Windows Analysis Report
7yJsmmW4wS.exe

Malicious sample detected (through community Yara rule)

System Summary

Source: 8.0.rat.exe.370000.0.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 0.2.7yJsmmW4wS.exe.328fc70.1.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 0.2.7yJsmmW4wS.exe.328fc70.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000008.00000000.1287942195.0000000000372000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000000.00000002.1291498856.0000000003271000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: C:\Users\user\AppData\Local\Temp\rat.exe, type: DROPPED	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: C:\Users\user\AppData\Roaming\edge.exe, type: DROPPED	Matched rule: Detects AsyncRAT Author: ditekSHen

Source: C:\Users\user\AppData\Local\Temp\rat.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\AppData\Local\Temp\freeware.exe

Code function: 9_2_00007FF7952B6A08 NtQuerySystemInformation,VirtualFree,VirtualAlloc,NtQuerySystemInformation,_stricmp,getenv,memchr,LoadLibraryExA,VirtualFree,_invalid_parameter_noinfo_noreturn,VirtualFree,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,

9_2_00007FF7952B6A08

Source: C:\Users\user\AppData\Local\Temp\freeware.exe

Code function: 9_2_00007FF7952B7228: LoadLibraryExA,_beginthreadex,terminate,?_Throw_Cpp_error@std@@YAXH@Z,_Thrd_id,_Thrd_join,?_Throw_Cpp_error@std@@YAXH@Z,?_Throw_Cpp_error@std@@YAXH@Z,?_Throw_Cpp_error@std@@YAXH@Z,memcmp,GetModuleHandleA,GetCurrentProcessId,memcmp,GetModuleHandleA,GetCurrentProcessId,DeviceIoControl,memcmp,GetModuleHandleA,GetCurrentProcessId,DeviceIoControl,

9_2_00007FF7952B7228

Source: C:\Users\user\Desktop\7yJsmmW4wS.exe	Code function: 0_2_00007FFAACCE0A21	0_2_00007FFAACCE0A21
Source: C:\Users\user\AppData\Local\Temp\rat.exe	Code function: 8_2_00007FFAACCE2719	8_2_00007FFAACCE2719
Source: C:\Users\user\AppData\Local\Temp\rat.exe	Code function: 8_2_00007FFAACCE1289	8_2_00007FFAACCE1289
Source: C:\Users\user\AppData\Local\Temp\rat.exe	Code function: 8_2_00007FFAACCE8A66	8_2_00007FFAACCE8A66
Source: C:\Users\user\AppData\Local\Temp\rat.exe	Code function: 8_2_00007FFAACCE9812	8_2_00007FFAACCE9812
Source: C:\Users\user\AppData\Local\Temp\rat.exe	Code function: 8_2_00007FFAACCE0E33	8_2_00007FFAACCE0E33
Source: C:\Users\user\AppData\Local\Temp\rat.exe	Code function: 8_2_00007FFAACCE3769	8_2_00007FFAACCE3769
Source: C:\Users\user\AppData\Local\Temp\rat.exe	Code function: 8_2_00007FFAACCE1BC5	8_2_00007FFAACCE1BC5
Source: C:\Users\user\AppData\Local\Temp\freeware.exe	Code function: 9_2_00007FF7952B7228	9_2_00007FF7952B7228
Source: C:\Users\user\AppData\Local\Temp\freeware.exe	Code function: 9_2_00007FF7952D225C	9_2_00007FF7952D225C
Source: C:\Users\user\AppData\Local\Temp\freeware.exe	Code function: 9_2_00007FF7952B5E5C	9_2_00007FF7952B5E5C
Source: C:\Users\user\AppData\Local\Temp\freeware.exe	Code function: 9_2_00007FF7952CF2D5	9_2_00007FF7952CF2D5
Source: C:\Users\user\AppData\Local\Temp\freeware.exe	Code function: 9_2_00007FF7953992B4	9_2_00007FF7953992B4
Source: C:\Users\user\AppData\Local\Temp\freeware.exe	Code function: 9_2_00007FF7952B2980	9_2_00007FF7952B2980
Source: C:\Users\user\AppData\Local\Temp\freeware.exe	Code function: 9_2_00007FF7952D11BC	9_2_00007FF7952D11BC
Source: C:\Users\user\AppData\Local\Temp\freeware.exe	Code function: 9_2_00007FF7952BC214	9_2_00007FF7952BC214
Source: C:\Users\user\AppData\Local\Temp\freeware.exe	Code function: 9_2_00007FF7952B6A08	9_2_00007FF7952B6A08
Source: C:\Users\user\AppData\Local\Temp\freeware.exe	Code function: 9_2_00007FF7952C2E0C	9_2_00007FF7952C2E0C
Source: C:\Users\user\AppData\Local\Temp\freeware.exe	Code function: 9_2_00007FF7952CA5D8	9_2_00007FF7952CA5D8
Source: C:\Users\user\AppData\Local\Temp\freeware.exe	Code function: 9_2_00007FF7952C7CC0	9_2_00007FF7952C7CC0
Source: C:\Users\user\AppData\Local\Temp\freeware.exe	Code function: 9_2_00007FF7952B90B0	9_2_00007FF7952B90B0
Source: C:\Users\user\AppData\Roaming\edge.exe	Code function: 14_2_00007FFAACCE1289	14_2_00007FFAACCE1289
Source: C:\Users\user\AppData\Roaming\edge.exe	Code function: 14_2_00007FFAACCE1BC5	14_2_00007FFAACCE1BC5
Source: C:\Users\user\AppData\Roaming\edge.exe	Code function: 16_2_00007FFAACCD1289	16_2_00007FFAACCD1289
Source: C:\Users\user\AppData\Roaming\edge.exe	Code function: 16_2_00007FFAACCD1BC5	16_2_00007FFAACCD1BC5

Source: C:\Users\user\AppData\Local\Temp\freeware.exe	Code function: String function: 00007FF7952B3EBC appears 58 times
Source: C:\Users\user\AppData\Local\Temp\freeware.exe	Code function: String function: 00007FF7952D2F28 appears 109 times

Source: 7yJsmmW4wS.exe, 00000000.00000000.1255644971.0000000001038000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamefreeware.exe4 vs 7yJsmmW4wS.exe
Source: 7yJsmmW4wS.exe, 00000000.00000002.1291498856.0000000003271000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamerat.exe4 vs 7yJsmmW4wS.exe
Source: 7yJsmmW4wS.exe	Binary or memory string: OriginalFilenamefreeware.exe4 vs 7yJsmmW4wS.exe

Source: 7yJsmmW4wS.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 8.0.rat.exe.370000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 0.2.7yJsmmW4wS.exe.328fc70.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 0.2.7yJsmmW4wS.exe.328fc70.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000008.00000000.1287942195.0000000000372000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000000.00000002.1291498856.0000000003271000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: C:\Users\user\AppData\Local\Temp\rat.exe, type: DROPPED	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: C:\Users\user\AppData\Roaming\edge.exe, type: DROPPED	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT

Source: 7yJsmmW4wS.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: rat.exe.0.dr, Helper.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: rat.exe.0.dr, Helper.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: rat.exe.0.dr, AlgorithmAES.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.7yJsmmW4wS.exe.328fc70.1.raw.unpack, Helper.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.7yJsmmW4wS.exe.328fc70.1.raw.unpack, Helper.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.7yJsmmW4wS.exe.328fc70.1.raw.unpack, AlgorithmAES.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: edge.exe.8.dr, Helper.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: edge.exe.8.dr, Helper.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: edge.exe.8.dr, AlgorithmAES.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: rat.exe.0.dr, Settings.cs	Base64 encoded string: 'mZ5PY82JATlZAMnr4kQ0nx73VB3LsOpdxE3BVduerFREmaiVDQ+JeiNHpLtTHU1m'
Source: 0.2.7yJsmmW4wS.exe.328fc70.1.raw.unpack, Settings.cs	Base64 encoded string: 'mZ5PY82JATlZAMnr4kQ0nx73VB3LsOpdxE3BVduerFREmaiVDQ+JeiNHpLtTHU1m'
Source: edge.exe.8.dr, Settings.cs	Base64 encoded string: 'mZ5PY82JATlZAMnr4kQ0nx73VB3LsOpdxE3BVduerFREmaiVDQ+JeiNHpLtTHU1m'

Source: 0.2.7yJsmmW4wS.exe.328fc70.1.raw.unpack, ClientSocket.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 0.2.7yJsmmW4wS.exe.328fc70.1.raw.unpack, ClientSocket.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: rat.exe.0.dr, ClientSocket.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: rat.exe.0.dr, ClientSocket.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: edge.exe.8.dr, ClientSocket.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: edge.exe.8.dr, ClientSocket.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()

Source: freeware.exe.0.dr	Binary string: \Device\PhysicalMemory
Source: freeware.exe.0.dr	Binary string: \Device\AsUpdateio
Source: freeware.exe.0.dr	Binary string: \Device\crazyape776

Source: classification engine

Classification label: mal100.troj.evad.winEXE@13/6@1/1

Source: C:\Users\user\AppData\Local\Temp\freeware.exe

Code function: 9_2_00007FF7952BB728 CreateToolhelp32Snapshot,Process32First,lstrcmpiA,Process32Next,CloseHandle,CloseHandle,

9_2_00007FF7952BB728

Source: C:\Users\user\Desktop\7yJsmmW4wS.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\7yJsmmW4wS.exe.log

Source: C:\Users\user\Desktop\7yJsmmW4wS.exe	Mutant created: \Sessions\1\BaseNamedObjects\DfSwcy0uKBIsveTI1
Source: C:\Users\user\AppData\Roaming\edge.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7364:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7192:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\rat.exe	Mutant created: \Sessions\1\BaseNamedObjects\QxbISg5F4EKZB8tq

Source: C:\Users\user\Desktop\7yJsmmW4wS.exe

File created: C:\Users\user\AppData\Local\Temp\rat.exe

Source: 7yJsmmW4wS.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 7yJsmmW4wS.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Users\user\Desktop\7yJsmmW4wS.exe

File read: C:\Users\user\Desktop\desktop.ini

Source: C:\Users\user\Desktop\7yJsmmW4wS.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: 7yJsmmW4wS.exe	Virustotal: Detection: 54%
Source: 7yJsmmW4wS.exe	ReversingLabs: Detection: 73%

Source: unknown	Process created: C:\Users\user\Desktop\7yJsmmW4wS.exe "C:\Users\user\Desktop\7yJsmmW4wS.exe"
Source: C:\Users\user\Desktop\7yJsmmW4wS.exe	Process created: C:\Users\user\AppData\Local\Temp\rat.exe "C:\Users\user~1\AppData\Local\Temp\rat.exe"
Source: C:\Users\user\Desktop\7yJsmmW4wS.exe	Process created: C:\Users\user\AppData\Local\Temp\freeware.exe "C:\Users\user~1\AppData\Local\Temp\freeware.exe"
Source: C:\Users\user\AppData\Local\Temp\freeware.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\rat.exe	Process created: C:\Windows\System32\schtasks.exe "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "edge" /tr "C:\Users\user\AppData\Roaming\edge.exe"
Source: C:\Windows\System32\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Roaming\edge.exe C:\Users\user\AppData\Roaming\edge.exe
Source: unknown	Process created: C:\Users\user\AppData\Roaming\edge.exe C:\Users\user\AppData\Roaming\edge.exe
Source: unknown	Process created: C:\Users\user\AppData\Roaming\edge.exe
Source: unknown	Process created: C:\Users\user\AppData\Roaming\edge.exe
Source: C:\Users\user\Desktop\7yJsmmW4wS.exe	Process created: C:\Users\user\AppData\Local\Temp\rat.exe "C:\Users\user~1\AppData\Local\Temp\rat.exe"	Jump to behavior
Source: C:\Users\user\Desktop\7yJsmmW4wS.exe	Process created: C:\Users\user\AppData\Local\Temp\freeware.exe "C:\Users\user~1\AppData\Local\Temp\freeware.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rat.exe	Process created: C:\Windows\System32\schtasks.exe "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "edge" /tr "C:\Users\user\AppData\Roaming\edge.exe"	Jump to behavior

Source: C:\Users\user\Desktop\7yJsmmW4wS.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\7yJsmmW4wS.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\7yJsmmW4wS.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\7yJsmmW4wS.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\7yJsmmW4wS.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\7yJsmmW4wS.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\7yJsmmW4wS.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\7yJsmmW4wS.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\7yJsmmW4wS.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\7yJsmmW4wS.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\7yJsmmW4wS.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\7yJsmmW4wS.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\7yJsmmW4wS.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\7yJsmmW4wS.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\7yJsmmW4wS.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\7yJsmmW4wS.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\7yJsmmW4wS.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\7yJsmmW4wS.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\7yJsmmW4wS.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\7yJsmmW4wS.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\7yJsmmW4wS.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\7yJsmmW4wS.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\7yJsmmW4wS.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\7yJsmmW4wS.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\7yJsmmW4wS.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\7yJsmmW4wS.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\7yJsmmW4wS.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\7yJsmmW4wS.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\7yJsmmW4wS.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\7yJsmmW4wS.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rat.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rat.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rat.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rat.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rat.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rat.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rat.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rat.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rat.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rat.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rat.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rat.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rat.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rat.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rat.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rat.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rat.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rat.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rat.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rat.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rat.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rat.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rat.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rat.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rat.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rat.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rat.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rat.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rat.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rat.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rat.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rat.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rat.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rat.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rat.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rat.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rat.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rat.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rat.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rat.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rat.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rat.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rat.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rat.exe	Section loaded: avicap32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rat.exe	Section loaded: msvfw32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rat.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\freeware.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\freeware.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\freeware.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\freeware.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\freeware.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\freeware.exe	Section loaded: d3dcompiler_43.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\freeware.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\freeware.exe	Section loaded: d3dx11_43.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\freeware.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\freeware.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\freeware.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\freeware.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\freeware.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\freeware.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\edge.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\edge.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\edge.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\edge.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\edge.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\edge.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\edge.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\edge.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\edge.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\edge.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\edge.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\edge.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\edge.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\edge.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\edge.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\edge.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\edge.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\edge.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\edge.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\edge.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\edge.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\edge.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\edge.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\edge.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\edge.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\edge.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\edge.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\edge.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\edge.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\edge.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\edge.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\edge.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\edge.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\edge.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\edge.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\edge.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\edge.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\edge.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\edge.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\edge.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\edge.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\edge.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\edge.exe	Section loaded: cryptbase.dll	Jump to behavior

Source: C:\Users\user\Desktop\7yJsmmW4wS.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Source: edge.lnk.8.dr

LNK file: ..\..\..\..\..\edge.exe

Source: C:\Users\user\Desktop\7yJsmmW4wS.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

.NET source code contains method to dynamically call methods (often used by packers)

Source: 7yJsmmW4wS.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: 7yJsmmW4wS.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: 7yJsmmW4wS.exe

Static file information: File size 1464320 > 1048576

Source: 7yJsmmW4wS.exe

Static PE information: Raw size of .text is bigger than: 0x100000 < 0x164e00

Source: 7yJsmmW4wS.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: D:\AsUpIO20111020\20111020\objfre_wnet_AMD64\amd64\AsUpIO.pdb source: freeware.exe, 00000009.00000000.1290098975.00007FF79539F000.00000002.00000001.01000000.00000007.sdmp, freeware.exe, 00000009.00000002.3716444269.00007FF7953A0000.00000002.00000001.01000000.00000007.sdmp, freeware.exe.0.dr
Source:	Binary string: Drive not readyThis error indicates a .pdb file related failure. source: freeware.exe, 00000009.00000002.3717107290.00007FFB087AD000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: Error while loading symbolsUnable to locate the .pdb file in any of the symbol search source: freeware.exe, 00000009.00000002.3717107290.00007FFB087AD000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: zzz_AsmCodeRange_*FrameDatainvalid string positionstring too long.pdb source: freeware.exe, 00000009.00000002.3717107290.00007FFB087AD000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: Pdb read access deniedYou may be attempting to access a .pdb file with read-only attributes source: freeware.exe, 00000009.00000002.3717107290.00007FFB087AD000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: Unable to locate the .pdb file in this location source: freeware.exe, 00000009.00000002.3717107290.00007FFB087AD000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: Unrecognized pdb formatThis error indicates attempting to access a .pdb file with source: freeware.exe, 00000009.00000002.3717107290.00007FFB087AD000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: A connection with the server could not be establishedAn extended error was returned from the WinHttp serverThe .pdb file is probably no longer indexed in the symbol server share location. source: freeware.exe, 00000009.00000002.3717107290.00007FFB087AD000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: The module signature does not match with .pdb signature. source: freeware.exe, 00000009.00000002.3717107290.00007FFB087AD000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: .pdb.dbg source: freeware.exe, 00000009.00000002.3717107290.00007FFB087AD000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: Age does not matchThe module age and .pdb age do not match. source: freeware.exe, 00000009.00000002.3717107290.00007FFB087AD000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: C:\Users\skinn\OneDrive\Desktop\wait wait what\Roblox Cheating Sources\thedecentsource\santo\build\santo.pdbmm/GCTL source: freeware.exe, 00000009.00000000.1290098975.00007FF79539F000.00000002.00000001.01000000.00000007.sdmp, freeware.exe, 00000009.00000002.3716444269.00007FF7953A0000.00000002.00000001.01000000.00000007.sdmp, freeware.exe.0.dr
Source:	Binary string: Cvinfo is corruptThe .pdb file contains a corrupted debug codeview information. source: freeware.exe, 00000009.00000002.3717107290.00007FFB087AD000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: or you do not have access permission to the .pdb location. source: freeware.exe, 00000009.00000002.3717107290.00007FFB087AD000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: An Exception happened while downloading the module .pdbPlease open a bug if this is a consistent repro. source: freeware.exe, 00000009.00000002.3717107290.00007FFB087AD000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: C:\Users\kenneth\Downloads\payson-ioctl-cheat-driver-main\build\driver\driver.pdb source: freeware.exe, 00000009.00000000.1290098975.00007FF79539F000.00000002.00000001.01000000.00000007.sdmp, freeware.exe, 00000009.00000002.3716444269.00007FF7953A0000.00000002.00000001.01000000.00000007.sdmp, freeware.exe.0.dr
Source:	Binary string: Downloading symbols for [%s] %ssrvsymsrvhttp://https://_bad_pdb_file.pdb source: freeware.exe, 00000009.00000002.3717107290.00007FFB087AD000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: Signature does not matchThe module signature does not match with .pdb signature source: freeware.exe, 00000009.00000002.3717107290.00007FFB087AD000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: The symbol server has never indexed any version of this symbol fileNo version of the .pdb file with the given name has ever been registered. source: freeware.exe, 00000009.00000002.3717107290.00007FFB087AD000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: dbghelp.pdb source: freeware.exe, 00000009.00000002.3717107290.00007FFB087AD000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: PDB not foundUnable to locate the .pdb file in any of the symbol search path locations. source: freeware.exe, 00000009.00000002.3717107290.00007FFB087AD000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: C:\Users\skinn\OneDrive\Desktop\wait wait what\Roblox Cheating Sources\thedecentsource\santo\build\santo.pdb source: freeware.exe, 00000009.00000000.1290098975.00007FF79539F000.00000002.00000001.01000000.00000007.sdmp, freeware.exe, 00000009.00000002.3716444269.00007FF7953A0000.00000002.00000001.01000000.00000007.sdmp, freeware.exe.0.dr
Source:	Binary string: dbghelp.pdbGCTL source: freeware.exe, 00000009.00000002.3717107290.00007FFB087AD000.00000002.00000001.01000000.0000000A.sdmp

Data Obfuscation

Source: rat.exe.0.dr, Messages.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[5]{Settings.Host,Settings.Port,Settings.SPL,Settings.KEY,Helper.ID()}}, (string[])null, (Type[])null, (bool[])null, true)
Source: rat.exe.0.dr, Messages.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[2]{Pack[2],Helper.Decompress(Convert.FromBase64String(Pack[3]))}}, (string[])null, (Type[])null, (bool[])null, true)
Source: 0.2.7yJsmmW4wS.exe.328fc70.1.raw.unpack, Messages.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[5]{Settings.Host,Settings.Port,Settings.SPL,Settings.KEY,Helper.ID()}}, (string[])null, (Type[])null, (bool[])null, true)
Source: 0.2.7yJsmmW4wS.exe.328fc70.1.raw.unpack, Messages.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[2]{Pack[2],Helper.Decompress(Convert.FromBase64String(Pack[3]))}}, (string[])null, (Type[])null, (bool[])null, true)
Source: edge.exe.8.dr, Messages.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[5]{Settings.Host,Settings.Port,Settings.SPL,Settings.KEY,Helper.ID()}}, (string[])null, (Type[])null, (bool[])null, true)
Source: edge.exe.8.dr, Messages.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[2]{Pack[2],Helper.Decompress(Convert.FromBase64String(Pack[3]))}}, (string[])null, (Type[])null, (bool[])null, true)

.NET source code contains potential unpacker

Source: rat.exe.0.dr, Messages.cs	.Net Code: Plugin System.AppDomain.Load(byte[])
Source: rat.exe.0.dr, Messages.cs	.Net Code: Memory System.AppDomain.Load(byte[])
Source: rat.exe.0.dr, Messages.cs	.Net Code: Memory
Source: 0.2.7yJsmmW4wS.exe.328fc70.1.raw.unpack, Messages.cs	.Net Code: Plugin System.AppDomain.Load(byte[])
Source: 0.2.7yJsmmW4wS.exe.328fc70.1.raw.unpack, Messages.cs	.Net Code: Memory System.AppDomain.Load(byte[])
Source: 0.2.7yJsmmW4wS.exe.328fc70.1.raw.unpack, Messages.cs	.Net Code: Memory
Source: edge.exe.8.dr, Messages.cs	.Net Code: Plugin System.AppDomain.Load(byte[])
Source: edge.exe.8.dr, Messages.cs	.Net Code: Memory System.AppDomain.Load(byte[])
Source: edge.exe.8.dr, Messages.cs	.Net Code: Memory

Source: C:\Users\user\Desktop\7yJsmmW4wS.exe	Code function: 0_2_00007FFAACCE00BD pushad ; iretd	0_2_00007FFAACCE00C1
Source: C:\Users\user\AppData\Local\Temp\rat.exe	Code function: 8_2_00007FFAACCE00BD pushad ; iretd	8_2_00007FFAACCE00C1
Source: C:\Users\user\AppData\Local\Temp\freeware.exe	Code function: 9_2_00007FF7952CE535 push rbp; iretd	9_2_00007FF7952CE536
Source: C:\Users\user\AppData\Local\Temp\freeware.exe	Code function: 9_2_00007FF7952BE08D push rdi; ret	9_2_00007FF7952BE08E
Source: C:\Users\user\AppData\Local\Temp\freeware.exe	Code function: 9_2_00007FF7952BBF34 push rbp; iretd	9_2_00007FF7952BBF35
Source: C:\Users\user\AppData\Local\Temp\freeware.exe	Code function: 9_2_00007FF7952BBFE6 push rbp; iretd	9_2_00007FF7952BBFE7
Source: C:\Users\user\AppData\Roaming\edge.exe	Code function: 14_2_00007FFAACCE00BD pushad ; iretd	14_2_00007FFAACCE00C1
Source: C:\Users\user\AppData\Roaming\edge.exe	Code function: 16_2_00007FFAACCD00BD pushad ; iretd	16_2_00007FFAACCD00C1

Source: 7yJsmmW4wS.exe

Static PE information: section name: .text entropy: 7.998334006790471

Source: C:\Users\user\Desktop\7yJsmmW4wS.exe	File created: C:\Users\user\AppData\Local\Temp\freeware.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\rat.exe	File created: C:\Users\user\AppData\Roaming\edge.exe	Jump to dropped file
Source: C:\Users\user\Desktop\7yJsmmW4wS.exe	File created: C:\Users\user\AppData\Local\Temp\rat.exe	Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\AppData\Local\Temp\rat.exe

Process created: C:\Windows\System32\schtasks.exe "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "edge" /tr "C:\Users\user\AppData\Roaming\edge.exe"

Source: C:\Users\user\AppData\Local\Temp\rat.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\edge.lnk

Source: C:\Users\user\AppData\Local\Temp\rat.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\edge.lnk

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\AppData\Local\Temp\rat.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run edge			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rat.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run edge			Jump to behavior

Source: C:\Users\user\Desktop\7yJsmmW4wS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7yJsmmW4wS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7yJsmmW4wS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7yJsmmW4wS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7yJsmmW4wS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7yJsmmW4wS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7yJsmmW4wS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7yJsmmW4wS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7yJsmmW4wS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7yJsmmW4wS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7yJsmmW4wS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7yJsmmW4wS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7yJsmmW4wS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7yJsmmW4wS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7yJsmmW4wS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7yJsmmW4wS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7yJsmmW4wS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7yJsmmW4wS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7yJsmmW4wS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7yJsmmW4wS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\freeware.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\freeware.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\edge.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\edge.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\edge.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\edge.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\edge.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\edge.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\edge.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\edge.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\edge.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\edge.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\edge.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\edge.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\edge.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\edge.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\edge.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\edge.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\edge.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\edge.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\edge.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\edge.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\edge.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\edge.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\edge.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\edge.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\edge.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\edge.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\edge.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\edge.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\edge.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\edge.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\edge.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\edge.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\edge.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\edge.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\edge.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\edge.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\edge.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\edge.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\edge.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\edge.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\edge.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\edge.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\edge.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\edge.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\edge.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\edge.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\edge.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\edge.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\edge.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\edge.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\edge.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\edge.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\edge.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\edge.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\edge.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\edge.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\edge.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\edge.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\edge.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\edge.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\edge.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\edge.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\edge.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\edge.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\edge.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\edge.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\edge.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\edge.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\edge.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\edge.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\edge.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\edge.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\edge.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\edge.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\edge.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\edge.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\edge.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\edge.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\edge.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\edge.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Source: C:\Users\user\AppData\Local\Temp\rat.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Local\Temp\rat.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Local\Temp\rat.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Local\Temp\rat.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Local\Temp\rat.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Local\Temp\rat.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Local\Temp\rat.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Local\Temp\rat.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Local\Temp\rat.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Local\Temp\rat.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController

Source: C:\Users\user\Desktop\7yJsmmW4wS.exe	Memory allocated: 1870000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\7yJsmmW4wS.exe	Memory allocated: 1B270000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rat.exe	Memory allocated: BC0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rat.exe	Memory allocated: 1A4C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\edge.exe	Memory allocated: 1430000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\edge.exe	Memory allocated: 1B120000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\edge.exe	Memory allocated: A30000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\edge.exe	Memory allocated: 1A910000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\edge.exe	Memory allocated: 1690000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\edge.exe	Memory allocated: 1B060000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\edge.exe	Memory allocated: 13C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\edge.exe	Memory allocated: 1AE80000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\7yJsmmW4wS.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rat.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\edge.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\edge.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\edge.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\edge.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\rat.exe	Window / User API: threadDelayed 2396			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rat.exe	Window / User API: threadDelayed 7431			Jump to behavior

Source: C:\Users\user\Desktop\7yJsmmW4wS.exe TID: 6704	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rat.exe TID: 7444	Thread sleep time: -15679732462653109s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\edge.exe TID: 7492	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\edge.exe TID: 7764	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\edge.exe TID: 8072	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\edge.exe TID: 7364	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\AppData\Local\Temp\rat.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rat.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rat.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rat.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rat.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rat.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rat.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rat.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rat.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rat.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rat.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\edge.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\edge.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\edge.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\edge.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\freeware.exe	Code function: 9_2_00007FF7953992B4 GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,__std_fs_open_handle,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,abort,GetFileInformationByHandleEx,GetLastError,CloseHandle,abort,GetFileInformationByHandleEx,GetLastError,CloseHandle,abort,CloseHandle,CloseHandle,abort,		9_2_00007FF7953992B4
Source: C:\Users\user\AppData\Local\Temp\freeware.exe	Code function: 9_2_00007FF795399210 FindClose,abort,FindFirstFileExW,GetLastError,		9_2_00007FF795399210

Source: C:\Users\user\Desktop\7yJsmmW4wS.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rat.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\edge.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\edge.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\edge.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\edge.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: rat.exe, 00000008.00000002.3719816331.000000001B410000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAWnStr%SystemRoot%\system32\mswsock.dllem.Web.Security.SqlRoleProvider, Sys

Anti Debugging

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Source: C:\Users\user\AppData\Roaming\edge.exe	System information queried: CodeIntegrityInformation			Jump to behavior
Source: C:\Users\user\AppData\Roaming\edge.exe	System information queried: CodeIntegrityInformation			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\rat.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rat.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Roaming\edge.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Roaming\edge.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Roaming\edge.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Roaming\edge.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\freeware.exe

Code function: 9_2_00007FF795398080 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

9_2_00007FF795398080

Source: C:\Users\user\Desktop\7yJsmmW4wS.exe

Memory allocated: page read and write | page guard

Source: C:\Users\user\Desktop\7yJsmmW4wS.exe	Process created: C:\Users\user\AppData\Local\Temp\rat.exe "C:\Users\user~1\AppData\Local\Temp\rat.exe"	Jump to behavior
Source: C:\Users\user\Desktop\7yJsmmW4wS.exe	Process created: C:\Users\user\AppData\Local\Temp\freeware.exe "C:\Users\user~1\AppData\Local\Temp\freeware.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rat.exe	Process created: C:\Windows\System32\schtasks.exe "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "edge" /tr "C:\Users\user\AppData\Roaming\edge.exe"	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\freeware.exe

Code function: GetLocaleInfoEx,FormatMessageA,

9_2_00007FF795398D90

Source: C:\Users\user\Desktop\7yJsmmW4wS.exe	Queries volume information: C:\Users\user\Desktop\7yJsmmW4wS.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rat.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\rat.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rat.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\edge.exe	Queries volume information: C:\Users\user\AppData\Roaming\edge.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\edge.exe	Queries volume information: C:\Users\user\AppData\Roaming\edge.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\edge.exe	Queries volume information: C:\Users\user\AppData\Roaming\edge.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\edge.exe	Queries volume information: C:\Users\user\AppData\Roaming\edge.exe VolumeInformation	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\freeware.exe

Code function: 9_2_00007FF795398C10 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

9_2_00007FF795398C10

Source: C:\Users\user\Desktop\7yJsmmW4wS.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Source: rat.exe, 00000008.00000002.3719816331.000000001B4F1000.00000004.00000020.00020000.00000000.sdmp, rat.exe, 00000008.00000002.3719816331.000000001B4AE000.00000004.00000020.00020000.00000000.sdmp, rat.exe, 00000008.00000002.3715723586.0000000000869000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\AppData\Local\Temp\rat.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\AppData\Local\Temp\rat.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\AppData\Local\Temp\rat.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\AppData\Local\Temp\rat.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\AppData\Local\Temp\rat.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\AppData\Local\Temp\rat.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\AppData\Local\Temp\rat.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\AppData\Local\Temp\rat.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\AppData\Local\Temp\rat.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\AppData\Local\Temp\rat.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct

Stealing of Sensitive Information

Yara detected XWorm

Source: Yara match	File source: 8.0.rat.exe.370000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.7yJsmmW4wS.exe.328fc70.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.7yJsmmW4wS.exe.328fc70.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000000.1287942195.0000000000372000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1291498856.0000000003271000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 7yJsmmW4wS.exe PID: 2548, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: rat.exe PID: 1240, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\rat.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\edge.exe, type: DROPPED

Remote Access Functionality

Yara detected XWorm

Source: Yara match	File source: 8.0.rat.exe.370000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.7yJsmmW4wS.exe.328fc70.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.7yJsmmW4wS.exe.328fc70.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000000.1287942195.0000000000372000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1291498856.0000000003271000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 7yJsmmW4wS.exe PID: 2548, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: rat.exe PID: 1240, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\rat.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\edge.exe, type: DROPPED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	11 Windows Management Instrumentation	1 Scheduled Task/Job	11 Process Injection	1 Masquerading	11 Input Capture	1 System Time Discovery	Remote Services	11 Input Capture	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Scheduled Task/Job	21 Registry Run Keys / Startup Folder	1 Scheduled Task/Job	1 Disable or Modify Tools	LSASS Memory	321 Security Software Discovery	Remote Desktop Protocol	11 Archive Collected Data	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 DLL Side-Loading	21 Registry Run Keys / Startup Folder	231 Virtualization/Sandbox Evasion	Security Account Manager	231 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 DLL Side-Loading	11 Process Injection	NTDS	1 Process Discovery	Distributed Component Object Model	Input Capture	11 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	11 Deobfuscate/Decode Files or Information	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	31 Obfuscated Files or Information	Cached Domain Credentials	2 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	22 Software Packing	DCSync	24 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
7yJsmmW4wS.exe	55%	Virustotal		Browse
7yJsmmW4wS.exe	74%	ReversingLabs	ByteCode-MSIL.Trojan.XWormRAT
7yJsmmW4wS.exe	100%	Avira	TR/Dropper.Gen
7yJsmmW4wS.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\edge.exe	100%	Avira	HEUR/AGEN.1305769
C:\Users\user\AppData\Local\Temp\rat.exe	100%	Avira	HEUR/AGEN.1305769
C:\Users\user\AppData\Roaming\edge.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\rat.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\freeware.exe	42%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\rat.exe	88%	ReversingLabs	ByteCode-MSIL.Trojan.Jalapeno
C:\Users\user\AppData\Local\Temp\rat.exe	73%	Virustotal		Browse
C:\Users\user\AppData\Roaming\edge.exe	88%	ReversingLabs	ByteCode-MSIL.Trojan.Jalapeno
C:\Users\user\AppData\Roaming\edge.exe	73%	Virustotal		Browse

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
authors-reflections.gl.at.ply.gg	4%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
https://github.com/googlefonts/lexend)6_ju	0%	Virustotal		Browse
https://scripts.sil.org/OFLThis	0%	Virustotal		Browse
https://scripts.sil.org/OFLhttps://www.lexend.comBonnie	0%	Virustotal		Browse
authors-reflections.gl.at.ply.gg	4%	Virustotal		Browse
http://www.apache.org/licenses/LICENSE-2.0	0%	Virustotal		Browse
http://www.urwpp.de	0%	Virustotal		Browse
http://www.urwpp.com	0%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
authors-reflections.gl.at.ply.gg	147.185.221.23	true	true	4%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
authors-reflections.gl.at.ply.gg	true	4%, Virustotal, Browse	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://github.com/googlefonts/lexend)6_ju	freeware.exe.0.dr	false	0%, Virustotal, Browse	unknown
https://scripts.sil.org/OFLThis	freeware.exe.0.dr	false	0%, Virustotal, Browse	unknown
http://www.apache.org/licenses/LICENSE-2.0	freeware.exe, 00000009.00000002.3716626020.00007FF7953E2000.00000008.00000001.01000000.00000007.sdmp, freeware.exe, 00000009.00000000.1290142796.00007FF7953E1000.00000008.00000001.01000000.00000007.sdmp, freeware.exe.0.dr	false	0%, Virustotal, Browse	unknown
http://www.urwpp.de	freeware.exe, 00000009.00000002.3716548241.00007FF7953E1000.00000004.00000001.01000000.00000007.sdmp, freeware.exe, 00000009.00000000.1290142796.00007FF7953E1000.00000008.00000001.01000000.00000007.sdmp, freeware.exe.0.dr	false	0%, Virustotal, Browse	unknown
https://scripts.sil.org/OFLhttps://www.lexend.comBonnie	freeware.exe.0.dr	false	0%, Virustotal, Browse	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	rat.exe, 00000008.00000002.3717163305.00000000024C1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.urwpp.dehttp://www.urwpp.dehttp://www.urwpp.comhttp://www.urwpp.comNimbus	freeware.exe, 00000009.00000002.3716548241.00007FF7953E1000.00000004.00000001.01000000.00000007.sdmp, freeware.exe, 00000009.00000000.1290142796.00007FF7953E1000.00000008.00000001.01000000.00000007.sdmp, freeware.exe.0.dr	false		unknown
http://https://_bad_pdb_file.pdb	freeware.exe, 00000009.00000002.3717107290.00007FFB087AD000.00000002.00000001.01000000.0000000A.sdmp	false		unknown
http://www.urwpp.com	freeware.exe, 00000009.00000002.3716548241.00007FF7953E1000.00000004.00000001.01000000.00000007.sdmp, freeware.exe, 00000009.00000000.1290142796.00007FF7953E1000.00000008.00000001.01000000.00000007.sdmp, freeware.exe.0.dr	false	0%, Virustotal, Browse	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
147.185.221.23	authors-reflections.gl.at.ply.gg	United States		12087	SALSGIVERUS	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1532626
Start date and time:	2024-10-13 19:12:08 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 41s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	23
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Sample name:	7yJsmmW4wS.exe renamed because original name is a hash value
Original Sample Name:	4aecacc803e54cc06db8e3a84e910d5376f58867e2436eb68a19a9c203043bd2.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@13/6@1/1
EGA Information:	Successful, ratio: 20%
HCA Information:	Successful, ratio: 99% Number of executed functions: 23 Number of non-executed functions: 83
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, time.windows.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target 7yJsmmW4wS.exe, PID 2548 because it is empty
Execution Graph export aborted for target edge.exe, PID 7468 because it is empty
Execution Graph export aborted for target edge.exe, PID 7744 because it is empty
Execution Graph export aborted for target freeware.exe, PID 2980 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
13:13:11	API Interceptor	15805638x Sleep call for process: rat.exe modified
19:13:12	Task Scheduler	Run new task: edge path: C:\Users\user\AppData\Roaming\edge.exe
19:13:12	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run edge C:\Users\user\AppData\Roaming\edge.exe
20:55:59	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run edge C:\Users\user\AppData\Roaming\edge.exe
20:56:19	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\edge.lnk

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
147.185.221.23	I8YtUAUWeS.exe	Get hash	malicious	XWorm	Browse
	s3OBQLA3xR.exe	Get hash	malicious	XWorm	Browse
	W1FREE.exe	Get hash	malicious	XWorm	Browse
	x2Yi9Hr77a.exe	Get hash	malicious	XWorm	Browse
	H2f8SkAvdV.exe	Get hash	malicious	Blank Grabber, XWorm	Browse
	A39tzaySzX.exe	Get hash	malicious	AsyncRAT, XWorm	Browse
	H1N45BQJ8x.exe	Get hash	malicious	XWorm	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
SALSGIVERUS	I8YtUAUWeS.exe	Get hash	malicious	XWorm	Browse	147.185.221.23
	s3OBQLA3xR.exe	Get hash	malicious	XWorm	Browse	147.185.221.23
	W1FREE.exe	Get hash	malicious	XWorm	Browse	147.185.221.23
	dHp58IIEYz.exe	Get hash	malicious	XWorm	Browse	147.185.221.22
	Lr87y2w72r.exe	Get hash	malicious	XWorm	Browse	147.185.221.18
	7LwVrYH7sy.exe	Get hash	malicious	XWorm	Browse	147.185.221.18
	432mtXKD3l.exe	Get hash	malicious	XWorm	Browse	147.185.221.22
	5q4X9fRo4b.exe	Get hash	malicious	AsyncRAT, XWorm	Browse	147.185.221.17
	l18t80u9zg.exe	Get hash	malicious	XWorm	Browse	147.185.221.22
	Windows Defender.exe	Get hash	malicious	XWorm	Browse	147.185.221.22

Process:	C:\Users\user\Desktop\7yJsmmW4wS.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	654
Entropy (8bit):	5.380476433908377
Encrypted:	false
SSDEEP:	12:Q3La/KDLI4MWuPXcp1OKbbDLI4MWuPOKfSSI6Khap+92n4MNQp3/VXM5gXu9tv:ML9E4KQwKDE4KGKZI6Kh6+84xp3/VclT
MD5:	30E4BDFC34907D0E4D11152CAEBE27FA
SHA1:	825402D6B151041BA01C5117387228EC9B7168BF
SHA-256:	A7B8F7FFB4822570DB1423D61ED74D7F4B538CE73521CC8745BC6B131C18BE63
SHA-512:	89FBCBCDB0BE5AD7A95685CF9AA4330D5B0250440E67DC40C6642260E024F52A402E9381F534A9824D2541B98B02094178A15BF2320148432EDB0D09B5F972BA
Malicious:	true
Reputation:	moderate, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.V9921e851#\04de61553901f06e2f763b6f03a6f65a\Microsoft.VisualBasic.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\edge.exe.log

Process:	C:\Users\user\AppData\Roaming\edge.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	654
Entropy (8bit):	5.380476433908377
Encrypted:	false
SSDEEP:	12:Q3La/KDLI4MWuPXcp1OKbbDLI4MWuPOKfSSI6Khap+92n4MNQp3/VXM5gXu9tv:ML9E4KQwKDE4KGKZI6Kh6+84xp3/VclT
MD5:	30E4BDFC34907D0E4D11152CAEBE27FA
SHA1:	825402D6B151041BA01C5117387228EC9B7168BF
SHA-256:	A7B8F7FFB4822570DB1423D61ED74D7F4B538CE73521CC8745BC6B131C18BE63
SHA-512:	89FBCBCDB0BE5AD7A95685CF9AA4330D5B0250440E67DC40C6642260E024F52A402E9381F534A9824D2541B98B02094178A15BF2320148432EDB0D09B5F972BA
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.V9921e851#\04de61553901f06e2f763b6f03a6f65a\Microsoft.VisualBasic.ni.dll",0..

C:\Users\user\AppData\Local\Temp\freeware.exe

Process:	C:\Users\user\Desktop\7yJsmmW4wS.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2322432
Entropy (8bit):	7.007547565174849
Encrypted:	false
SSDEEP:	49152:5iDc4qGH0Ux97b7b7blyAaqWq47gmEEnyKPZHRKttY+z+4y5PuL1dxhVQcmYD:2CUlaRqyZxKttYN/PuL1ZVF
MD5:	BFDFA3FAE0BF91D83DDDF5A708DBEFB1
SHA1:	EFDE91E21BE9CC72F232FF7EECE993D044308BB7
SHA-256:	7EAD32808AB47500FF3E36FC1B4702E797457ACC46E2769CD23004E5FAEB6761
SHA-512:	740429D8D3E15EB4DA2ED45F5C3BBE159D3F8C4B734044A26A478F71E6B529881CA0A198A00578105BFFDD34B013B024D6D94F404AEE91C1EAC0A53414F25A6F
Malicious:	true
Antivirus:	Antivirus: Virustotal, Detection: 42%, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........1...b...b...b.yb...b;.vb...b.F.c...b.F.b...b.F.c...b.F.c...b.F.c...b...c...b...bY..bj..c...b.G.c...b.G.c...b.G.b...b.G.c...bRich...b........PE..d...fU.g.........."....)......................@..............................#...........`.............................................L.......0.....#.......#..............#.4.......p.......................(.......@...............@............................text............................... ..`.rdata..B...........................@..@.data...............................@....pdata.......#.......".............@..@.rsrc.........#......\#.............@..@.reloc..4.....#......^#.............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\rat.exe

Process:	C:\Users\user\Desktop\7yJsmmW4wS.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	40448
Entropy (8bit):	5.636394334726735
Encrypted:	false
SSDEEP:	768:ET7JKHWcEbDvghvq3cJ+uap/5fzbN2WzFPw9UwOphwuA4c:A7JKHWcqcLiFN2iFY9UwOpGh4c
MD5:	0F43E9B3D93B65843F0346D76282BDC7
SHA1:	140BE5EEC263CDBADB57579201AA7CCACD3C770D
SHA-256:	108FF90BF1870B1618CCBA08FFA06DAE87028F514BDF2410B46204AFA2F8248B
SHA-512:	E322DA86925D29C214223F7E05C52B86104333D8E6A28C8F91A2B261B5B50DD08A209EFBA59AEAEE17607BE52EC2C2405030FC6945CE11FA0DCA01FEFDA8A029
Malicious:	true
Yara Hits:	Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: C:\Users\user\AppData\Local\Temp\rat.exe, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: C:\Users\user\AppData\Local\Temp\rat.exe, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 88% Antivirus: Virustotal, Detection: 73%, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....b.g................................. ........@.. ....................................@.................................L...O.................................................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......8_...T............................................................(......(.....s.........s.........s.........s............0..........~....o.....+....0..........~....o.....+....0..........~....o.....+....0..........~....o.....+....0............(....(.....+......0...........(.....+....0...............(.....+....0...........(.....+....0................-.(...+.+.+...+...0...........................(.....0.. .......~.........-.(...+.....~.....+....(.....0..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\edge.lnk

Process:	C:\Users\user\AppData\Local\Temp\rat.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Sun Oct 13 16:13:10 2024, mtime=Sun Oct 13 16:13:10 2024, atime=Sun Oct 13 16:13:10 2024, length=40448, window=hide
Category:	dropped
Size (bytes):	751
Entropy (8bit):	5.067548280755048
Encrypted:	false
SSDEEP:	12:8ocO4gN+2Chsi1Y//jt6AALuQaJ8+aDjAvNHTBHFeQJCQJzBmV:8fl2f9muQz+yAppF9JZJtm
MD5:	8236853F02B2A1FCE12A171121A196F0
SHA1:	D9F5512AABFB2A7464386289EF58CE355E6385AE
SHA-256:	FFA9411284490D1CAA872B22CC5D35505EBD51CE2B3BEA04C5F02E2398EDF237
SHA-512:	A9FEF469758F1700D4D0B3BD31DC5E2246517C9461ADF3AD0F572E828506F75A335434872B18CB73D4E4F7B068BFBFCC56B469610FAA495AF875A8D4E40ADAFA
Malicious:	false
Preview:	L..................F.... ...e-.-....e-.-....e-.-............................n.:..DG..Yr?.D..U..k0.&...&......Qg._.....?%.....R..........t...CFSF..1.....EW.=..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......EW.=MY............................3N.A.p.p.D.a.t.a...B.V.1.....MY....Roaming.@......EW.=MY............................n.+.R.o.a.m.i.n.g.....Z.2.....MY.. .edge.exe..B......MY..MY................................e.d.g.e...e.x.e.......Z...............-.......Y............}.......C:\Users\user\AppData\Roaming\edge.exe........\.....\.....\.....\.....\.e.d.g.e...e.x.e.`.......X.......494126...........hT..CrF.f4... ..../Tc...,......hT..CrF.f4... ..../Tc...,......E.......9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

C:\Users\user\AppData\Roaming\edge.exe

Process:	C:\Users\user\AppData\Local\Temp\rat.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	40448
Entropy (8bit):	5.636394334726735
Encrypted:	false
SSDEEP:	768:ET7JKHWcEbDvghvq3cJ+uap/5fzbN2WzFPw9UwOphwuA4c:A7JKHWcqcLiFN2iFY9UwOpGh4c
MD5:	0F43E9B3D93B65843F0346D76282BDC7
SHA1:	140BE5EEC263CDBADB57579201AA7CCACD3C770D
SHA-256:	108FF90BF1870B1618CCBA08FFA06DAE87028F514BDF2410B46204AFA2F8248B
SHA-512:	E322DA86925D29C214223F7E05C52B86104333D8E6A28C8F91A2B261B5B50DD08A209EFBA59AEAEE17607BE52EC2C2405030FC6945CE11FA0DCA01FEFDA8A029
Malicious:	true
Yara Hits:	Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: C:\Users\user\AppData\Roaming\edge.exe, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: C:\Users\user\AppData\Roaming\edge.exe, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 88% Antivirus: Virustotal, Detection: 73%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....b.g................................. ........@.. ....................................@.................................L...O.................................................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......8_...T............................................................(......(.....s.........s.........s.........s............0..........~....o.....+....0..........~....o.....+....0..........~....o.....+....0..........~....o.....+....0............(....(.....+......0...........(.....+....0...............(.....+....0...........(.....+....0................-.(...+.+.+...+...0...........................(.....0.. .......~.........-.(...+.....~.....+....(.....0..

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.997859272989848
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	7yJsmmW4wS.exe
File size:	1'464'320 bytes
MD5:	3dcc9cfed0a716b6ad3c4f4aaf1a1f46
SHA1:	e512e9a92247439ca3bbb8e412ec46f191025b41
SHA256:	4aecacc803e54cc06db8e3a84e910d5376f58867e2436eb68a19a9c203043bd2
SHA512:	9400b6f93ea25a644be656d2a1d9d3ba7a44ba2abdeb2140e6428fcdd4ba198216628c094602684744de2293bcbfe7e323c6ad74e4d7c6e16c77b66d1f65666c
SSDEEP:	24576:bvx5AU4Cte393UvHQbyGDfa1HSiSvcXKF41oVMz8f9ShSpwRs6MmgBXzAnPcWJ+G:bvPJ4Ue1IweVpSiGIec8Pr6MmgBX3H0g
TLSH:	016533B08BFCF325EED8573568603601C362A4A6784F1C5E8DA0892A631FA5F065DFD7
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...)c.g.................N...........l... ........@.. ....................................@................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x566cae
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x670B6329 [Sun Oct 13 06:05:29 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x166c54	0x57	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x168000	0x4e0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x16a000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x164cb4	0x164e00	d2b6185c2aee59bf0e792e0d80bef820	False	0.9953542305166375	data	7.998334006790471	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x168000	0x4e0	0x600	07e863eeca965422f6550ca650e23d0d	False	0.3776041666666667	data	3.726934327461166	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x16a000	0xc	0x200	b5ddd55df5d98f6eaa46a44d28165bd9	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x1680a0	0x24c	data			0.47278911564625853
RT_MANIFEST	0x1682f0	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5469387755102041

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-13T19:15:50.862264+0200	2855924	ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound	1	192.168.2.7	49977	147.185.221.23	19578	TCP
2024-10-13T19:16:24.283835+0200	2853193	ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound	1	192.168.2.7	49979	147.185.221.23	19578	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 13, 2024 19:13:12.315424919 CEST	49700	19578	192.168.2.7	147.185.221.23
Oct 13, 2024 19:13:12.320256948 CEST	19578	49700	147.185.221.23	192.168.2.7
Oct 13, 2024 19:13:12.320333004 CEST	49700	19578	192.168.2.7	147.185.221.23
Oct 13, 2024 19:13:12.470298052 CEST	49700	19578	192.168.2.7	147.185.221.23
Oct 13, 2024 19:13:12.475204945 CEST	19578	49700	147.185.221.23	192.168.2.7
Oct 13, 2024 19:13:23.118040085 CEST	49700	19578	192.168.2.7	147.185.221.23
Oct 13, 2024 19:13:23.122948885 CEST	19578	49700	147.185.221.23	192.168.2.7
Oct 13, 2024 19:13:33.719511986 CEST	19578	49700	147.185.221.23	192.168.2.7
Oct 13, 2024 19:13:33.719578028 CEST	49700	19578	192.168.2.7	147.185.221.23
Oct 13, 2024 19:13:35.124120951 CEST	49700	19578	192.168.2.7	147.185.221.23
Oct 13, 2024 19:13:35.128941059 CEST	19578	49700	147.185.221.23	192.168.2.7
Oct 13, 2024 19:13:35.146059990 CEST	49839	19578	192.168.2.7	147.185.221.23
Oct 13, 2024 19:13:35.150938034 CEST	19578	49839	147.185.221.23	192.168.2.7
Oct 13, 2024 19:13:35.151021957 CEST	49839	19578	192.168.2.7	147.185.221.23
Oct 13, 2024 19:13:35.247178078 CEST	49839	19578	192.168.2.7	147.185.221.23
Oct 13, 2024 19:13:35.252778053 CEST	19578	49839	147.185.221.23	192.168.2.7
Oct 13, 2024 19:13:45.393857956 CEST	49839	19578	192.168.2.7	147.185.221.23
Oct 13, 2024 19:13:45.398719072 CEST	19578	49839	147.185.221.23	192.168.2.7
Oct 13, 2024 19:13:55.533729076 CEST	49839	19578	192.168.2.7	147.185.221.23
Oct 13, 2024 19:13:55.538716078 CEST	19578	49839	147.185.221.23	192.168.2.7
Oct 13, 2024 19:13:56.525755882 CEST	19578	49839	147.185.221.23	192.168.2.7
Oct 13, 2024 19:13:56.525816917 CEST	49839	19578	192.168.2.7	147.185.221.23
Oct 13, 2024 19:13:56.580553055 CEST	49839	19578	192.168.2.7	147.185.221.23
Oct 13, 2024 19:13:56.581928968 CEST	49969	19578	192.168.2.7	147.185.221.23
Oct 13, 2024 19:13:56.585289001 CEST	19578	49839	147.185.221.23	192.168.2.7
Oct 13, 2024 19:13:56.586813927 CEST	19578	49969	147.185.221.23	192.168.2.7
Oct 13, 2024 19:13:56.586884975 CEST	49969	19578	192.168.2.7	147.185.221.23
Oct 13, 2024 19:13:56.621480942 CEST	49969	19578	192.168.2.7	147.185.221.23
Oct 13, 2024 19:13:56.626348019 CEST	19578	49969	147.185.221.23	192.168.2.7
Oct 13, 2024 19:14:11.221467972 CEST	49969	19578	192.168.2.7	147.185.221.23
Oct 13, 2024 19:14:11.226448059 CEST	19578	49969	147.185.221.23	192.168.2.7
Oct 13, 2024 19:14:17.964137077 CEST	19578	49969	147.185.221.23	192.168.2.7
Oct 13, 2024 19:14:17.967668056 CEST	49969	19578	192.168.2.7	147.185.221.23
Oct 13, 2024 19:14:19.377350092 CEST	49969	19578	192.168.2.7	147.185.221.23
Oct 13, 2024 19:14:19.379607916 CEST	49974	19578	192.168.2.7	147.185.221.23
Oct 13, 2024 19:14:19.382204056 CEST	19578	49969	147.185.221.23	192.168.2.7
Oct 13, 2024 19:14:19.384478092 CEST	19578	49974	147.185.221.23	192.168.2.7
Oct 13, 2024 19:14:19.384545088 CEST	49974	19578	192.168.2.7	147.185.221.23
Oct 13, 2024 19:14:19.419876099 CEST	49974	19578	192.168.2.7	147.185.221.23
Oct 13, 2024 19:14:19.424793005 CEST	19578	49974	147.185.221.23	192.168.2.7
Oct 13, 2024 19:14:29.643280983 CEST	49974	19578	192.168.2.7	147.185.221.23
Oct 13, 2024 19:14:29.648325920 CEST	19578	49974	147.185.221.23	192.168.2.7
Oct 13, 2024 19:14:29.690316916 CEST	49974	19578	192.168.2.7	147.185.221.23
Oct 13, 2024 19:14:29.695425034 CEST	19578	49974	147.185.221.23	192.168.2.7
Oct 13, 2024 19:14:29.721411943 CEST	49974	19578	192.168.2.7	147.185.221.23
Oct 13, 2024 19:14:29.726260900 CEST	19578	49974	147.185.221.23	192.168.2.7
Oct 13, 2024 19:14:29.736875057 CEST	49974	19578	192.168.2.7	147.185.221.23
Oct 13, 2024 19:14:29.741830111 CEST	19578	49974	147.185.221.23	192.168.2.7
Oct 13, 2024 19:14:29.783880949 CEST	49974	19578	192.168.2.7	147.185.221.23
Oct 13, 2024 19:14:29.788938046 CEST	19578	49974	147.185.221.23	192.168.2.7
Oct 13, 2024 19:14:29.862142086 CEST	49974	19578	192.168.2.7	147.185.221.23
Oct 13, 2024 19:14:29.868067026 CEST	19578	49974	147.185.221.23	192.168.2.7
Oct 13, 2024 19:14:29.940114021 CEST	49974	19578	192.168.2.7	147.185.221.23
Oct 13, 2024 19:14:29.946146965 CEST	19578	49974	147.185.221.23	192.168.2.7
Oct 13, 2024 19:14:29.971299887 CEST	49974	19578	192.168.2.7	147.185.221.23
Oct 13, 2024 19:14:29.977231979 CEST	19578	49974	147.185.221.23	192.168.2.7
Oct 13, 2024 19:14:37.424400091 CEST	49974	19578	192.168.2.7	147.185.221.23
Oct 13, 2024 19:14:37.429410934 CEST	19578	49974	147.185.221.23	192.168.2.7
Oct 13, 2024 19:14:40.765373945 CEST	19578	49974	147.185.221.23	192.168.2.7
Oct 13, 2024 19:14:40.766608000 CEST	49974	19578	192.168.2.7	147.185.221.23
Oct 13, 2024 19:14:45.408560991 CEST	49974	19578	192.168.2.7	147.185.221.23
Oct 13, 2024 19:14:45.411724091 CEST	49975	19578	192.168.2.7	147.185.221.23
Oct 13, 2024 19:14:45.413568020 CEST	19578	49974	147.185.221.23	192.168.2.7
Oct 13, 2024 19:14:45.416692972 CEST	19578	49975	147.185.221.23	192.168.2.7
Oct 13, 2024 19:14:45.416778088 CEST	49975	19578	192.168.2.7	147.185.221.23
Oct 13, 2024 19:14:45.452955008 CEST	49975	19578	192.168.2.7	147.185.221.23
Oct 13, 2024 19:14:45.457941055 CEST	19578	49975	147.185.221.23	192.168.2.7
Oct 13, 2024 19:14:45.486896992 CEST	49975	19578	192.168.2.7	147.185.221.23
Oct 13, 2024 19:14:45.491996050 CEST	19578	49975	147.185.221.23	192.168.2.7
Oct 13, 2024 19:14:45.502448082 CEST	49975	19578	192.168.2.7	147.185.221.23
Oct 13, 2024 19:14:45.507559061 CEST	19578	49975	147.185.221.23	192.168.2.7
Oct 13, 2024 19:14:45.533838034 CEST	49975	19578	192.168.2.7	147.185.221.23
Oct 13, 2024 19:14:45.538928032 CEST	19578	49975	147.185.221.23	192.168.2.7
Oct 13, 2024 19:14:45.549283028 CEST	49975	19578	192.168.2.7	147.185.221.23
Oct 13, 2024 19:14:45.554351091 CEST	19578	49975	147.185.221.23	192.168.2.7
Oct 13, 2024 19:14:45.736910105 CEST	49975	19578	192.168.2.7	147.185.221.23
Oct 13, 2024 19:14:45.741889954 CEST	19578	49975	147.185.221.23	192.168.2.7
Oct 13, 2024 19:14:45.783823967 CEST	49975	19578	192.168.2.7	147.185.221.23
Oct 13, 2024 19:14:45.788809061 CEST	19578	49975	147.185.221.23	192.168.2.7
Oct 13, 2024 19:14:45.799665928 CEST	49975	19578	192.168.2.7	147.185.221.23
Oct 13, 2024 19:14:45.804627895 CEST	19578	49975	147.185.221.23	192.168.2.7
Oct 13, 2024 19:14:45.846390963 CEST	49975	19578	192.168.2.7	147.185.221.23
Oct 13, 2024 19:14:45.851336956 CEST	19578	49975	147.185.221.23	192.168.2.7
Oct 13, 2024 19:14:48.721702099 CEST	49975	19578	192.168.2.7	147.185.221.23
Oct 13, 2024 19:14:48.726679087 CEST	19578	49975	147.185.221.23	192.168.2.7
Oct 13, 2024 19:14:51.408878088 CEST	49975	19578	192.168.2.7	147.185.221.23
Oct 13, 2024 19:14:51.413763046 CEST	19578	49975	147.185.221.23	192.168.2.7
Oct 13, 2024 19:15:01.799370050 CEST	49975	19578	192.168.2.7	147.185.221.23
Oct 13, 2024 19:15:01.806263924 CEST	19578	49975	147.185.221.23	192.168.2.7
Oct 13, 2024 19:15:01.908783913 CEST	49975	19578	192.168.2.7	147.185.221.23
Oct 13, 2024 19:15:01.914226055 CEST	19578	49975	147.185.221.23	192.168.2.7
Oct 13, 2024 19:15:06.855192900 CEST	19578	49975	147.185.221.23	192.168.2.7
Oct 13, 2024 19:15:06.855282068 CEST	49975	19578	192.168.2.7	147.185.221.23
Oct 13, 2024 19:15:06.939958096 CEST	49975	19578	192.168.2.7	147.185.221.23
Oct 13, 2024 19:15:06.943466902 CEST	49976	19578	192.168.2.7	147.185.221.23
Oct 13, 2024 19:15:06.944812059 CEST	19578	49975	147.185.221.23	192.168.2.7
Oct 13, 2024 19:15:06.948431969 CEST	19578	49976	147.185.221.23	192.168.2.7
Oct 13, 2024 19:15:06.948540926 CEST	49976	19578	192.168.2.7	147.185.221.23
Oct 13, 2024 19:15:07.081887007 CEST	49976	19578	192.168.2.7	147.185.221.23
Oct 13, 2024 19:15:07.086827040 CEST	19578	49976	147.185.221.23	192.168.2.7
Oct 13, 2024 19:15:07.674572945 CEST	49976	19578	192.168.2.7	147.185.221.23
Oct 13, 2024 19:15:07.679570913 CEST	19578	49976	147.185.221.23	192.168.2.7
Oct 13, 2024 19:15:10.848048925 CEST	49976	19578	192.168.2.7	147.185.221.23
Oct 13, 2024 19:15:10.853168964 CEST	19578	49976	147.185.221.23	192.168.2.7
Oct 13, 2024 19:15:12.783811092 CEST	49976	19578	192.168.2.7	147.185.221.23
Oct 13, 2024 19:15:12.788872957 CEST	19578	49976	147.185.221.23	192.168.2.7
Oct 13, 2024 19:15:17.690049887 CEST	49976	19578	192.168.2.7	147.185.221.23
Oct 13, 2024 19:15:17.694977045 CEST	19578	49976	147.185.221.23	192.168.2.7
Oct 13, 2024 19:15:17.721215963 CEST	49976	19578	192.168.2.7	147.185.221.23
Oct 13, 2024 19:15:17.726059914 CEST	19578	49976	147.185.221.23	192.168.2.7
Oct 13, 2024 19:15:21.255433083 CEST	49976	19578	192.168.2.7	147.185.221.23
Oct 13, 2024 19:15:21.260545969 CEST	19578	49976	147.185.221.23	192.168.2.7
Oct 13, 2024 19:15:28.002547979 CEST	49976	19578	192.168.2.7	147.185.221.23
Oct 13, 2024 19:15:28.007566929 CEST	19578	49976	147.185.221.23	192.168.2.7
Oct 13, 2024 19:15:28.080559015 CEST	49976	19578	192.168.2.7	147.185.221.23
Oct 13, 2024 19:15:28.085670948 CEST	19578	49976	147.185.221.23	192.168.2.7
Oct 13, 2024 19:15:28.342479944 CEST	19578	49976	147.185.221.23	192.168.2.7
Oct 13, 2024 19:15:28.342569113 CEST	49976	19578	192.168.2.7	147.185.221.23
Oct 13, 2024 19:15:33.128576040 CEST	49976	19578	192.168.2.7	147.185.221.23
Oct 13, 2024 19:15:33.128580093 CEST	49977	19578	192.168.2.7	147.185.221.23
Oct 13, 2024 19:15:33.134095907 CEST	19578	49976	147.185.221.23	192.168.2.7
Oct 13, 2024 19:15:33.134119034 CEST	19578	49977	147.185.221.23	192.168.2.7
Oct 13, 2024 19:15:33.134320021 CEST	49977	19578	192.168.2.7	147.185.221.23
Oct 13, 2024 19:15:33.340935946 CEST	49977	19578	192.168.2.7	147.185.221.23
Oct 13, 2024 19:15:33.346555948 CEST	19578	49977	147.185.221.23	192.168.2.7
Oct 13, 2024 19:15:44.018284082 CEST	49977	19578	192.168.2.7	147.185.221.23
Oct 13, 2024 19:15:44.023838997 CEST	19578	49977	147.185.221.23	192.168.2.7
Oct 13, 2024 19:15:44.049375057 CEST	49977	19578	192.168.2.7	147.185.221.23
Oct 13, 2024 19:15:44.054466009 CEST	19578	49977	147.185.221.23	192.168.2.7
Oct 13, 2024 19:15:44.064918041 CEST	49977	19578	192.168.2.7	147.185.221.23
Oct 13, 2024 19:15:44.069832087 CEST	19578	49977	147.185.221.23	192.168.2.7
Oct 13, 2024 19:15:44.111962080 CEST	49977	19578	192.168.2.7	147.185.221.23
Oct 13, 2024 19:15:44.117388010 CEST	19578	49977	147.185.221.23	192.168.2.7
Oct 13, 2024 19:15:47.612032890 CEST	49977	19578	192.168.2.7	147.185.221.23
Oct 13, 2024 19:15:47.617244005 CEST	19578	49977	147.185.221.23	192.168.2.7
Oct 13, 2024 19:15:49.190114021 CEST	49977	19578	192.168.2.7	147.185.221.23
Oct 13, 2024 19:15:49.195138931 CEST	19578	49977	147.185.221.23	192.168.2.7
Oct 13, 2024 19:15:50.862263918 CEST	49977	19578	192.168.2.7	147.185.221.23
Oct 13, 2024 19:15:50.867635965 CEST	19578	49977	147.185.221.23	192.168.2.7
Oct 13, 2024 19:15:54.252501965 CEST	49977	19578	192.168.2.7	147.185.221.23
Oct 13, 2024 19:15:54.258184910 CEST	19578	49977	147.185.221.23	192.168.2.7
Oct 13, 2024 19:15:54.268260002 CEST	49977	19578	192.168.2.7	147.185.221.23
Oct 13, 2024 19:15:54.273252010 CEST	19578	49977	147.185.221.23	192.168.2.7
Oct 13, 2024 19:15:54.314955950 CEST	49977	19578	192.168.2.7	147.185.221.23
Oct 13, 2024 19:15:54.321305990 CEST	19578	49977	147.185.221.23	192.168.2.7
Oct 13, 2024 19:15:54.393167973 CEST	49977	19578	192.168.2.7	147.185.221.23
Oct 13, 2024 19:15:54.398389101 CEST	19578	49977	147.185.221.23	192.168.2.7
Oct 13, 2024 19:15:54.408688068 CEST	49977	19578	192.168.2.7	147.185.221.23
Oct 13, 2024 19:15:54.413759947 CEST	19578	49977	147.185.221.23	192.168.2.7
Oct 13, 2024 19:15:54.424344063 CEST	49977	19578	192.168.2.7	147.185.221.23
Oct 13, 2024 19:15:54.431130886 CEST	19578	49977	147.185.221.23	192.168.2.7
Oct 13, 2024 19:15:54.439965010 CEST	49977	19578	192.168.2.7	147.185.221.23
Oct 13, 2024 19:15:54.445360899 CEST	19578	49977	147.185.221.23	192.168.2.7
Oct 13, 2024 19:15:54.455471039 CEST	49977	19578	192.168.2.7	147.185.221.23
Oct 13, 2024 19:15:54.460642099 CEST	19578	49977	147.185.221.23	192.168.2.7
Oct 13, 2024 19:15:54.544955969 CEST	19578	49977	147.185.221.23	192.168.2.7
Oct 13, 2024 19:15:54.545120001 CEST	49977	19578	192.168.2.7	147.185.221.23
Oct 13, 2024 19:15:54.545197010 CEST	49977	19578	192.168.2.7	147.185.221.23
Oct 13, 2024 19:15:54.549498081 CEST	49978	19578	192.168.2.7	147.185.221.23
Oct 13, 2024 19:15:54.550345898 CEST	19578	49977	147.185.221.23	192.168.2.7
Oct 13, 2024 19:15:54.554411888 CEST	19578	49978	147.185.221.23	192.168.2.7
Oct 13, 2024 19:15:54.554852009 CEST	49978	19578	192.168.2.7	147.185.221.23
Oct 13, 2024 19:15:54.625579119 CEST	49978	19578	192.168.2.7	147.185.221.23
Oct 13, 2024 19:15:54.630707979 CEST	19578	49978	147.185.221.23	192.168.2.7
Oct 13, 2024 19:15:59.658829927 CEST	49978	19578	192.168.2.7	147.185.221.23
Oct 13, 2024 19:15:59.663826942 CEST	19578	49978	147.185.221.23	192.168.2.7
Oct 13, 2024 19:15:59.674532890 CEST	49978	19578	192.168.2.7	147.185.221.23
Oct 13, 2024 19:15:59.679414034 CEST	19578	49978	147.185.221.23	192.168.2.7
Oct 13, 2024 19:15:59.705761909 CEST	49978	19578	192.168.2.7	147.185.221.23
Oct 13, 2024 19:15:59.710664988 CEST	19578	49978	147.185.221.23	192.168.2.7
Oct 13, 2024 19:16:08.486913919 CEST	49978	19578	192.168.2.7	147.185.221.23
Oct 13, 2024 19:16:08.492258072 CEST	19578	49978	147.185.221.23	192.168.2.7
Oct 13, 2024 19:16:09.971357107 CEST	49978	19578	192.168.2.7	147.185.221.23
Oct 13, 2024 19:16:09.976516008 CEST	19578	49978	147.185.221.23	192.168.2.7
Oct 13, 2024 19:16:10.018122911 CEST	49978	19578	192.168.2.7	147.185.221.23
Oct 13, 2024 19:16:10.023272038 CEST	19578	49978	147.185.221.23	192.168.2.7
Oct 13, 2024 19:16:15.752569914 CEST	49978	19578	192.168.2.7	147.185.221.23
Oct 13, 2024 19:16:15.757730961 CEST	19578	49978	147.185.221.23	192.168.2.7
Oct 13, 2024 19:16:15.935811996 CEST	19578	49978	147.185.221.23	192.168.2.7
Oct 13, 2024 19:16:15.935904980 CEST	49978	19578	192.168.2.7	147.185.221.23
Oct 13, 2024 19:16:20.033565998 CEST	49978	19578	192.168.2.7	147.185.221.23
Oct 13, 2024 19:16:20.035181046 CEST	49979	19578	192.168.2.7	147.185.221.23
Oct 13, 2024 19:16:20.038546085 CEST	19578	49978	147.185.221.23	192.168.2.7
Oct 13, 2024 19:16:20.040201902 CEST	19578	49979	147.185.221.23	192.168.2.7
Oct 13, 2024 19:16:20.040301085 CEST	49979	19578	192.168.2.7	147.185.221.23
Oct 13, 2024 19:16:20.077361107 CEST	49979	19578	192.168.2.7	147.185.221.23
Oct 13, 2024 19:16:20.082518101 CEST	19578	49979	147.185.221.23	192.168.2.7
Oct 13, 2024 19:16:20.111892939 CEST	49979	19578	192.168.2.7	147.185.221.23
Oct 13, 2024 19:16:20.117163897 CEST	19578	49979	147.185.221.23	192.168.2.7
Oct 13, 2024 19:16:20.127420902 CEST	49979	19578	192.168.2.7	147.185.221.23
Oct 13, 2024 19:16:20.132342100 CEST	19578	49979	147.185.221.23	192.168.2.7
Oct 13, 2024 19:16:22.096450090 CEST	49979	19578	192.168.2.7	147.185.221.23
Oct 13, 2024 19:16:22.103252888 CEST	19578	49979	147.185.221.23	192.168.2.7
Oct 13, 2024 19:16:24.283834934 CEST	49979	19578	192.168.2.7	147.185.221.23
Oct 13, 2024 19:16:24.288813114 CEST	19578	49979	147.185.221.23	192.168.2.7
Oct 13, 2024 19:16:28.846292019 CEST	49979	19578	192.168.2.7	147.185.221.23
Oct 13, 2024 19:16:28.851497889 CEST	19578	49979	147.185.221.23	192.168.2.7
Oct 13, 2024 19:16:30.299346924 CEST	49979	19578	192.168.2.7	147.185.221.23
Oct 13, 2024 19:16:30.304512024 CEST	19578	49979	147.185.221.23	192.168.2.7
Oct 13, 2024 19:16:30.377510071 CEST	49979	19578	192.168.2.7	147.185.221.23
Oct 13, 2024 19:16:30.382648945 CEST	19578	49979	147.185.221.23	192.168.2.7
Oct 13, 2024 19:16:38.143547058 CEST	49979	19578	192.168.2.7	147.185.221.23
Oct 13, 2024 19:16:38.149203062 CEST	19578	49979	147.185.221.23	192.168.2.7
Oct 13, 2024 19:16:40.502579927 CEST	49979	19578	192.168.2.7	147.185.221.23
Oct 13, 2024 19:16:40.507596970 CEST	19578	49979	147.185.221.23	192.168.2.7
Oct 13, 2024 19:16:40.518424988 CEST	49979	19578	192.168.2.7	147.185.221.23
Oct 13, 2024 19:16:40.523890972 CEST	19578	49979	147.185.221.23	192.168.2.7
Oct 13, 2024 19:16:40.533864021 CEST	49979	19578	192.168.2.7	147.185.221.23
Oct 13, 2024 19:16:40.540795088 CEST	19578	49979	147.185.221.23	192.168.2.7
Oct 13, 2024 19:16:41.439224958 CEST	19578	49979	147.185.221.23	192.168.2.7
Oct 13, 2024 19:16:41.439307928 CEST	49979	19578	192.168.2.7	147.185.221.23
Oct 13, 2024 19:16:45.627420902 CEST	49979	19578	192.168.2.7	147.185.221.23
Oct 13, 2024 19:16:45.629724979 CEST	49980	19578	192.168.2.7	147.185.221.23
Oct 13, 2024 19:16:45.632397890 CEST	19578	49979	147.185.221.23	192.168.2.7
Oct 13, 2024 19:16:45.634630919 CEST	19578	49980	147.185.221.23	192.168.2.7
Oct 13, 2024 19:16:45.634701967 CEST	49980	19578	192.168.2.7	147.185.221.23
Oct 13, 2024 19:16:45.671724081 CEST	49980	19578	192.168.2.7	147.185.221.23
Oct 13, 2024 19:16:45.676738977 CEST	19578	49980	147.185.221.23	192.168.2.7
Oct 13, 2024 19:16:45.690026999 CEST	49980	19578	192.168.2.7	147.185.221.23
Oct 13, 2024 19:16:45.694914103 CEST	19578	49980	147.185.221.23	192.168.2.7
Oct 13, 2024 19:16:45.799429893 CEST	49980	19578	192.168.2.7	147.185.221.23
Oct 13, 2024 19:16:45.804594040 CEST	19578	49980	147.185.221.23	192.168.2.7
Oct 13, 2024 19:16:45.815069914 CEST	49980	19578	192.168.2.7	147.185.221.23
Oct 13, 2024 19:16:45.820954084 CEST	19578	49980	147.185.221.23	192.168.2.7
Oct 13, 2024 19:16:45.893460989 CEST	49980	19578	192.168.2.7	147.185.221.23
Oct 13, 2024 19:16:45.898900986 CEST	19578	49980	147.185.221.23	192.168.2.7
Oct 13, 2024 19:16:45.924372911 CEST	49980	19578	192.168.2.7	147.185.221.23
Oct 13, 2024 19:16:45.930237055 CEST	19578	49980	147.185.221.23	192.168.2.7
Oct 13, 2024 19:16:45.955668926 CEST	49980	19578	192.168.2.7	147.185.221.23
Oct 13, 2024 19:16:45.961458921 CEST	19578	49980	147.185.221.23	192.168.2.7
Oct 13, 2024 19:16:45.971252918 CEST	49980	19578	192.168.2.7	147.185.221.23
Oct 13, 2024 19:16:45.976907015 CEST	19578	49980	147.185.221.23	192.168.2.7
Oct 13, 2024 19:16:51.064929008 CEST	49980	19578	192.168.2.7	147.185.221.23
Oct 13, 2024 19:16:51.070713043 CEST	19578	49980	147.185.221.23	192.168.2.7
Oct 13, 2024 19:16:57.877717018 CEST	49980	19578	192.168.2.7	147.185.221.23
Oct 13, 2024 19:16:57.882839918 CEST	19578	49980	147.185.221.23	192.168.2.7
Oct 13, 2024 19:17:02.315188885 CEST	49980	19578	192.168.2.7	147.185.221.23
Oct 13, 2024 19:17:02.320342064 CEST	19578	49980	147.185.221.23	192.168.2.7
Oct 13, 2024 19:17:07.014601946 CEST	19578	49980	147.185.221.23	192.168.2.7
Oct 13, 2024 19:17:07.017436028 CEST	49980	19578	192.168.2.7	147.185.221.23
Oct 13, 2024 19:17:15.299349070 CEST	49980	19578	192.168.2.7	147.185.221.23
Oct 13, 2024 19:17:15.300802946 CEST	49981	19578	192.168.2.7	147.185.221.23
Oct 13, 2024 19:17:15.304425001 CEST	19578	49980	147.185.221.23	192.168.2.7
Oct 13, 2024 19:17:15.305763960 CEST	19578	49981	147.185.221.23	192.168.2.7
Oct 13, 2024 19:17:15.305876970 CEST	49981	19578	192.168.2.7	147.185.221.23
Oct 13, 2024 19:17:15.333889008 CEST	49981	19578	192.168.2.7	147.185.221.23
Oct 13, 2024 19:17:15.338860989 CEST	19578	49981	147.185.221.23	192.168.2.7
Oct 13, 2024 19:17:29.862045050 CEST	49981	19578	192.168.2.7	147.185.221.23
Oct 13, 2024 19:17:29.866965055 CEST	19578	49981	147.185.221.23	192.168.2.7
Oct 13, 2024 19:17:36.703522921 CEST	19578	49981	147.185.221.23	192.168.2.7
Oct 13, 2024 19:17:36.703648090 CEST	49981	19578	192.168.2.7	147.185.221.23
Oct 13, 2024 19:17:42.799305916 CEST	49981	19578	192.168.2.7	147.185.221.23
Oct 13, 2024 19:17:42.800616980 CEST	49982	19578	192.168.2.7	147.185.221.23
Oct 13, 2024 19:17:42.805026054 CEST	19578	49981	147.185.221.23	192.168.2.7
Oct 13, 2024 19:17:42.805994034 CEST	19578	49982	147.185.221.23	192.168.2.7
Oct 13, 2024 19:17:42.806272984 CEST	49982	19578	192.168.2.7	147.185.221.23
Oct 13, 2024 19:17:42.844145060 CEST	49982	19578	192.168.2.7	147.185.221.23
Oct 13, 2024 19:17:42.849191904 CEST	19578	49982	147.185.221.23	192.168.2.7

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 13, 2024 19:13:12.294356108 CEST	63185	53	192.168.2.7	1.1.1.1
Oct 13, 2024 19:13:12.307651997 CEST	53	63185	1.1.1.1	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 13, 2024 19:13:12.294356108 CEST	192.168.2.7	1.1.1.1	0xcbd6	Standard query (0)	authors-reflections.gl.at.ply.gg	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 13, 2024 19:13:12.307651997 CEST	1.1.1.1	192.168.2.7	0xcbd6	No error (0)	authors-reflections.gl.at.ply.gg		147.185.221.23	A (IP address)	IN (0x0001)	false

Target ID:	0
Start time:	13:13:02
Start date:	13/10/2024
Path:	C:\Users\user\Desktop\7yJsmmW4wS.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\7yJsmmW4wS.exe"
Imagebase:	0xed0000
File size:	1'464'320 bytes
MD5 hash:	3DCC9CFED0A716B6AD3C4F4AAF1A1F46
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000000.00000002.1291498856.0000000003271000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 00000000.00000002.1291498856.0000000003271000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	true

Target ID:	8
Start time:	13:13:06
Start date:	13/10/2024
Path:	C:\Users\user\AppData\Local\Temp\rat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user~1\AppData\Local\Temp\rat.exe"
Imagebase:	0x370000
File size:	40'448 bytes
MD5 hash:	0F43E9B3D93B65843F0346D76282BDC7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000008.00000000.1287942195.0000000000372000.00000002.00000001.01000000.00000006.sdmp, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 00000008.00000000.1287942195.0000000000372000.00000002.00000001.01000000.00000006.sdmp, Author: ditekSHen Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: C:\Users\user\AppData\Local\Temp\rat.exe, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: C:\Users\user\AppData\Local\Temp\rat.exe, Author: ditekSHen
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 88%, ReversingLabs Detection: 73%, Virustotal, Browse
Reputation:	low
Has exited:	false

Target ID:	9
Start time:	13:13:06
Start date:	13/10/2024
Path:	C:\Users\user\AppData\Local\Temp\freeware.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user~1\AppData\Local\Temp\freeware.exe"
Imagebase:	0x7ff7952b0000
File size:	2'322'432 bytes
MD5 hash:	BFDFA3FAE0BF91D83DDDF5A708DBEFB1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 42%, Virustotal, Browse
Reputation:	low
Has exited:	false

Target ID:	10
Start time:	13:13:06
Start date:	13/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Target ID:	12
Start time:	13:13:10
Start date:	13/10/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "edge" /tr "C:\Users\user\AppData\Roaming\edge.exe"
Imagebase:	0x7ff68aec0000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	13
Start time:	13:13:10
Start date:	13/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	14
Start time:	13:13:12
Start date:	13/10/2024
Path:	C:\Users\user\AppData\Roaming\edge.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Roaming\edge.exe
Imagebase:	0xe00000
File size:	40'448 bytes
MD5 hash:	0F43E9B3D93B65843F0346D76282BDC7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: C:\Users\user\AppData\Roaming\edge.exe, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: C:\Users\user\AppData\Roaming\edge.exe, Author: ditekSHen
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 88%, ReversingLabs Detection: 73%, Virustotal, Browse
Reputation:	low
Has exited:	true

Target ID:	16
Start time:	14:56:00
Start date:	13/10/2024
Path:	C:\Users\user\AppData\Roaming\edge.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Roaming\edge.exe
Imagebase:	0x500000
File size:	40'448 bytes
MD5 hash:	0F43E9B3D93B65843F0346D76282BDC7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Target ID:	20
Start time:	14:57:00
Start date:	13/10/2024
Path:	C:\Users\user\AppData\Roaming\edge.exe
Wow64 process (32bit):
Commandline:
Imagebase:
File size:	40'448 bytes
MD5 hash:	0F43E9B3D93B65843F0346D76282BDC7
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Target ID:	22
Start time:	14:58:01
Start date:	13/10/2024
Path:	C:\Users\user\AppData\Roaming\edge.exe
Wow64 process (32bit):
Commandline:
Imagebase:
File size:	40'448 bytes
MD5 hash:	0F43E9B3D93B65843F0346D76282BDC7
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false