x7DBFG4HFfb93sGOOZ9YfaI44JdpDbf5KVCxlZLQzdkK7PL4P9rrVFNN7gXvyynX3xNK System.AppDomain.Load(byte[])
Source: msedge.exe.0.dr, s1zDChMR3v6pFTdTev1irCmHmU1wJwIWDbDCRbkB04x0k5VFirFGX15ek7YyWoQgechSINTmzW2Z0zYsJQCYgEg0npXA.cs	.Net Code: VsewEVB79ECwVBBn7vM70WvdPXt5PRmB8AszIf2GVFGGTRZZRPSX4hOcf5KWfPj745nBlBaDC6PvxNpk38Omtf4qnu0X System.AppDomain.Load(byte[])
Source: msedge.exe.0.dr, s1zDChMR3v6pFTdTev1irCmHmU1wJwIWDbDCRbkB04x0k5VFirFGX15ek7YyWoQgechSINTmzW2Z0zYsJQCYgEg0npXA.cs	.Net Code: VsewEVB79ECwVBBn7vM70WvdPXt5PRmB8AszIf2GVFGGTRZZRPSX4hOcf5KWfPj745nBlBaDC6PvxNpk38Omtf4qnu0X
Source: 0.0.IAdjMfB2A5.exe.7ff674462000.1.raw.unpack, s1zDChMR3v6pFTdTev1irCmHmU1wJwIWDbDCRbkB04x0k5VFirFGX15ek7YyWoQgechSINTmzW2Z0zYsJQCYgEg0npXA.cs	.Net Code: DGOhZm2kY6a41lNzUAO7Jv94x7DBFG4HFfb93sGOOZ9YfaI44JdpDbf5KVCxlZLQzdkK7PL4P9rrVFNN7gXvyynX3xNK System.AppDomain.Load(byte[])
Source: 0.0.IAdjMfB2A5.exe.7ff674462000.1.raw.unpack, s1zDChMR3v6pFTdTev1irCmHmU1wJwIWDbDCRbkB04x0k5VFirFGX15ek7YyWoQgechSINTmzW2Z0zYsJQCYgEg0npXA.cs	.Net Code: VsewEVB79ECwVBBn7vM70WvdPXt5PRmB8AszIf2GVFGGTRZZRPSX4hOcf5KWfPj745nBlBaDC6PvxNpk38Omtf4qnu0X System.AppDomain.Load(byte[])
Source: 0.0.IAdjMfB2A5.exe.7ff674462000.1.raw.unpack, s1zDChMR3v6pFTdTev1irCmHmU1wJwIWDbDCRbkB04x0k5VFirFGX15ek7YyWoQgechSINTmzW2Z0zYsJQCYgEg0npXA.cs	.Net Code: VsewEVB79ECwVBBn7vM70WvdPXt5PRmB8AszIf2GVFGGTRZZRPSX4hOcf5KWfPj745nBlBaDC6PvxNpk38Omtf4qnu0X
Source: 0.2.IAdjMfB2A5.exe.7ff674462000.1.raw.unpack, s1zDChMR3v6pFTdTev1irCmHmU1wJwIWDbDCRbkB04x0k5VFirFGX15ek7YyWoQgechSINTmzW2Z0zYsJQCYgEg0npXA.cs	.Net Code: DGOhZm2kY6a41lNzUAO7Jv94x7DBFG4HFfb93sGOOZ9YfaI44JdpDbf5KVCxlZLQzdkK7PL4P9rrVFNN7gXvyynX3xNK System.AppDomain.Load(byte[])
Source: 0.2.IAdjMfB2A5.exe.7ff674462000.1.raw.unpack, s1zDChMR3v6pFTdTev1irCmHmU1wJwIWDbDCRbkB04x0k5VFirFGX15ek7YyWoQgechSINTmzW2Z0zYsJQCYgEg0npXA.cs	.Net Code: VsewEVB79ECwVBBn7vM70WvdPXt5PRmB8AszIf2GVFGGTRZZRPSX4hOcf5KWfPj745nBlBaDC6PvxNpk38Omtf4qnu0X System.AppDomain.Load(byte[])
Source: 0.2.IAdjMfB2A5.exe.7ff674462000.1.raw.unpack, s1zDChMR3v6pFTdTev1irCmHmU1wJwIWDbDCRbkB04x0k5VFirFGX15ek7YyWoQgechSINTmzW2Z0zYsJQCYgEg0npXA.cs	.Net Code: VsewEVB79ECwVBBn7vM70WvdPXt5PRmB8AszIf2GVFGGTRZZRPSX4hOcf5KWfPj745nBlBaDC6PvxNpk38Omtf4qnu0X

Source: C:\Users\user\Desktop\IAdjMfB2A5.exe	Code function: 0_2_00007FF674466AF6 push ss; ret	0_2_00007FF674466C22
Source: C:\Users\user\Desktop\IAdjMfB2A5.exe	Code function: 0_2_00007FF674462682 push es; retf 0000h	0_2_00007FF674462686
Source: C:\Users\user\Desktop\IAdjMfB2A5.exe	Code function: 0_2_00007FF674466C36 push ds; ret	0_2_00007FF674466C3A
Source: C:\Users\user\Desktop\IAdjMfB2A5.exe	Code function: 0_2_00007FF67446863F push ebp; ret	0_2_00007FF67446885A
Source: C:\Windows\msedge.exe	Code function: 13_2_00007FF848E12B23 push esi; iretd	13_2_00007FF848E12B22
Source: C:\Windows\msedge.exe	Code function: 13_2_00007FF848E12A9D push esi; iretd	13_2_00007FF848E12B22

Source: msedge.exe.0.dr, fZxKo0R9gHXQ0DMv7wrFv6fFWuutND4Wdo1mB77p7ZNRdJblVPPI5huPpT2DEdZ2Ht289mbNLK.cs	High entropy of concatenated method names: 'DPhQWJD5QH2AzOs5GCIYUUZPuvJXhEUeY4bw80lQKW0mObYjUqV', 'mmPsJknc0rusxKZKeoibNNOORCVDsB0F6I7Kt7lOQ6Az5LtBHTB', '_5Up93SMffx1to9iPBZPUyd0O0A3539oHRFZxzyV0r1Xw6Hr5uQx', 'UdFaYg9FvK9X7hceozvN1ZRoGJNMICF5Ck3kLRs2S3Upx653V9p'
Source: msedge.exe.0.dr, llh7f0sYaLxi6yXrfPaBFl6UJCVXBttiOH.cs	High entropy of concatenated method names: 'PfAjvP7x5wLaIINw0FvZiN16SipvlSBDa1', 'QDHD5swMYFyK3NYnES67tyzqyWwmatDRYr', 'lvzcn3KcfH0l7qGq41a', 'OcDBnUMjjag', '_2YhPpzzAPV4', 'XRr0zdN2GI1', 'Vh8GEsuwkJo', 'FOn8clLHeys', 'MZ696AQzbZM', '_2krcbn3HX0V'
Source: msedge.exe.0.dr, K6WhBlaIGoubgiXm85xVKg90d70tAEzArIMwc4ieBc.cs	High entropy of concatenated method names: 'Equals', 'GetHashCode', 'GetType', 'ToString', 'Create__Instance__', 'Dispose__Instance__', '_9fKNSiW6kTLZsS9m9hTBpMXqVUeLounTntT2oDcGPsroWtaNHqk', '_3lGNtbZIh9mOKm8hZL3PROhpvTKG7FBFK3jTyBpgWAeOGsNZwXF', 'yDsNoXkyshzAxL02mxyiiJZeAqxMU5UJvRm7CFqWfZuu1UA4JDq', 'bC20ECQFeaUKjjpbYj7JzNUbABKxPmblGtSxnrd8fJWD1Y3cj5h'
Source: msedge.exe.0.dr, vgWlVAySzP7O3THtCP5fBBa6AikzpVbLuyqaYt6a7HYMS2pskOYRhMkSwgK.cs	High entropy of concatenated method names: 'MCdp7Zp68uIqZgPdX42mybfi1joiJMkaZ23ZgmN5VJh1BvsdCozsjkSW29l', '_3rdwbmqIu9p4butVFLN998AEtSxqG5GyXyeHWmVrvATPEsef1ckjuBsMEjX', 'cdvBzfV4v548QpITVIDo3ChkOsJ4jdpejK33mesrb6RjAbUuDl2bK7NfJxy', 'RIW6O7j7AkgymKbW28KXD8vUL2un5yEvCwtIetfquQcPfrVlzznFLeTwvfc', '_5vdcV98mboiVc359mw22qkNRhmE7fzbwlve96tQe4gUYL429YdiPS4kTxpZ', '_8FI8dtlQJr77FXsF0sl5Ce3GIZ1Zxla8wPtFcMubB2Gbg8WVNGck9jBSCMA', 'ktopJNH9Fp8JYB3f7NXEh6P7NtVmGLCyXuwh3PB9IICJdhN7qTB5xddWXeL', 'KD8WEl8KFcAh2LBnRBYUgT3SXZN9d4BbqVxNcLyXYLx8BHQWOXXO6yVShtG', 'dBcxQ1vZlmaJY331k9mXDSJYgg1Nj0OpeTqxPr0xtNN6iSYzZemHFNXMV1n', 'twXtoURXiH5dZKAP01ZmZo0jem0dhWFX1C70v8sqzgsVCQgcrvNKODdhOwB'
Source: msedge.exe.0.dr, BvR5v2WPH73iyYsHaICgMTE43JF2DmBfOVTs9UMyEfyeq0zbjewa6QcG1ac.cs	High entropy of concatenated method names: 'xWAPJ85EEw6cputoAkYJxOyo9g9JdYvi66fcjj5xRj1TV6QUumbN7Ry4A0G', 'MYGsHkoP4vija1zhSZPQnAFxn2wkOckwtcNqTzKxN89HcWXjG3QG5ipyznc', 'zgbbb3qQFs7CAYfCHvNiqaNU75in3cmgbvTtc7mnt33lBlDLb5VHdtsCvN6', 'WRXGPidRBVP5p8bSZBmVZLZdYqFhdwtuQpVVq0GPFoQywosgY2QNGft39AW', 'zNaR3azFSwOWB5ydKLB8BQQuC2cogNCCNqRPi8H2hd2JZUn6bgVf138w2b1', 'LSJ5RzuDfa4gjH20qPxhQdIpf1N8Ib5TRj6QqDOT3oqansbBYFhav84Cgv1', 'qnR1OGpcUdIunKF66SgSerFLDxRzhEYESHVXkQlOxNaAUS1JEmrrxYq4lvJ', 'BwQgFYCK4gQM8LcnwELGBO4UPbz0ERGJfPMAy8w4RHHbqOiJzEIliFKv2e2', 'whtFbWjvYHHHhmbx84hSZ5gM8nrNtmH3yKVn2ISRLsaWba66Fe3FkCUR7Hg', '_1KuqfXFITQeYyvd01e1SG158xpK6JAbVWt8bS05rWf7JZRov7pC31N1VeFh'
Source: msedge.exe.0.dr, K3EtGcFLetA04ODNdK5g4Tlc3zyYrVKESf.cs	High entropy of concatenated method names: 'DFls8uDkadRWFVBNw8WktDBnRfPsv3rWzJ', 'nHTtaLtmRlob1IlRbBSDxI1iXOjfx5x2Zx0OmCx9JGz5HE9Fah64Ldy4kBDXyJiNUJ0ac', 'PYoPnnHBtvWp1kpYmUtpCYAN7Td7NgBR2zzEk9BMqWKiNbVbdpp3UmT3UewXb9tiyIZMb', 'agCW5GDgWjXEGFvQhM4Ixonr0NbtRkYRfQXZSRK1jzpGcXxVzcKEXaBEVk6CyooiuVcDu', 'cvvuUjaoHcVpvTqcIlcXpawOgR79ftSYRg2yuaBrY2WrV93sQp9kGAOs2zcKpPJK51CKp'
Source: msedge.exe.0.dr, s1zDChMR3v6pFTdTev1irCmHmU1wJwIWDbDCRbkB04x0k5VFirFGX15ek7YyWoQgechSINTmzW2Z0zYsJQCYgEg0npXA.cs	High entropy of concatenated method names: '_4I7FHtah9ZHtwnhrBn7BgWR8enKypo9kuVRdOYdguDegM5e6St4ccacTNV9V1c7ShoVaNudWwx2ZZlUgv4uyee63oT4x', 'DGOhZm2kY6a41lNzUAO7Jv94x7DBFG4HFfb93sGOOZ9YfaI44JdpDbf5KVCxlZLQzdkK7PL4P9rrVFNN7gXvyynX3xNK', 'dcTkVmnN5jD1wd31jQjqfIZYwTsNmS93DU58HWrA3FT93LgA4Gs7bU8AVZw9QXofTSqVDIRNfhPQBH9D12JcJg2Onsdl', 'FlnbQ5Y4dlNRbFi0auRh1Xvv8d0QNwTQR85qt1hzV58cbrawr08e88UyuNkNwB8pLDLGZ0Qhxv2BGMN1fO1QO3N5ZhU1', '_74fVxMYuNqHfDzB13sg6C5ITRxn4xexPJrPX7V81gl1y81BL6AuzqB2c4xlzkdUHb40KYimUrpCUlF7rnCqQYtACF3Ji', '_7tGmT2Wg5h5kkF4vDiAE6BH9mrhcq0HBgwRakuJ2kgL9afPXD4hAOMyrueJemC5846ISkVXxivZBp9Mi7EaPqZqXWnGD', '_7JLXlGlwkSuct6Kp5eHUfAAmUJxQuLohzxYVcm96E7gnb1Lnhun7rmagRrLGQIsu8CxcUjftCcVFvU0rDNXBi4708Mta', 'L1ha6jStyHqTtSmY0TQL0RPNRzx5L0Aps85U3uJjO6Av4yaAboT0IVCp0AA9QiV92XIssNazhsrf4rRcXFfJXROwBwnF', 'TGomXW7PpfX7coWdD02EZkzbdu85mq6HmGne9rW3kJDR7Wop9jGYBCO9DRf10DGLvbl9KvqlSQ57EGwmxLdLaw2HHCAc', 'zIt5aLiqzmQYh43rmy2baovzJo9hCPyTeXihOIa1yiau43zmJ0iIyjFPjz6QtaVTKDZTTDg6s18SjCBjUOlCRb8mZ7Hj'
Source: msedge.exe.0.dr, z0ejMO0H72Lgpu4KAimc0W6XopbPWmkq6t.cs	High entropy of concatenated method names: 'ikfRuUei3gZqMOIcVl5ucGZnLO1KieMb2r', 'Xy20OXrOKuK2CWGzmRrDcrS5PUHtqBiZBP', 'kMQKD36wRFbYUvcd1jhgNXxg2AaNaTf2e5', 'ywaCHtqx4FrhV8zelZjA2rcATGscWHpmf7', 'wxg5bV6r7EkR6gbbzleGXxb5S94ORbEpVO', 'BqOssfaMgvqjPqGCkCgHWNCBdi3MpeFd3i', 'DA2s8ELlaW2Rxgyv35ISpZAcmYy1H1yCPu', 'BGbfuIOFRXuV4w6oE17Jt9s87xKxVu20re', 'IeXIFqYGYs2E5rC8HZZDOpgkngoZuyS3sW', '_8YiIOLrg6qMiShgij0tPyI1SQ41IznKNTK'
Source: msedge.exe.0.dr, q4EXxgqFBVfebrrJRQRZsnHCyCxnnRNNkx.cs	High entropy of concatenated method names: 'UzJlsKhqZj8jO29IZ4HiWvfNK1L8hjUSt3', 'APgyezhcHTrtvaXJHHFg7ynSvUZ8CZqWeZ', 's4nAyMN3s82zj5I6ZWhX4AVZfy0P1wXPuC', 'Tdf8ibS05oGw5qvUMQdcbsxEjsBFSvyJDv', 'FcO6LKpu7ljOfDRDMksS3S9b7eL7HMnxlO', 'y4XfJOuqzs60tQfr7P87Vjy6ztHDodDk9y', 'xZm29jVp2tZThckkUtqfTEhMwv3wSEGwSz', '_66LBAj82u6thVVKFs1srk1oVo7ZFavKRtR', 'HPdVNxIjLXJ0wO2jp7CfZVmQYokzEtGPPe', 'VVvvKG2lnskD3hjyThQf0zirWxxHp27vfz'
Source: msedge.exe.0.dr, vzNrDBdAQYZ7dTTheTLxGK4cw4WdNxOiqz.cs	High entropy of concatenated method names: 'GIuD7Apa0GbB9885TWo6NIvqkZu5Ogg7QS', 'oc2J6qnUjBHgZeqPmgzsBwuI8SiCh3GnuJ', 'FKGhoNNCnkTAL8hWl4TJN5Fth1vRFxegHk', 'V9DqPlsHPnIRk6U8cl4pSeOVs1VuanK3EN', 'rKKgMSHwysVmPDOuWXx7huykclWL8JMxySHhb7RRDZDPEmyoHIRJLOzT63UwDuDI5WOL5', 'y523m5NYA0NorLhvhQNwdMbTNqKC01OVX4pW3FkiRADbhkx3SMqt1j1A0wpyeLYKP6Q1C', 'JAgrqIoz7cYZlP6PsJWqlOEq2F6j6zJG2GrYVpH0Y3LC3moJk7sY9JK1hAGqrrPujFWHZ', 'CI3tgTWTbLa19T1PlDjBab35adeNaHaNuCTws53DzdFxiq5g0dlgEL1EvBe9B0YsOwVBx', 'XphGSTIWdYBcyc2aLeenOJLuZy2OY8iCchPIHRKFjt5qyjXy1aAwD8wosyssHgKLmTfPg', 'Im8fgnSLfrxxiRoPBm2eyn6e9qY810BLWmL5zLyTYux92Pa6rhNuSyD1AYnfD3zramnP0'
Source: msedge.exe.0.dr, 6M7XeKP2IA69yV7J0faCjVkgqAaozD2eyJ.cs	High entropy of concatenated method names: '_2vEvgeGrHTniH7RRVuhNyiVkAYrQ6YLB1s', 'xzAqkEHwHXToJuORnFs5PSuwXHotfkQf4Ioc6', 'Y2vPj8ZvUvOFnNz7xqdqEI3bGzd0NSbKtYnLp', 'M3Vco5RvnJO5YoUPzloxreC4cKvmCD0aKpnuG', '_5zHi8xTbXMp5bSc30l8Mz2egbPdG37iaq4FfY'
Source: 0.0.IAdjMfB2A5.exe.7ff674462000.1.raw.unpack, fZxKo0R9gHXQ0DMv7wrFv6fFWuutND4Wdo1mB77p7ZNRdJblVPPI5huPpT2DEdZ2Ht289mbNLK.cs	High entropy of concatenated method names: 'DPhQWJD5QH2AzOs5GCIYUUZPuvJXhEUeY4bw80lQKW0mObYjUqV', 'mmPsJknc0rusxKZKeoibNNOORCVDsB0F6I7Kt7lOQ6Az5LtBHTB', '_5Up93SMffx1to9iPBZPUyd0O0A3539oHRFZxzyV0r1Xw6Hr5uQx', 'UdFaYg9FvK9X7hceozvN1ZRoGJNMICF5Ck3kLRs2S3Upx653V9p'
Source: 0.0.IAdjMfB2A5.exe.7ff674462000.1.raw.unpack, llh7f0sYaLxi6yXrfPaBFl6UJCVXBttiOH.cs	High entropy of concatenated method names: 'PfAjvP7x5wLaIINw0FvZiN16SipvlSBDa1', 'QDHD5swMYFyK3NYnES67tyzqyWwmatDRYr', 'lvzcn3KcfH0l7qGq41a', 'OcDBnUMjjag', '_2YhPpzzAPV4', 'XRr0zdN2GI1', 'Vh8GEsuwkJo', 'FOn8clLHeys', 'MZ696AQzbZM', '_2krcbn3HX0V'
Source: 0.0.IAdjMfB2A5.exe.7ff674462000.1.raw.unpack, K6WhBlaIGoubgiXm85xVKg90d70tAEzArIMwc4ieBc.cs	High entropy of concatenated method names: 'Equals', 'GetHashCode', 'GetType', 'ToString', 'Create__Instance__', 'Dispose__Instance__', '_9fKNSiW6kTLZsS9m9hTBpMXqVUeLounTntT2oDcGPsroWtaNHqk', '_3lGNtbZIh9mOKm8hZL3PROhpvTKG7FBFK3jTyBpgWAeOGsNZwXF', 'yDsNoXkyshzAxL02mxyiiJZeAqxMU5UJvRm7CFqWfZuu1UA4JDq', 'bC20ECQFeaUKjjpbYj7JzNUbABKxPmblGtSxnrd8fJWD1Y3cj5h'
Source: 0.0.IAdjMfB2A5.exe.7ff674462000.1.raw.unpack, vgWlVAySzP7O3THtCP5fBBa6AikzpVbLuyqaYt6a7HYMS2pskOYRhMkSwgK.cs	High entropy of concatenated method names: 'MCdp7Zp68uIqZgPdX42mybfi1joiJMkaZ23ZgmN5VJh1BvsdCozsjkSW29l', '_3rdwbmqIu9p4butVFLN998AEtSxqG5GyXyeHWmVrvATPEsef1ckjuBsMEjX', 'cdvBzfV4v548QpITVIDo3ChkOsJ4jdpejK33mesrb6RjAbUuDl2bK7NfJxy', 'RIW6O7j7AkgymKbW28KXD8vUL2un5yEvCwtIetfquQcPfrVlzznFLeTwvfc', '_5vdcV98mboiVc359mw22qkNRhmE7fzbwlve96tQe4gUYL429YdiPS4kTxpZ', '_8FI8dtlQJr77FXsF0sl5Ce3GIZ1Zxla8wPtFcMubB2Gbg8WVNGck9jBSCMA', 'ktopJNH9Fp8JYB3f7NXEh6P7NtVmGLCyXuwh3PB9IICJdhN7qTB5xddWXeL', 'KD8WEl8KFcAh2LBnRBYUgT3SXZN9d4BbqVxNcLyXYLx8BHQWOXXO6yVShtG', 'dBcxQ1vZlmaJY331k9mXDSJYgg1Nj0OpeTqxPr0xtNN6iSYzZemHFNXMV1n', 'twXtoURXiH5dZKAP01ZmZo0jem0dhWFX1C70v8sqzgsVCQgcrvNKODdhOwB'
Source: 0.0.IAdjMfB2A5.exe.7ff674462000.1.raw.unpack, BvR5v2WPH73iyYsHaICgMTE43JF2DmBfOVTs9UMyEfyeq0zbjewa6QcG1ac.cs	High entropy of concatenated method names: 'xWAPJ85EEw6cputoAkYJxOyo9g9JdYvi66fcjj5xRj1TV6QUumbN7Ry4A0G', 'MYGsHkoP4vija1zhSZPQnAFxn2wkOckwtcNqTzKxN89HcWXjG3QG5ipyznc', 'zgbbb3qQFs7CAYfCHvNiqaNU75in3cmgbvTtc7mnt33lBlDLb5VHdtsCvN6', 'WRXGPidRBVP5p8bSZBmVZLZdYqFhdwtuQpVVq0GPFoQywosgY2QNGft39AW', 'zNaR3azFSwOWB5ydKLB8BQQuC2cogNCCNqRPi8H2hd2JZUn6bgVf138w2b1', 'LSJ5RzuDfa4gjH20qPxhQdIpf1N8Ib5TRj6QqDOT3oqansbBYFhav84Cgv1', 'qnR1OGpcUdIunKF66SgSerFLDxRzhEYESHVXkQlOxNaAUS1JEmrrxYq4lvJ', 'BwQgFYCK4gQM8LcnwELGBO4UPbz0ERGJfPMAy8w4RHHbqOiJzEIliFKv2e2', 'whtFbWjvYHHHhmbx84hSZ5gM8nrNtmH3yKVn2ISRLsaWba66Fe3FkCUR7Hg', '_1KuqfXFITQeYyvd01e1SG158xpK6JAbVWt8bS05rWf7JZRov7pC31N1VeFh'
Source: 0.0.IAdjMfB2A5.exe.7ff674462000.1.raw.unpack, K3EtGcFLetA04ODNdK5g4Tlc3zyYrVKESf.cs	High entropy of concatenated method names: 'DFls8uDkadRWFVBNw8WktDBnRfPsv3rWzJ', 'nHTtaLtmRlob1IlRbBSDxI1iXOjfx5x2Zx0OmCx9JGz5HE9Fah64Ldy4kBDXyJiNUJ0ac', 'PYoPnnHBtvWp1kpYmUtpCYAN7Td7NgBR2zzEk9BMqWKiNbVbdpp3UmT3UewXb9tiyIZMb', 'agCW5GDgWjXEGFvQhM4Ixonr0NbtRkYRfQXZSRK1jzpGcXxVzcKEXaBEVk6CyooiuVcDu', 'cvvuUjaoHcVpvTqcIlcXpawOgR79ftSYRg2yuaBrY2WrV93sQp9kGAOs2zcKpPJK51CKp'
Source: 0.0.IAdjMfB2A5.exe.7ff674462000.1.raw.unpack, s1zDChMR3v6pFTdTev1irCmHmU1wJwIWDbDCRbkB04x0k5VFirFGX15ek7YyWoQgechSINTmzW2Z0zYsJQCYgEg0npXA.cs	High entropy of concatenated method names: '_4I7FHtah9ZHtwnhrBn7BgWR8enKypo9kuVRdOYdguDegM5e6St4ccacTNV9V1c7ShoVaNudWwx2ZZlUgv4uyee63oT4x', 'DGOhZm2kY6a41lNzUAO7Jv94x7DBFG4HFfb93sGOOZ9YfaI44JdpDbf5KVCxlZLQzdkK7PL4P9rrVFNN7gXvyynX3xNK', 'dcTkVmnN5jD1wd31jQjqfIZYwTsNmS93DU58HWrA3FT93LgA4Gs7bU8AVZw9QXofTSqVDIRNfhPQBH9D12JcJg2Onsdl', 'FlnbQ5Y4dlNRbFi0auRh1Xvv8d0QNwTQR85qt1hzV58cbrawr08e88UyuNkNwB8pLDLGZ0Qhxv2BGMN1fO1QO3N5ZhU1', '_74fVxMYuNqHfDzB13sg6C5ITRxn4xexPJrPX7V81gl1y81BL6AuzqB2c4xlzkdUHb40KYimUrpCUlF7rnCqQYtACF3Ji', '_7tGmT2Wg5h5kkF4vDiAE6BH9mrhcq0HBgwRakuJ2kgL9afPXD4hAOMyrueJemC5846ISkVXxivZBp9Mi7EaPqZqXWnGD', '_7JLXlGlwkSuct6Kp5eHUfAAmUJxQuLohzxYVcm96E7gnb1Lnhun7rmagRrLGQIsu8CxcUjftCcVFvU0rDNXBi4708Mta', 'L1ha6jStyHqTtSmY0TQL0RPNRzx5L0Aps85U3uJjO6Av4yaAboT0IVCp0AA9QiV92XIssNazhsrf4rRcXFfJXROwBwnF', 'TGomXW7PpfX7coWdD02EZkzbdu85mq6HmGne9rW3kJDR7Wop9jGYBCO9DRf10DGLvbl9KvqlSQ57EGwmxLdLaw2HHCAc', 'zIt5aLiqzmQYh43rmy2baovzJo9hCPyTeXihOIa1yiau43zmJ0iIyjFPjz6QtaVTKDZTTDg6s18SjCBjUOlCRb8mZ7Hj'
Source: 0.0.IAdjMfB2A5.exe.7ff674462000.1.raw.unpack, z0ejMO0H72Lgpu4KAimc0W6XopbPWmkq6t.cs	High entropy of concatenated method names: 'ikfRuUei3gZqMOIcVl5ucGZnLO1KieMb2r', 'Xy20OXrOKuK2CWGzmRrDcrS5PUHtqBiZBP', 'kMQKD36wRFbYUvcd1jhgNXxg2AaNaTf2e5', 'ywaCHtqx4FrhV8zelZjA2rcATGscWHpmf7', 'wxg5bV6r7EkR6gbbzleGXxb5S94ORbEpVO', 'BqOssfaMgvqjPqGCkCgHWNCBdi3MpeFd3i', 'DA2s8ELlaW2Rxgyv35ISpZAcmYy1H1yCPu', 'BGbfuIOFRXuV4w6oE17Jt9s87xKxVu20re', 'IeXIFqYGYs2E5rC8HZZDOpgkngoZuyS3sW', '_8YiIOLrg6qMiShgij0tPyI1SQ41IznKNTK'
Source: 0.0.IAdjMfB2A5.exe.7ff674462000.1.raw.unpack, q4EXxgqFBVfebrrJRQRZsnHCyCxnnRNNkx.cs	High entropy of concatenated method names: 'UzJlsKhqZj8jO29IZ4HiWvfNK1L8hjUSt3', 'APgyezhcHTrtvaXJHHFg7ynSvUZ8CZqWeZ', 's4nAyMN3s82zj5I6ZWhX4AVZfy0P1wXPuC', 'Tdf8ibS05oGw5qvUMQdcbsxEjsBFSvyJDv', 'FcO6LKpu7ljOfDRDMksS3S9b7eL7HMnxlO', 'y4XfJOuqzs60tQfr7P87Vjy6ztHDodDk9y', 'xZm29jVp2tZThckkUtqfTEhMwv3wSEGwSz', '_66LBAj82u6thVVKFs1srk1oVo7ZFavKRtR', 'HPdVNxIjLXJ0wO2jp7CfZVmQYokzEtGPPe', 'VVvvKG2lnskD3hjyThQf0zirWxxHp27vfz'
Source: 0.0.IAdjMfB2A5.exe.7ff674462000.1.raw.unpack, vzNrDBdAQYZ7dTTheTLxGK4cw4WdNxOiqz.cs	High entropy of concatenated method names: 'GIuD7Apa0GbB9885TWo6NIvqkZu5Ogg7QS', 'oc2J6qnUjBHgZeqPmgzsBwuI8SiCh3GnuJ', 'FKGhoNNCnkTAL8hWl4TJN5Fth1vRFxegHk', 'V9DqPlsHPnIRk6U8cl4pSeOVs1VuanK3EN', 'rKKgMSHwysVmPDOuWXx7huykclWL8JMxySHhb7RRDZDPEmyoHIRJLOzT63UwDuDI5WOL5', 'y523m5NYA0NorLhvhQNwdMbTNqKC01OVX4pW3FkiRADbhkx3SMqt1j1A0wpyeLYKP6Q1C', 'JAgrqIoz7cYZlP6PsJWqlOEq2F6j6zJG2GrYVpH0Y3LC3moJk7sY9JK1hAGqrrPujFWHZ', 'CI3tgTWTbLa19T1PlDjBab35adeNaHaNuCTws53DzdFxiq5g0dlgEL1EvBe9B0YsOwVBx', 'XphGSTIWdYBcyc2aLeenOJLuZy2OY8iCchPIHRKFjt5qyjXy1aAwD8wosyssHgKLmTfPg', 'Im8fgnSLfrxxiRoPBm2eyn6e9qY810BLWmL5zLyTYux92Pa6rhNuSyD1AYnfD3zramnP0'
Source: 0.0.IAdjMfB2A5.exe.7ff674462000.1.raw.unpack, 6M7XeKP2IA69yV7J0faCjVkgqAaozD2eyJ.cs	High entropy of concatenated method names: '_2vEvgeGrHTniH7RRVuhNyiVkAYrQ6YLB1s', 'xzAqkEHwHXToJuORnFs5PSuwXHotfkQf4Ioc6', 'Y2vPj8ZvUvOFnNz7xqdqEI3bGzd0NSbKtYnLp', 'M3Vco5RvnJO5YoUPzloxreC4cKvmCD0aKpnuG', '_5zHi8xTbXMp5bSc30l8Mz2egbPdG37iaq4FfY'
Source: 0.2.IAdjMfB2A5.exe.7ff674462000.1.raw.unpack, fZxKo0R9gHXQ0DMv7wrFv6fFWuutND4Wdo1mB77p7ZNRdJblVPPI5huPpT2DEdZ2Ht289mbNLK.cs	High entropy of concatenated method names: 'DPhQWJD5QH2AzOs5GCIYUUZPuvJXhEUeY4bw80lQKW0mObYjUqV', 'mmPsJknc0rusxKZKeoibNNOORCVDsB0F6I7Kt7lOQ6Az5LtBHTB', '_5Up93SMffx1to9iPBZPUyd0O0A3539oHRFZxzyV0r1Xw6Hr5uQx', 'UdFaYg9FvK9X7hceozvN1ZRoGJNMICF5Ck3kLRs2S3Upx653V9p'
Source: 0.2.IAdjMfB2A5.exe.7ff674462000.1.raw.unpack, llh7f0sYaLxi6yXrfPaBFl6UJCVXBttiOH.cs	High entropy of concatenated method names: 'PfAjvP7x5wLaIINw0FvZiN16SipvlSBDa1', 'QDHD5swMYFyK3NYnES67tyzqyWwmatDRYr', 'lvzcn3KcfH0l7qGq41a', 'OcDBnUMjjag', '_2YhPpzzAPV4', 'XRr0zdN2GI1', 'Vh8GEsuwkJo', 'FOn8clLHeys', 'MZ696AQzbZM', '_2krcbn3HX0V'
Source: 0.2.IAdjMfB2A5.exe.7ff674462000.1.raw.unpack, K6WhBlaIGoubgiXm85xVKg90d70tAEzArIMwc4ieBc.cs	High entropy of concatenated method names: 'Equals', 'GetHashCode', 'GetType', 'ToString', 'Create__Instance__', 'Dispose__Instance__', '_9fKNSiW6kTLZsS9m9hTBpMXqVUeLounTntT2oDcGPsroWtaNHqk', '_3lGNtbZIh9mOKm8hZL3PROhpvTKG7FBFK3jTyBpgWAeOGsNZwXF', 'yDsNoXkyshzAxL02mxyiiJZeAqxMU5UJvRm7CFqWfZuu1UA4JDq', 'bC20ECQFeaUKjjpbYj7JzNUbABKxPmblGtSxnrd8fJWD1Y3cj5h'
Source: 0.2.IAdjMfB2A5.exe.7ff674462000.1.raw.unpack, vgWlVAySzP7O3THtCP5fBBa6AikzpVbLuyqaYt6a7HYMS2pskOYRhMkSwgK.cs	High entropy of concatenated method names: 'MCdp7Zp68uIqZgPdX42mybfi1joiJMkaZ23ZgmN5VJh1BvsdCozsjkSW29l', '_3rdwbmqIu9p4butVFLN998AEtSxqG5GyXyeHWmVrvATPEsef1ckjuBsMEjX', 'cdvBzfV4v548QpITVIDo3ChkOsJ4jdpejK33mesrb6RjAbUuDl2bK7NfJxy', 'RIW6O7j7AkgymKbW28KXD8vUL2un5yEvCwtIetfquQcPfrVlzznFLeTwvfc', '_5vdcV98mboiVc359mw22qkNRhmE7fzbwlve96tQe4gUYL429YdiPS4kTxpZ', '_8FI8dtlQJr77FXsF0sl5Ce3GIZ1Zxla8wPtFcMubB2Gbg8WVNGck9jBSCMA', 'ktopJNH9Fp8JYB3f7NXEh6P7NtVmGLCyXuwh3PB9IICJdhN7qTB5xddWXeL', 'KD8WEl8KFcAh2LBnRBYUgT3SXZN9d4BbqVxNcLyXYLx8BHQWOXXO6yVShtG', 'dBcxQ1vZlmaJY331k9mXDSJYgg1Nj0OpeTqxPr0xtNN6iSYzZemHFNXMV1n', 'twXtoURXiH5dZKAP01ZmZo0jem0dhWFX1C70v8sqzgsVCQgcrvNKODdhOwB'
Source: 0.2.IAdjMfB2A5.exe.7ff674462000.1.raw.unpack, BvR5v2WPH73iyYsHaICgMTE43JF2DmBfOVTs9UMyEfyeq0zbjewa6QcG1ac.cs	High entropy of concatenated method names: 'xWAPJ85EEw6cputoAkYJxOyo9g9JdYvi66fcjj5xRj1TV6QUumbN7Ry4A0G', 'MYGsHkoP4vija1zhSZPQnAFxn2wkOckwtcNqTzKxN89HcWXjG3QG5ipyznc', 'zgbbb3qQFs7CAYfCHvNiqaNU75in3cmgbvTtc7mnt33lBlDLb5VHdtsCvN6', 'WRXGPidRBVP5p8bSZBmVZLZdYqFhdwtuQpVVq0GPFoQywosgY2QNGft39AW', 'zNaR3azFSwOWB5ydKLB8BQQuC2cogNCCNqRPi8H2hd2JZUn6bgVf138w2b1', 'LSJ5RzuDfa4gjH20qPxhQdIpf1N8Ib5TRj6QqDOT3oqansbBYFhav84Cgv1', 'qnR1OGpcUdIunKF66SgSerFLDxRzhEYESHVXkQlOxNaAUS1JEmrrxYq4lvJ', 'BwQgFYCK4gQM8LcnwELGBO4UPbz0ERGJfPMAy8w4RHHbqOiJzEIliFKv2e2', 'whtFbWjvYHHHhmbx84hSZ5gM8nrNtmH3yKVn2ISRLsaWba66Fe3FkCUR7Hg', '_1KuqfXFITQeYyvd01e1SG158xpK6JAbVWt8bS05rWf7JZRov7pC31N1VeFh'
Source: 0.2.IAdjMfB2A5.exe.7ff674462000.1.raw.unpack, K3EtGcFLetA04ODNdK5g4Tlc3zyYrVKESf.cs	High entropy of concatenated method names: 'DFls8uDkadRWFVBNw8WktDBnRfPsv3rWzJ', 'nHTtaLtmRlob1IlRbBSDxI1iXOjfx5x2Zx0OmCx9JGz5HE9Fah64Ldy4kBDXyJiNUJ0ac', 'PYoPnnHBtvWp1kpYmUtpCYAN7Td7NgBR2zzEk9BMqWKiNbVbdpp3UmT3UewXb9tiyIZMb', 'agCW5GDgWjXEGFvQhM4Ixonr0NbtRkYRfQXZSRK1jzpGcXxVzcKEXaBEVk6CyooiuVcDu', 'cvvuUjaoHcVpvTqcIlcXpawOgR79ftSYRg2yuaBrY2WrV93sQp9kGAOs2zcKpPJK51CKp'
Source: 0.2.IAdjMfB2A5.exe.7ff674462000.1.raw.unpack, s1zDChMR3v6pFTdTev1irCmHmU1wJwIWDbDCRbkB04x0k5VFirFGX15ek7YyWoQgechSINTmzW2Z0zYsJQCYgEg0npXA.cs	High entropy of concatenated method names: '_4I7FHtah9ZHtwnhrBn7BgWR8enKypo9kuVRdOYdguDegM5e6St4ccacTNV9V1c7ShoVaNudWwx2ZZlUgv4uyee63oT4x', 'DGOhZm2kY6a41lNzUAO7Jv94x7DBFG4HFfb93sGOOZ9YfaI44JdpDbf5KVCxlZLQzdkK7PL4P9rrVFNN7gXvyynX3xNK', 'dcTkVmnN5jD1wd31jQjqfIZYwTsNmS93DU58HWrA3FT93LgA4Gs7bU8AVZw9QXofTSqVDIRNfhPQBH9D12JcJg2Onsdl', 'FlnbQ5Y4dlNRbFi0auRh1Xvv8d0QNwTQR85qt1hzV58cbrawr08e88UyuNkNwB8pLDLGZ0Qhxv2BGMN1fO1QO3N5ZhU1', '_74fVxMYuNqHfDzB13sg6C5ITRxn4xexPJrPX7V81gl1y81BL6AuzqB2c4xlzkdUHb40KYimUrpCUlF7rnCqQYtACF3Ji', '_7tGmT2Wg5h5kkF4vDiAE6BH9mrhcq0HBgwRakuJ2kgL9afPXD4hAOMyrueJemC5846ISkVXxivZBp9Mi7EaPqZqXWnGD', '_7JLXlGlwkSuct6Kp5eHUfAAmUJxQuLohzxYVcm96E7gnb1Lnhun7rmagRrLGQIsu8CxcUjftCcVFvU0rDNXBi4708Mta', 'L1ha6jStyHqTtSmY0TQL0RPNRzx5L0Aps85U3uJjO6Av4yaAboT0IVCp0AA9QiV92XIssNazhsrf4rRcXFfJXROwBwnF', 'TGomXW7PpfX7coWdD02EZkzbdu85mq6HmGne9rW3kJDR7Wop9jGYBCO9DRf10DGLvbl9KvqlSQ57EGwmxLdLaw2HHCAc', 'zIt5aLiqzmQYh43rmy2baovzJo9hCPyTeXihOIa1yiau43zmJ0iIyjFPjz6QtaVTKDZTTDg6s18SjCBjUOlCRb8mZ7Hj'
Source: 0.2.IAdjMfB2A5.exe.7ff674462000.1.raw.unpack, z0ejMO0H72Lgpu4KAimc0W6XopbPWmkq6t.cs	High entropy of concatenated method names: 'ikfRuUei3gZqMOIcVl5ucGZnLO1KieMb2r', 'Xy20OXrOKuK2CWGzmRrDcrS5PUHtqBiZBP', 'kMQKD36wRFbYUvcd1jhgNXxg2AaNaTf2e5', 'ywaCHtqx4FrhV8zelZjA2rcATGscWHpmf7', 'wxg5bV6r7EkR6gbbzleGXxb5S94ORbEpVO', 'BqOssfaMgvqjPqGCkCgHWNCBdi3MpeFd3i', 'DA2s8ELlaW2Rxgyv35ISpZAcmYy1H1yCPu', 'BGbfuIOFRXuV4w6oE17Jt9s87xKxVu20re', 'IeXIFqYGYs2E5rC8HZZDOpgkngoZuyS3sW', '_8YiIOLrg6qMiShgij0tPyI1SQ41IznKNTK'
Source: 0.2.IAdjMfB2A5.exe.7ff674462000.1.raw.unpack, q4EXxgqFBVfebrrJRQRZsnHCyCxnnRNNkx.cs	High entropy of concatenated method names: 'UzJlsKhqZj8jO29IZ4HiWvfNK1L8hjUSt3', 'APgyezhcHTrtvaXJHHFg7ynSvUZ8CZqWeZ', 's4nAyMN3s82zj5I6ZWhX4AVZfy0P1wXPuC', 'Tdf8ibS05oGw5qvUMQdcbsxEjsBFSvyJDv', 'FcO6LKpu7ljOfDRDMksS3S9b7eL7HMnxlO', 'y4XfJOuqzs60tQfr7P87Vjy6ztHDodDk9y', 'xZm29jVp2tZThckkUtqfTEhMwv3wSEGwSz', '_66LBAj82u6thVVKFs1srk1oVo7ZFavKRtR', 'HPdVNxIjLXJ0wO2jp7CfZVmQYokzEtGPPe', 'VVvvKG2lnskD3hjyThQf0zirWxxHp27vfz'
Source: 0.2.IAdjMfB2A5.exe.7ff674462000.1.raw.unpack, vzNrDBdAQYZ7dTTheTLxGK4cw4WdNxOiqz.cs	High entropy of concatenated method names: 'GIuD7Apa0GbB9885TWo6NIvqkZu5Ogg7QS', 'oc2J6qnUjBHgZeqPmgzsBwuI8SiCh3GnuJ', 'FKGhoNNCnkTAL8hWl4TJN5Fth1vRFxegHk', 'V9DqPlsHPnIRk6U8cl4pSeOVs1VuanK3EN', 'rKKgMSHwysVmPDOuWXx7huykclWL8JMxySHhb7RRDZDPEmyoHIRJLOzT63UwDuDI5WOL5', 'y523m5NYA0NorLhvhQNwdMbTNqKC01OVX4pW3FkiRADbhkx3SMqt1j1A0wpyeLYKP6Q1C', 'JAgrqIoz7cYZlP6PsJWqlOEq2F6j6zJG2GrYVpH0Y3LC3moJk7sY9JK1hAGqrrPujFWHZ', 'CI3tgTWTbLa19T1PlDjBab35adeNaHaNuCTws53DzdFxiq5g0dlgEL1EvBe9B0YsOwVBx', 'XphGSTIWdYBcyc2aLeenOJLuZy2OY8iCchPIHRKFjt5qyjXy1aAwD8wosyssHgKLmTfPg', 'Im8fgnSLfrxxiRoPBm2eyn6e9qY810BLWmL5zLyTYux92Pa6rhNuSyD1AYnfD3zramnP0'
Source: 0.2.IAdjMfB2A5.exe.7ff674462000.1.raw.unpack, 6M7XeKP2IA69yV7J0faCjVkgqAaozD2eyJ.cs	High entropy of concatenated method names: '_2vEvgeGrHTniH7RRVuhNyiVkAYrQ6YLB1s', 'xzAqkEHwHXToJuORnFs5PSuwXHotfkQf4Ioc6', 'Y2vPj8ZvUvOFnNz7xqdqEI3bGzd0NSbKtYnLp', 'M3Vco5RvnJO5YoUPzloxreC4cKvmCD0aKpnuG', '_5zHi8xTbXMp5bSc30l8Mz2egbPdG37iaq4FfY'

Persistence and Installation Behavior

Drops executables to the windows directory (C:\Windows) and starts them

Source: C:\Windows\System32\cmd.exe

Executable created and started: C:\Windows\msedge.exe

Check if machine is in data center or colocation facility

Source: C:\Users\user\Desktop\IAdjMfB2A5.exe

File created: C:\Windows\msedge.exe

Jump to dropped file

Source: C:\Users\user\Desktop\IAdjMfB2A5.exe

File created: C:\Windows\msedge.exe

Jump to dropped file

Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\msedge.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\msedge.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\msedge.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\msedge.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\msedge.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\msedge.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\msedge.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\msedge.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\msedge.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\msedge.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\msedge.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\msedge.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\msedge.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\msedge.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\msedge.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\msedge.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\msedge.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\msedge.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\msedge.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\msedge.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\msedge.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\msedge.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\msedge.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\msedge.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\msedge.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\msedge.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\msedge.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\msedge.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\msedge.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\msedge.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\msedge.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\msedge.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\msedge.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\msedge.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\msedge.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\msedge.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\msedge.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\msedge.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\msedge.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\msedge.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\msedge.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\msedge.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\msedge.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\msedge.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Source: global traffic

HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: IAdjMfB2A5.exe	Binary or memory string: [1;34M >NUL 2>&1-TASKKILL /IM EPICGAMESLAUNCHER.EXE /FTASKKILL /IM FORTNITECLIENT-WIN64-SHIPPING_BE.EXE /FTASKKILL /IM FORTNITECLIENT-WIN64-SHIPPING.EXE /FTASKKILL /IM X64DBG.EXECLSNET \| PERMANENT SPOOFER
Source: IAdjMfB2A5.exe, msedge.exe, 0000000D.00000002.2264433685.0000000002D4C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SBIEDLL.DLL
Source: IAdjMfB2A5.exe, msedge.exe.0.dr	Binary or memory string: SBIEDLL.DLLG4MBQDARJJASRK66WTM8W0KKYNCI0TTFT7J0FKJVWTLFQHNGNMOUGKIARDYGSO7J0BPUKMYOAIX7CGT3N2YD9HFLOXPYDBC4TK9H7VK3GGXKAS0MXBBGQ66GPWAZGSZYKF1QBEP8VO7ZWIOA2F8W6O7MAC2EGLMSRQBMOKCVE2SC6D6TSNWYZVWIIZIZHQTA70U5EDEERCUOGSKQGWXVTLZB7ZWI2K8CHWBPCPTZYJZBQE1ETPWYLU71KB13HJ6WCAWFGJF0D0DOOTXP2SFDQILWUOQRWSYYOUGZIIJGSLXDVA9OZB3SVEQTGZ2BFJHIPSMALPSRZSBVVJ1WZ3KXSQUPSM3SLQEKE7EGPMVVSFI9G7RCXVJVNBVFWY9LT8MN8RATUJRTMDRQFTZDHEQZUFRGECCQXIAXGCPYBNV8E97WPIZYELA1PJHQKWI5EQXNLHGLTZX6KQ59I2N1I9XPGORLFUPE8BLPSB2V4WBL1IXD95CGNCL9XLLHXKTGKLOOCJVPXIUUG8UOWNV6QZ8P1MPWARRLXE3NJ6VWSON4BCYPR9PS4BGTDIQEWVWJGFIBLWQUQVP63YVV0A3IGOVNFDYV2U5X6TA1RNDV6STQCPJY4BTWG7HGC8E00XNH9GHD2TF9WNLB0QBON9DT412YD8NT6RFKI7ROV9Q3GQKYKW0T7VTJRK1FLIRMUABOXUJMBAEZXRSUCGSAMGBCYLIHPMSMINFO
Source: IAdjMfB2A5.exe	Binary or memory string: TASKKILL /IM X64DBG.EXE

Source: C:\Windows\msedge.exe	Memory allocated: FF0000 memory reserve \| memory write watch			Jump to behavior
Source: C:\Windows\msedge.exe	Memory allocated: 1AD40000 memory reserve \| memory write watch			Jump to behavior

Source: C:\Windows\System32\timeout.exe TID: 3716

Thread sleep count: 40 > 30

Source: C:\Windows\msedge.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem

Source: C:\Users\user\Desktop\IAdjMfB2A5.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\msedge.exe

File Volume queried: C:\ FullSizeInformation

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Source: Amcache.hve.26.dr	Binary or memory string: VMware
Source: Amcache.hve.26.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.26.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.26.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.26.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.26.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.26.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.26.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: msedge.exe, 0000000D.00000002.2264851950.000000001BBF8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllysJ
Source: Amcache.hve.26.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.26.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.26.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.26.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: IAdjMfB2A5.exe, 00000000.00000002.2069048420.000002351B6B8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll%%
Source: Amcache.hve.26.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.26.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.26.dr	Binary or memory string: vmci.syshbin`
Source: msedge.exe.0.dr	Binary or memory string: vmware
Source: Amcache.hve.26.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.26.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.26.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.26.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.26.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.26.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.26.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.26.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.26.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.26.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.26.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.26.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.26.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.26.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Anti Debugging

Source: C:\Windows\msedge.exe

Code function: 13_2_00007FF848E1764A CheckRemoteDebuggerPresent,

13_2_00007FF848E1764A

Source: C:\Windows\msedge.exe

Process queried: DebugPort

Source: C:\Users\user\Desktop\IAdjMfB2A5.exe

Code function: 0_2_00007FF67443E718 GetLastError,IsDebuggerPresent,OutputDebugStringW,

0_2_00007FF67443E718

Source: C:\Users\user\Desktop\IAdjMfB2A5.exe

Code function: 0_2_00007FF67443E718 GetLastError,IsDebuggerPresent,OutputDebugStringW,

0_2_00007FF67443E718

Source: C:\Users\user\Desktop\IAdjMfB2A5.exe

Code function: 0_2_00007FF6743C1820 GetProcessHeap,

0_2_00007FF6743C1820

Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\msedge.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\Desktop\IAdjMfB2A5.exe

Code function: 0_2_00007FF67443E080 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

0_2_00007FF67443E080

Source: C:\Windows\msedge.exe

Memory allocated: page read and write | page guard

Source: C:\Users\user\Desktop\IAdjMfB2A5.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /IM EpicGamesLauncher.exe /F	Jump to behavior
Source: C:\Users\user\Desktop\IAdjMfB2A5.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /IM FortniteClient-Win64-Shipping_BE.exe /F	Jump to behavior
Source: C:\Users\user\Desktop\IAdjMfB2A5.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /IM FortniteClient-Win64-Shipping.exe /F	Jump to behavior
Source: C:\Users\user\Desktop\IAdjMfB2A5.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /IM x64dbg.exe	Jump to behavior
Source: C:\Users\user\Desktop\IAdjMfB2A5.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c cls	Jump to behavior
Source: C:\Users\user\Desktop\IAdjMfB2A5.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c start C:\Windows\msedge.exe	Jump to behavior
Source: C:\Users\user\Desktop\IAdjMfB2A5.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\user\Desktop\IAdjMfB2A5.exe" MD5 \| find /i /v "md5" \| find /i /v "certutil"	Jump to behavior
Source: C:\Users\user\Desktop\IAdjMfB2A5.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c start cmd /C "color b && title Error && echo SSL connect error && timeout /t 5"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM EpicGamesLauncher.exe /F	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM FortniteClient-Win64-Shipping_BE.exe /F	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM FortniteClient-Win64-Shipping.exe /F	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM x64dbg.exe	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\msedge.exe C:\Windows\msedge.exe	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\certutil.exe certutil -hashfile "C:\Users\user\Desktop\IAdjMfB2A5.exe" MD5	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /i /v "md5"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /i /v "certutil"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /C "color b && title Error && echo SSL connect error && timeout /t 5"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout /t 5	Jump to behavior

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM EpicGamesLauncher.exe /F	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM FortniteClient-Win64-Shipping_BE.exe /F	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM FortniteClient-Win64-Shipping.exe /F	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /IM x64dbg.exe	Jump to behavior

Source: C:\Users\user\Desktop\IAdjMfB2A5.exe

Code function: 0_2_00007FF67443D5C0 cpuid

0_2_00007FF67443D5C0

Source: C:\Windows\msedge.exe

Queries volume information: C:\Windows\msedge.exe VolumeInformation

Source: C:\Users\user\Desktop\IAdjMfB2A5.exe

Code function: 0_2_00007FF67443E590 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00007FF67443E590

Source: C:\Windows\msedge.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Source: Amcache.hve.26.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.26.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.26.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.26.dr	Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information

Yara detected XWorm

Source: Yara match	File source: IAdjMfB2A5.exe, type: SAMPLE
Source: Yara match	File source: 0.2.IAdjMfB2A5.exe.7ff674462000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.IAdjMfB2A5.exe.7ff674462000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.IAdjMfB2A5.exe.7ff674462000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.0.msedge.exe.a80000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.IAdjMfB2A5.exe.7ff674462000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.IAdjMfB2A5.exe.7ff6743c0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.IAdjMfB2A5.exe.7ff6743c0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000D.00000000.2036559031.0000000000A82000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.2264433685.0000000002D4C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.2025716296.00007FF674462000.00000008.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2069285543.00007FF674462000.00000008.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: IAdjMfB2A5.exe PID: 4324, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: msedge.exe PID: 764, type: MEMORYSTR
Source: Yara match	File source: C:\Windows\msedge.exe, type: DROPPED

Remote Access Functionality

Yara detected XWorm

Source: Yara match	File source: IAdjMfB2A5.exe, type: SAMPLE
Source: Yara match	File source: 0.2.IAdjMfB2A5.exe.7ff674462000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.IAdjMfB2A5.exe.7ff674462000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.IAdjMfB2A5.exe.7ff674462000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.0.msedge.exe.a80000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.IAdjMfB2A5.exe.7ff674462000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.IAdjMfB2A5.exe.7ff6743c0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.IAdjMfB2A5.exe.7ff6743c0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000D.00000000.2036559031.0000000000A82000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.2264433685.0000000002D4C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.2025716296.00007FF674462000.00000008.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2069285543.00007FF674462000.00000008.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: IAdjMfB2A5.exe PID: 4324, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: msedge.exe PID: 764, type: MEMORYSTR
Source: Yara match	File source: C:\Windows\msedge.exe, type: DROPPED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	11 Windows Management Instrumentation	1 DLL Side-Loading	11 Process Injection	12 Masquerading	OS Credential Dumping	1 System Time Discovery	Remote Services	12 Archive Collected Data	12 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	1 DLL Side-Loading	4 Virtualization/Sandbox Evasion	LSASS Memory	461 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Disable or Modify Tools	Security Account Manager	4 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Process Injection	NTDS	1 System Network Configuration Discovery	Distributed Component Object Model	Input Capture	13 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	35 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Obfuscated Files or Information	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	2 Software Packing	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
IAdjMfB2A5.exe	58%	ReversingLabs	Win64.Trojan.Dacic
IAdjMfB2A5.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Windows\msedge.exe	100%	Avira	TR/Spy.Gen
C:\Windows\msedge.exe	100%	Joe Sandbox ML
C:\Windows\msedge.exe	88%	ReversingLabs	ByteCode-MSIL.Spyware.AsyncRAT

Source	Detection	Scanner	Label	Link
45.84.199.152	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
keyauth.win	104.26.0.5	true	false		high
ip-api.com	208.95.112.1	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
45.84.199.152	true	Avira URL Cloud: safe	unknown
http://ip-api.com/line/?fields=hosting	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
http://upx.sf.net	Amcache.hve.26.dr	false	high
https://keyauth.win/api/1.2/umL	IAdjMfB2A5.exe, 00000000.00000002.2069048420.000002351B6AD000.00000004.00000020.00020000.00000000.sdmp	false	high
https://keyauth.win/api/1.2/emc	IAdjMfB2A5.exe, 00000000.00000002.2069048420.000002351B6AD000.00000004.00000020.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	msedge.exe, 0000000D.00000002.2264433685.0000000002DE9000.00000004.00000800.00020000.00000000.sdmp	false	high
https://curl.haxx.se/docs/http-cookies.html	IAdjMfB2A5.exe	false	high
https://keyauth.win/api/1.2/	IAdjMfB2A5.exe, 00000000.00000002.2069048420.000002351B6AD000.00000004.00000020.00020000.00000000.sdmp	false	high
https://keyauth.win/api/1.2/em5	IAdjMfB2A5.exe, 00000000.00000002.2069048420.000002351B6AD000.00000004.00000020.00020000.00000000.sdmp	false	high
http://ip-api.com	msedge.exe, 0000000D.00000002.2264433685.0000000002DF6000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000D.00000002.2264433685.0000000002E01000.00000004.00000800.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
208.95.112.1	ip-api.com	United States		53334	TUT-ASUS	false
104.26.0.5	keyauth.win	United States		13335	CLOUDFLARENETUS	false

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1557197
Start date and time:	2024-11-17 19:12:05 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 33s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	30
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	IAdjMfB2A5.exe renamed because original name is a hash value
Original Sample Name:	f126b1c0b4ff973d9618b7287d011b61731c2b0e5e9960c72f5ef444288aa8dc.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@41/6@2/3
EGA Information:	Successful, ratio: 50%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 20.42.73.29
Excluded domains from analysis (whitelisted): ocsp.digicert.com, login.live.com, slscr.update.microsoft.com, otelrules.azureedge.net, blobcollector.events.data.trafficmanager.net, onedsblobprdeus15.eastus.cloudapp.azure.com, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target IAdjMfB2A5.exe, PID 4324 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Report size getting too big, too many NtSetInformationFile calls found.
VT rate limit hit for: IAdjMfB2A5.exe

Simulations

Behavior and APIs

Time	Type	Description
13:13:17	API Interceptor	1x Sleep call for process: WerFault.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
208.95.112.1	EternalPredictor.exe	Get hash	malicious	Blank Grabber, Skuld Stealer, XWorm	Browse	ip-api.com/json/?fields=225545
	program.exe	Get hash	malicious	Blank Grabber	Browse	ip-api.com/json/?fields=225545
	skuld.exe	Get hash	malicious	Skuld Stealer	Browse	ip-api.com/line/?fields=hosting
	SolaraBostrappers.exe	Get hash	malicious	DCRat	Browse	ip-api.com/line/?fields=hosting
	svhost.exe	Get hash	malicious	DCRat	Browse	ip-api.com/line/?fields=hosting
	Midnight.exe	Get hash	malicious	XWorm	Browse	ip-api.com/line/?fields=hosting
	exe030.exe	Get hash	malicious	XWorm	Browse	ip-api.com/line/?fields=hosting
	GRAINS.vbs	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	SAMPLE_PHOTO.js	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	RuntimeusererVers.exe	Get hash	malicious	Python Stealer	Browse	ip-api.com/json
104.26.0.5	SecuriteInfo.com.Win64.Evo-gen.9614.31304.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.W64.GenKryptik.GHEK.tr.25144.16407.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Trojan.GenericKD.74444428.17336.1019.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Win64.CrypterX-gen.31361.18171.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Variant.Tedy.627915.599.8749.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Variant.Tedy.627915.599.8749.exe	Get hash	malicious	Unknown	Browse
	lUAc7lqa56.exe	Get hash	malicious	Unknown	Browse
	xVmySfWfcW.exe	Get hash	malicious	Unknown	Browse
	LDlanZur0i.exe	Get hash	malicious	Unknown	Browse
	xxImTScxAq.exe	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
keyauth.win	SecuriteInfo.com.Win64.Evo-gen.9614.31304.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	SecuriteInfo.com.Win64.Evo-gen.9614.31304.exe	Get hash	malicious	Unknown	Browse	172.67.72.57
	SecuriteInfo.com.W64.GenKryptik.GHEK.tr.25144.16407.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	SecuriteInfo.com.Trojan.GenericKD.74444428.17336.1019.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	SecuriteInfo.com.Win64.MalwareX-gen.31244.2279.exe	Get hash	malicious	Unknown	Browse	104.26.1.5
	SecuriteInfo.com.Trojan.GenericKD.74444428.17336.1019.exe	Get hash	malicious	Unknown	Browse	104.26.1.5
	SecuriteInfo.com.Win64.CrypterX-gen.31361.18171.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	SecuriteInfo.com.Variant.Tedy.627915.599.8749.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	SecuriteInfo.com.Variant.Tedy.627915.599.8749.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	lUAc7lqa56.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
ip-api.com	EternalPredictor.exe	Get hash	malicious	Blank Grabber, Skuld Stealer, XWorm	Browse	208.95.112.1
	program.exe	Get hash	malicious	Blank Grabber	Browse	208.95.112.1
	skuld.exe	Get hash	malicious	Skuld Stealer	Browse	208.95.112.1
	SolaraBostrappers.exe	Get hash	malicious	DCRat	Browse	208.95.112.1
	svhost.exe	Get hash	malicious	DCRat	Browse	208.95.112.1
	Midnight.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	exe030.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	GRAINS.vbs	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	SAMPLE_PHOTO.js	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	RuntimeusererVers.exe	Get hash	malicious	Python Stealer	Browse	208.95.112.1

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, LummaC Stealer, Panda Stealer, Stealc	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC, Stealc	Browse	188.114.97.3
	https://deliversystand.com/	Get hash	malicious	Unknown	Browse	172.67.145.172
	https://deliversystand.com/	Get hash	malicious	Unknown	Browse	172.67.145.172
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	https://www.yumpu.com/en/document/read/69141128/newreviewreportsheet1124	Get hash	malicious	Unknown	Browse	104.18.86.42
TUT-ASUS	EternalPredictor.exe	Get hash	malicious	Blank Grabber, Skuld Stealer, XWorm	Browse	208.95.112.1
	program.exe	Get hash	malicious	Blank Grabber	Browse	208.95.112.1
	skuld.exe	Get hash	malicious	Skuld Stealer	Browse	208.95.112.1
	SolaraBostrappers.exe	Get hash	malicious	DCRat	Browse	208.95.112.1
	svhost.exe	Get hash	malicious	DCRat	Browse	208.95.112.1
	Midnight.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	exe030.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	GRAINS.vbs	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	https://t.ly/-kxCO	Get hash	malicious	Braodo	Browse	208.95.112.1
	SAMPLE_PHOTO.js	Get hash	malicious	AgentTesla	Browse	208.95.112.1

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ce5f3254611a8c095a3d821d44539877	SecuriteInfo.com.Win64.MalwareX-gen.26402.21423.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	SecuriteInfo.com.W64.GenKryptik.GHEK.tr.25144.16407.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	SecuriteInfo.com.Win64.MalwareX-gen.31244.2279.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	SecuriteInfo.com.Win64.CrypterX-gen.31361.18171.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	SecuriteInfo.com.Variant.Tedy.627915.599.8749.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	SecuriteInfo.com.Variant.Tedy.627915.599.8749.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	lUAc7lqa56.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	SecuriteInfo.com.FileRepMalware.12632.12594.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	SecuriteInfo.com.FileRepMalware.8628.17723.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	SecuriteInfo.com.Win64.MalwareX-gen.29573.28124.exe	Get hash	malicious	Unknown	Browse	104.26.0.5

Dropped Files

⊘No context

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_msedge.exe_ac37468f953bf74f5c143a1996c5bd897baf0_8242a2fb_c2713f28-ebf0-4be6-9a28-50f676b8a3e0\Report.wer

Process:	C:\Windows\System32\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.1958689255119386
Encrypted:	false
SSDEEP:	192:cb56KNFGF0NxMwaWz8iyU1lxPzuiF3Z24lO8F5:A5vnNxMwa48iFxPzuiF3Y4lO8F
MD5:	4C16961688DB0A4A5FC0ADAA08B15DBE
SHA1:	D51C2DBFCB7F25802477C175441DF83423957322
SHA-256:	7135F3EE5F5CC4DA4BBA235301937A07A25397868AC78148CA908BF5FD756C85
SHA-512:	4E1361CCCEF4E3CC4341B4F6322A799F069495FC3D8CF482B447FE97323020FB081E5C81B52EE340FE1AED5E13614025286C4F02DFFBEEA93F07E5A37FD269C5
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.C.L.R.2.0.r.3.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.6.3.4.0.7.8.1.2.0.9.0.6.3.9.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.6.3.4.0.7.8.1.9.4.3.4.3.6.4.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.c.2.7.1.3.f.2.8.-.e.b.f.0.-.4.b.e.6.-.9.a.2.8.-.5.0.f.6.7.6.b.8.a.3.e.0.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.3.a.7.1.7.f.d.8.-.8.5.e.b.-.4.8.5.6.-.b.9.0.0.-.e.a.0.b.6.b.1.5.7.0.2.6.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....N.s.A.p.p.N.a.m.e.=.m.s.e.d.g.e...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.m.s.e.d.g.e...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.2.f.c.-.0.0.0.1.-.0.0.1.4.-.8.4.a.e.-.1.8.5.3.1.c.3.9.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.5.2.f.5.5.1.2.a.6.8.e.8.1.8.7.1.e.c.9.c.0.8.b.1.5.d.1.f.9.f.1.d.0.0.0.0.0.0.0.0.!.0.0.0.0.d.a.9.1.6.3.9.4.4.b.1.f.5.1.4.3.8.b.2.6.0.2.c.b.c.9.5.6.6.0.a.f.4.3.1.7.2.0.6.5.!.m.s.e.d.g.e...e.x.e.....T.a.r.g.e.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERFB01.tmp.dmp

Process:	C:\Windows\System32\WerFault.exe
File Type:	Mini DuMP crash report, 16 streams, Sun Nov 17 18:13:01 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	443391
Entropy (8bit):	3.0992804073176337
Encrypted:	false
SSDEEP:	3072:RdvQHjcSMP4NJbPUzg57GOJC1CCqKIRP3+v1k8ua34MuMB3l:7oH3MANJbPUzgQwgq7P3QCgs2l
MD5:	61BDEE17CE8ACA53BA5317888F482073
SHA1:	0B10EA7BE0E36F11872C57A5CCFDAFA05824C383
SHA-256:	877CF732585014F90C05C9C730A7DA016C0D8235E4445F05C09CFA7D7CE2C1CC
SHA-512:	0C8351A9DC6D9A5942869B40F0EFF35FCFF39E3C227A0E1AB760E76AE4CC0A1FAFD6AE47D65CD65277D17074ECFF3FF95D44BA1624CB5DEC03CFDDF4DAD2F4E6
Malicious:	false
Preview:	MDMP..a..... .......-2:g........................d...........<...((..........d(.......7..P...........l.......8...........T...........8A.............\|6..........h8..............................................................................eJ.......9......Lw......................T...........'2:g.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERFC99.tmp.WERInternalMetadata.xml

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6724
Entropy (8bit):	3.7141007852457566
Encrypted:	false
SSDEEP:	96:RSIU6o7wVetbAsMdYZIeW8SnheMl5aMQURC89bqdSDyKfMXOm:R6l7wVeJJMdYZIpXTpDRC89bqAFfSOm
MD5:	89E696EB85F44B2CD202B66ED018141B
SHA1:	5B658371E440AC1CE8BA19E6C3998ED2C5DD9C10
SHA-256:	35A160B27BF1D01B3BE41993073FF5A4C9F39D48451F5C42848B8A6CDC189BEC
SHA-512:	752903B76BB13A2768622182D4D7FAEE8E1E49D9339084746F036473F5A574589F9A60412D223AA55E8C6D6DD7BA79CC1475777B40D2095871C5E3A98E6C76B1
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.6.4.<./.P.i.d.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERFCC9.tmp.xml

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4755
Entropy (8bit):	4.418912093473443
Encrypted:	false
SSDEEP:	48:cvIwWl8zs9PJg771I9ydWpW8VYhPYm8M4J10PF8Syq8vw0qHt1Y5juld:uIjf9xI7Rs7VoSJoWeHt+5juld
MD5:	C11F51C6E52445067B88E35AD1520E21
SHA1:	E8D03F5E14420F267202806E47962DB2439A74BE
SHA-256:	113906952EE55DA400B2D5CAFEC95BED57FAF210EA298F94246F2EC056844781
SHA-512:	EB7C4E38050186809097DC57C05047C1067754EFC71C9379578165F74B9A71B0BF4A89D27C7C79B577060573D8C89F0FC07C2FC4E25E9073CB94D499DC04F345
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="592395" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Windows\appcompat\Programs\Amcache.hve

Process:	C:\Windows\System32\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.421913964365036
Encrypted:	false
SSDEEP:	6144:QSvfpi6ceLP/9skLmb0OTMWSPHaJG8nAgeMZMMhA2fX4WABlEnN40uhiTw:7vloTMW+EZMM6DFyC03w
MD5:	B2C8DEB6B981D019A3C68F4318C37A06
SHA1:	C34710CB179411DEE0F31E4C2B04FC19EF409A85
SHA-256:	A3286CEBA27C9EB16015362BE4CF992AB808444CAE812F1F7846105B4C130C10
SHA-512:	0ADC4AD4EF7F06B67602AAE17A3243197110B2A675855241D120FE1FEA4A7FC93D4FB79A995726F1D1FBA0AB3B9D2A3C73B655CCF6676CE18979B612CAD9AE9A
Malicious:	false
Preview:	regf>...>....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm...V.9..............................................................................................................................................................................................................................................................................................................................................(R.b........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\msedge.exe

Process:	C:\Users\user\Desktop\IAdjMfB2A5.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	208896
Entropy (8bit):	6.358296180511797
Encrypted:	false
SSDEEP:	3072:LE9ZJhOb+68dbzP/b0GO1ItilKSRUGKXs+S++7KFSbxeY+qDDrMI:1q68dbD/b0mtilKDGqStKEbxI
MD5:	4738E3496A3EFE5F19C57B764EB5BA9B
SHA1:	DA9163944B1F51438B2602CBC95660AF43172065
SHA-256:	CB51764F19E66BB6ACCD7F0418332BAC7759073ED245F0633DDDD53F68E81933
SHA-512:	4CB3029E136471EDF2EBB46D1E4FC3A70E5138A5BD4B3FB182B6746D00C69FD5CF8822C0C90C2BCB4D8276DB0CECAC16EA0198E18A44E755A340495B19CC2238
Malicious:	true
Yara Hits:	Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: C:\Windows\msedge.exe, Author: Joe Security Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Windows\msedge.exe, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: C:\Windows\msedge.exe, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 88%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......e.................,..........NJ... ...`....@.. ....................................@..................................I..O....`..~....................`....................................................... ............... ..H............text...T... ...,.................. ..`.rsrc...~....`......................@..@.reloc.......`......................@..B................0J......H........c..\.......&.....................................................(.....r...p. E/....(.....r)..p. ~.H..s.........s.........s.........s..........r...p.r...p. h.7..ra..p. .s...r...p. .x!..r1..p. %kU...((....rg..p. h.:..r...p. ....(+...-.(,...,.+.(-...,.+.(...,.+.()...,..(Z..."(....+.&(....&+..+5sk... .... .'..ol...(,...~....-.(_...(Q...~....om...&.-..rG..p. R.,..r...p. ..m..r...p. .O...r...p. ..e..r...p. .[j..rO..p.r...p.r...p. .(

Static File Info

General

File type:	PE32+ executable (console) x86-64, for MS Windows
Entropy (8bit):	6.568896102524296
TrID:	Win64 Executable Console Net Framework (206006/5) 46.24% Win64 Executable Console (202006/5) 45.34% Win64 Executable (generic) Net Framework (21505/4) 4.83% Win64 Executable (generic) (12005/4) 2.69% Generic Win/DOS Executable (2004/3) 0.45%
File name:	IAdjMfB2A5.exe
File size:	887'808 bytes
MD5:	a8bd5b655845ba8a23a38abfd7e1bb03
SHA1:	90b245be80f5beb8b7b0e50bf910e1b4bff1f1cf
SHA256:	f126b1c0b4ff973d9618b7287d011b61731c2b0e5e9960c72f5ef444288aa8dc
SHA512:	f560893e04ee817be99c07a42ea654ce3f2ceaddcb3a644094a5316333ce85911f87eb06c10960673d53050e9b4a60410f0c61169c21e203014ba338138ed664
SSDEEP:	12288:i98NVBjvwSRz04lj4k/GG6yY5adl8M64mzx8B/wmtilK6yEbx9:vV9vT5lj4MGdyY5SWv4mM/eyEr
TLSH:	2615AF2A6FA921EDD1B7C17D84679243E735F48913108BEB12E485BC2F13AEC9E35B11
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........!8..@V..@V..@V..8...@V......@V...U..@V...R..@V...S..@V...W..@V.10R..@V.D.R..@V.D.S..@V..+W..@V..@W..AV..._..@V......@V...T..@V

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x14007dd9c
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x6739ABE2 [Sun Nov 17 08:40:02 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	75eb65370712eb02802f7b58c634fcdd

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007F9604E89F10h
dec eax
add esp, 28h
jmp 00007F9604E89597h
int3
int3
inc eax
push ebx
dec eax
sub esp, 20h
dec eax
mov ebx, ecx
dec eax
lea ecx, dword ptr [00057DF0h]
call dword ptr [000033B2h]
mov eax, dword ptr [000572E8h]
dec eax
lea ecx, dword ptr [00057DDDh]
mov edx, dword ptr [00057DDFh]
inc eax
mov dword ptr [000572D3h], eax
mov dword ptr [ebx], eax
dec eax
mov eax, dword ptr [00000058h]
inc ecx
mov ecx, 00000010h
dec esp
mov eax, dword ptr [eax+edx*8]
mov eax, dword ptr [000572B8h]
inc ebx
mov dword ptr [ecx+eax], eax
call dword ptr [0000336Ah]
dec eax
lea ecx, dword ptr [00057D9Bh]
dec eax
add esp, 20h
pop ebx
dec eax
jmp dword ptr [00003407h]
int3
int3
int3
inc eax
push ebx
dec eax
sub esp, 20h
dec eax
mov ebx, ecx
dec eax
lea ecx, dword ptr [00057D84h]
call dword ptr [00003346h]
cmp dword ptr [ebx], 00000000h
jne 00007F9604E89744h
or dword ptr [ebx], FFFFFFFFh
jmp 00007F9604E89767h
inc ebp
xor ecx, ecx
dec eax
lea edx, dword ptr [00057D6Ah]
inc ecx
or eax, FFFFFFFFh
dec eax
lea ecx, dword ptr [00057D57h]
call dword ptr [00003331h]
jmp 00007F9604E896FBh
cmp dword ptr [ebx], FFFFFFFFh
je 00007F9604E89700h
dec eax
mov eax, dword ptr [00000058h]

Rich Headers

Programming Language:

[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x9ded0	0x21c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xdc000	0x1e8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0xd7000	0x4b6c	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xdd000	0x5b0	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x944f0	0x70	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x94580	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x943b0	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x81000	0xc30	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x7f440	0x7f600	60ba2880a62710448c4f54fec2421f1c	False	0.47999723994111876	data	6.419225654128238	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x81000	0x2026e	0x20400	2e9642c7ad9ab6c4a3f3a372e064e495	False	0.3608890503875969	data	5.711691742662163	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xa2000	0x34460	0x33a00	38780438f09375e5936bff1232bb21d0	False	0.4958431068401937	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows	6.346457468797536	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0xd7000	0x4b6c	0x4c00	c08300499ad2af162252297bc101fa2e	False	0.48956620065789475	data	5.877358715482508	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0xdc000	0x1e8	0x200	b157b572f7ae8075c9dcb0dc1dd07257	False	0.54296875	data	4.762595083624659	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xdd000	0x5b0	0x600	36ba84efa0a9ce999652b889d8e98882	False	0.5546875	data	5.185301277370716	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0xdc060	0x188	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5892857142857143

Imports

DLL	Import
KERNEL32.dll	MultiByteToWideChar, GetEnvironmentVariableA, GetFileType, ReadFile, PeekNamedPipe, WaitForMultipleObjects, CreateFileA, GetFileSizeEx, WideCharToMultiByte, ReleaseSRWLockExclusive, AcquireSRWLockExclusive, MoveFileExA, SleepConditionVariableSRW, GetCurrentThreadId, GetLocaleInfoEx, GetCurrentDirectoryW, CreateDirectoryW, FindClose, FindFirstFileW, QueryPerformanceFrequency, WaitForSingleObjectEx, GetTickCount, QueryPerformanceCounter, VerifyVersionInfoA, LoadLibraryA, GetProcAddress, FreeLibrary, GetSystemDirectoryA, GetFileAttributesExW, AreFileApisANSI, GetFileInformationByHandleEx, WakeAllConditionVariable, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, VerSetConditionMask, SleepEx, LeaveCriticalSection, EnterCriticalSection, LocalFree, FormatMessageA, SetLastError, QueryFullProcessImageNameW, GetModuleHandleW, GetModuleHandleA, GetModuleFileNameW, GetModuleFileNameA, UnmapViewOfFile, MapViewOfFile, CreateFileMappingW, VirtualProtect, CreateThread, GetCurrentProcess, DeleteCriticalSection, InitializeCriticalSectionEx, GetProcessHeap, SetConsoleTitleA, HeapSize, HeapFree, HeapReAlloc, HeapAlloc, HeapDestroy, GetLastError, CloseHandle, GetConsoleWindow, Beep, Sleep, GetStdHandle, OutputDebugStringW, InitializeSListHead, GetSystemTimeAsFileTime, GetCurrentProcessId, IsDebuggerPresent, IsProcessorFeaturePresent, TerminateProcess, CreateFileW
USER32.dll	SetWindowLongW, MessageBoxA, GetWindowLongW, SetLayeredWindowAttributes
MSVCP140.dll	_Query_perf_frequency, ??1_Lockit@std@@QEAA@XZ, ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A, ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ, ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ, ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ, ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ, ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z, ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ, ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z, ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z, ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z, ?_Xbad_function_call@std@@YAXXZ, ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ, ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z, ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z, ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z, ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z, ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ, ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z, ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ, ?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAADD@Z, ??0_Lockit@std@@QEAA@H@Z, ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A, ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ, ?uncaught_exception@std@@YA_NXZ, ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ, ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z, ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z, ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z, ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ, ?_Pnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ, ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ, ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z, ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD0@Z, ?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A, ?_Xout_of_range@std@@YAXPEBD@Z, ?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z, ?_Gnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ, ?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ, ?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ, ?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ, ?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z, ?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z, ?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ, ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ, ?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ, ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ, ?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ, ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ, ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ, ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ, ?setf@ios_base@std@@QEAAHHH@Z, ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z, ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z, ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z, ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z, ?always_noconv@codecvt_base@std@@QEBA_NXZ, ?_Winerror_map@std@@YAHH@Z, ?_Syserror_map@std@@YAPEBDH@Z, ??Bid@locale@std@@QEAA_KXZ, ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z, ?good@ios_base@std@@QEBA_NXZ, ?id@?$ctype@D@std@@2V0locale@2@A, ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ, ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAH@Z, ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z, ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z, ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ, ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z, ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z, ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z, ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z, ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ, ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ, ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z, ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ, _Query_perf_counter, ?_Xlength_error@std@@YAXPEBD@Z, ?_Random_device@std@@YAIXZ
Normaliz.dll	IdnToAscii
WLDAP32.dll
CRYPT32.dll	CertEnumCertificatesInStore, CertFreeCertificateContext, CryptStringToBinaryA, PFXImportCertStore, CryptDecodeObjectEx, CertAddCertificateContextToStore, CertFindExtension, CertCloseStore, CertGetNameStringA, CryptQueryObject, CertCreateCertificateChainEngine, CertFreeCertificateChainEngine, CertGetCertificateChain, CertFreeCertificateChain, CertOpenStore, CertFindCertificateInStore
WS2_32.dll	accept, closesocket, freeaddrinfo, recvfrom, recv, send, WSAGetLastError, sendto, gethostname, ntohl, bind, select, __WSAFDIsSet, ioctlsocket, listen, htonl, getaddrinfo, WSACleanup, WSAStartup, WSAIoctl, WSASetLastError, connect, socket, setsockopt, ntohs, htons, getsockopt, getsockname, getpeername
SHLWAPI.dll	PathFindFileNameW
RPCRT4.dll	RpcStringFreeA, UuidToStringA, UuidCreate
PSAPI.DLL	GetModuleInformation
USERENV.dll	UnloadUserProfile
VCRUNTIME140_1.dll	__CxxFrameHandler4
VCRUNTIME140.dll	__current_exception_context, __current_exception, strchr, memcpy, __std_exception_destroy, __C_specific_handler, memset, strrchr, __std_exception_copy, __std_terminate, strstr, _CxxThrowException, memchr, memcmp, memmove
api-ms-win-crt-runtime-l1-1-0.dll	exit, _initterm, _get_initial_narrow_environment, system, _set_app_type, _invalid_parameter_noinfo, _cexit, _crt_atexit, __p___argv, _register_onexit_function, _initialize_onexit_table, _initialize_narrow_environment, _configure_narrow_argv, _resetstkoflw, abort, _c_exit, _getpid, strerror, _errno, _beginthreadex, _initterm_e, __sys_nerr, _exit, _seh_filter_exe, _register_thread_local_exe_atexit_callback, _invalid_parameter_noinfo_noreturn, __p___argc, terminate
api-ms-win-crt-heap-l1-1-0.dll	malloc, _set_new_mode, calloc, _callnewh, free, realloc
api-ms-win-crt-convert-l1-1-0.dll	strtoll, strtoul, strtoull, strtol, strtod, atoi
api-ms-win-crt-environment-l1-1-0.dll	getenv
api-ms-win-crt-stdio-l1-1-0.dll	_lseeki64, fclose, fflush, _get_stream_buffer_pointers, fgetpos, fgets, fputc, fread, fsetpos, _fseeki64, fwrite, _pclose, _popen, ungetc, __stdio_common_vsprintf, _set_fmode, __acrt_iob_func, __p__commode, ftell, _open, _close, _write, _read, fseek, feof, __stdio_common_vsscanf, fputs, fopen, setvbuf, fgetc
api-ms-win-crt-filesystem-l1-1-0.dll	_lock_file, _unlock_file, _fstat64, _stat64, _access, _unlink
api-ms-win-crt-time-l1-1-0.dll	_gmtime64, strftime, _localtime64, _time64
api-ms-win-crt-locale-l1-1-0.dll	_configthreadlocale, ___lc_codepage_func, localeconv
api-ms-win-crt-math-l1-1-0.dll	__setusermatherr, _dclass
api-ms-win-crt-string-l1-1-0.dll	tolower, strpbrk, strncpy, strcmp, strcspn, strspn, isupper, _strdup, strncmp
api-ms-win-crt-utility-l1-1-0.dll	qsort
ADVAPI32.dll	CryptDestroyKey, CryptHashData, CryptCreateHash, CryptGenRandom, CryptGetHashParam, CryptReleaseContext, CryptAcquireContextA, ConvertSidToStringSidA, CryptEncrypt, CryptImportKey, CopySid, SetSecurityInfo, IsValidSid, InitializeAcl, GetTokenInformation, GetLengthSid, AddAccessAllowedAce, CryptDestroyHash, OpenProcessToken
SHELL32.dll	ShellExecuteA

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 17, 2024 19:12:57.905275106 CET	49708	443	192.168.2.5	104.26.0.5
Nov 17, 2024 19:12:57.905325890 CET	443	49708	104.26.0.5	192.168.2.5
Nov 17, 2024 19:12:57.905436039 CET	49708	443	192.168.2.5	104.26.0.5
Nov 17, 2024 19:12:57.916625023 CET	49708	443	192.168.2.5	104.26.0.5
Nov 17, 2024 19:12:57.916645050 CET	443	49708	104.26.0.5	192.168.2.5
Nov 17, 2024 19:12:58.553987026 CET	443	49708	104.26.0.5	192.168.2.5
Nov 17, 2024 19:12:58.554088116 CET	49708	443	192.168.2.5	104.26.0.5
Nov 17, 2024 19:12:59.210649967 CET	49708	443	192.168.2.5	104.26.0.5
Nov 17, 2024 19:12:59.210676908 CET	443	49708	104.26.0.5	192.168.2.5
Nov 17, 2024 19:12:59.210884094 CET	49708	443	192.168.2.5	104.26.0.5
Nov 17, 2024 19:12:59.211134911 CET	443	49708	104.26.0.5	192.168.2.5
Nov 17, 2024 19:12:59.211209059 CET	49708	443	192.168.2.5	104.26.0.5
Nov 17, 2024 19:13:01.331581116 CET	49712	80	192.168.2.5	208.95.112.1
Nov 17, 2024 19:13:01.336375952 CET	80	49712	208.95.112.1	192.168.2.5
Nov 17, 2024 19:13:01.336469889 CET	49712	80	192.168.2.5	208.95.112.1
Nov 17, 2024 19:13:01.337392092 CET	49712	80	192.168.2.5	208.95.112.1
Nov 17, 2024 19:13:01.342139006 CET	80	49712	208.95.112.1	192.168.2.5
Nov 17, 2024 19:13:01.928514957 CET	80	49712	208.95.112.1	192.168.2.5
Nov 17, 2024 19:13:01.981132984 CET	49712	80	192.168.2.5	208.95.112.1
Nov 17, 2024 19:13:19.213017941 CET	49712	80	192.168.2.5	208.95.112.1

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 17, 2024 19:12:57.889467955 CET	64512	53	192.168.2.5	1.1.1.1
Nov 17, 2024 19:12:57.900465012 CET	53	64512	1.1.1.1	192.168.2.5
Nov 17, 2024 19:13:01.298559904 CET	56289	53	192.168.2.5	1.1.1.1
Nov 17, 2024 19:13:01.305490017 CET	53	56289	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 17, 2024 19:12:57.889467955 CET	192.168.2.5	1.1.1.1	0x24ce	Standard query (0)	keyauth.win	A (IP address)	IN (0x0001)	false
Nov 17, 2024 19:13:01.298559904 CET	192.168.2.5	1.1.1.1	0x6135	Standard query (0)	ip-api.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Nov 17, 2024 19:12:57.900465012 CET	1.1.1.1	192.168.2.5	0x24ce	No error (0)	keyauth.win	104.26.0.5	A (IP address)	IN (0x0001)	false
Nov 17, 2024 19:12:57.900465012 CET	1.1.1.1	192.168.2.5	0x24ce	No error (0)	keyauth.win	104.26.1.5	A (IP address)	IN (0x0001)	false
Nov 17, 2024 19:12:57.900465012 CET	1.1.1.1	192.168.2.5	0x24ce	No error (0)	keyauth.win	172.67.72.57	A (IP address)	IN (0x0001)	false
Nov 17, 2024 19:13:01.305490017 CET	1.1.1.1	192.168.2.5	0x6135	No error (0)	ip-api.com	208.95.112.1	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

ip-api.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49712	208.95.112.1	80	764	C:\Windows\msedge.exe

Timestamp	Bytes transferred	Direction	Data
Nov 17, 2024 19:13:01.337392092 CET	80	OUT	GET /line/?fields=hosting HTTP/1.1 Host: ip-api.com Connection: Keep-Alive
Nov 17, 2024 19:13:01.928514957 CET	174	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 18:13:01 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 5 Access-Control-Allow-Origin: * X-Ttl: 60 X-Rl: 44 Data Raw: 74 72 75 65 0a Data Ascii: true

Target ID:	0
Start time:	13:12:54
Start date:	17/11/2024
Path:	C:\Users\user\Desktop\IAdjMfB2A5.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\IAdjMfB2A5.exe"
Imagebase:	0x7ff6743c0000
File size:	887'808 bytes
MD5 hash:	A8BD5B655845BA8A23A38ABFD7E1BB03
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000000.00000000.2025716296.00007FF674462000.00000008.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: 00000000.00000000.2025716296.00007FF674462000.00000008.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 00000000.00000000.2025716296.00007FF674462000.00000008.00000001.01000000.00000003.sdmp, Author: ditekSHen Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000000.00000002.2069285543.00007FF674462000.00000008.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: 00000000.00000002.2069285543.00007FF674462000.00000008.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 00000000.00000002.2069285543.00007FF674462000.00000008.00000001.01000000.00000003.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	true

Target ID:	1
Start time:	13:12:54
Start date:	17/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	2
Start time:	13:12:54
Start date:	17/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c taskkill /IM EpicGamesLauncher.exe /F
Imagebase:	0x7ff7032c0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	3
Start time:	13:12:54
Start date:	17/11/2024
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /IM EpicGamesLauncher.exe /F
Imagebase:	0x7ff7cd5b0000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Target ID:	5
Start time:	13:12:54
Start date:	17/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c taskkill /IM FortniteClient-Win64-Shipping_BE.exe /F
Imagebase:	0x7ff7032c0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	6
Start time:	13:12:54
Start date:	17/11/2024
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /IM FortniteClient-Win64-Shipping_BE.exe /F
Imagebase:	0x7ff7cd5b0000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Target ID:	7
Start time:	13:12:54
Start date:	17/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c taskkill /IM FortniteClient-Win64-Shipping.exe /F
Imagebase:	0x7ff7032c0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	8
Start time:	13:12:54
Start date:	17/11/2024
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /IM FortniteClient-Win64-Shipping.exe /F
Imagebase:	0x7ff7cd5b0000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Target ID:	9
Start time:	13:12:55
Start date:	17/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c taskkill /IM x64dbg.exe
Imagebase:	0x7ff7032c0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	10
Start time:	13:12:55
Start date:	17/11/2024
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /IM x64dbg.exe
Imagebase:	0x7ff7cd5b0000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Target ID:	11
Start time:	13:12:55
Start date:	17/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c cls
Imagebase:	0x7ff7032c0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	12
Start time:	13:12:55
Start date:	17/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c start C:\Windows\msedge.exe
Imagebase:	0x7ff7032c0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	13
Start time:	13:12:55
Start date:	17/11/2024
Path:	C:\Windows\msedge.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\msedge.exe
Imagebase:	0xa80000
File size:	208'896 bytes
MD5 hash:	4738E3496A3EFE5F19C57B764EB5BA9B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 0000000D.00000000.2036559031.0000000000A82000.00000002.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 0000000D.00000000.2036559031.0000000000A82000.00000002.00000001.01000000.00000004.sdmp, Author: ditekSHen Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 0000000D.00000002.2264433685.0000000002D4C000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: C:\Windows\msedge.exe, Author: Joe Security Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Windows\msedge.exe, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: C:\Windows\msedge.exe, Author: ditekSHen
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 88%, ReversingLabs
Has exited:	true

Target ID:	14
Start time:	13:12:55
Start date:	17/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\user\Desktop\IAdjMfB2A5.exe" MD5 \| find /i /v "md5" \| find /i /v "certutil"
Imagebase:	0x7ff7032c0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	15
Start time:	13:12:55
Start date:	17/11/2024
Path:	C:\Windows\System32\certutil.exe
Wow64 process (32bit):	false
Commandline:	certutil -hashfile "C:\Users\user\Desktop\IAdjMfB2A5.exe" MD5
Imagebase:	0x7ff66fa20000
File size:	1'651'712 bytes
MD5 hash:	F17616EC0522FC5633151F7CAA278CAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	16
Start time:	13:12:55
Start date:	17/11/2024
Path:	C:\Windows\System32\find.exe
Wow64 process (32bit):	false
Commandline:	find /i /v "md5"
Imagebase:	0x7ff799250000
File size:	17'920 bytes
MD5 hash:	4BF76A28D31FC73AA9FC970B22D056AF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	17
Start time:	13:12:55
Start date:	17/11/2024
Path:	C:\Windows\System32\find.exe
Wow64 process (32bit):	false
Commandline:	find /i /v "certutil"
Imagebase:	0x7ff799250000
File size:	17'920 bytes
MD5 hash:	4BF76A28D31FC73AA9FC970B22D056AF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	18
Start time:	13:12:58
Start date:	17/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c start cmd /C "color b && title Error && echo SSL connect error && timeout /t 5"
Imagebase:	0x7ff7032c0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	19
Start time:	13:12:58
Start date:	17/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /C "color b && title Error && echo SSL connect error && timeout /t 5"
Imagebase:	0x7ff7032c0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	20
Start time:	13:12:58
Start date:	17/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	23
Start time:	13:12:58
Start date:	17/11/2024
Path:	C:\Windows\System32\timeout.exe
Wow64 process (32bit):	false
Commandline:	timeout /t 5
Imagebase:	0x7ff6b62e0000
File size:	32'768 bytes
MD5 hash:	100065E21CFBBDE57CBA2838921F84D6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	24
Start time:	13:12:58
Start date:	17/11/2024
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -u -p 4324 -s 844
Imagebase:	0x7ff709aa0000
File size:	570'736 bytes
MD5 hash:	FD27D9F6D02763BDE32511B5DF7FF7A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	26
Start time:	13:13:01
Start date:	17/11/2024
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -u -p 764 -s 1576
Imagebase:	0x7ff709aa0000
File size:	570'736 bytes
MD5 hash:	FD27D9F6D02763BDE32511B5DF7FF7A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true