Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1429353
MD5:	5f30e027d147af1de92391f2e18644c8
SHA1:	febe9d268d31c17a24c0cae2d2e2b5d617d8608f
SHA256:	8f82f1de5cd507dd90c604c127dfe50e366530fbc0bbe2841ce68767d911cc65
Tags:	exe
Infos:

Detection

RisePro Stealer

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Yara detected RisePro Stealer

Connects to many ports of the same IP (likely port scanning)

Contains functionality to inject threads in other processes

Found many strings related to Crypto-Wallets (likely being stolen)

Machine Learning detection for sample

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

AV process strings found (often used to terminate AV products)

Checks if the current process is being debugged

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to detect sandboxes (mouse cursor move detection)

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to record screenshots

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Found evasive API chain (date check)

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

One or more processes crash

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses the system / local time for branch decision (may execute only at specific dates)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

file.exe (PID: 2896 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 5F30E027D147AF1DE92391F2E18644C8)

WerFault.exe (PID: 1868 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 2896 -s 784 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 2756 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 2896 -s 880 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 6464 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 2896 -s 912 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 2756 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 2896 -s 920 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 4284 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 2896 -s 980 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 6924 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 2896 -s 1332 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 1800 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 2896 -s 1772 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 6924 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 2896 -s 1772 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 6820 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 2896 -s 1880 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 6920 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 2896 -s 1920 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 1800 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 2896 -s 1932 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 6952 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 2896 -s 1960 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 4284 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 2896 -s 1776 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 2364 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 2896 -s 1972 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 4248 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 2896 -s 1916 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 2800 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 2896 -s 1760 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 2004 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 2896 -s 1880 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 6824 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 2896 -s 1892 MD5: C31336C1EFC2CCB44B4326EA793040F2)

cleanup

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Temp\W9yZG_t61Z_J7GfmBn540XA.zip	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.2008702665.000000000418E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000000.00000002.2009564997.0000000008CB9000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000000.00000002.2009091900.000000000459F000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x798:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000000.00000002.2008702665.0000000004206000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2009188631.0000000005ED0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
Process Memory Space: file.exe PID: 2896	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
Process Memory Space: file.exe PID: 2896	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Click to see the 2 entries

Snort Signatures

ET TROJAN RisePro TCP Heartbeat Packet - Source IP: 192.168.2.4 - Destination IP: 147.45.47.93

Timestamp:	04/22/24-01:28:54.900516
SID:	2049060
Source Port:	49730
Destination Port:	58709
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (External IP) - Source IP: 147.45.47.93 - Destination IP: 192.168.2.4

Timestamp:	04/22/24-01:28:55.338745
SID:	2046267
Source Port:	58709
Destination Port:	49730
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Token) - Source IP: 147.45.47.93 - Destination IP: 192.168.2.4

Timestamp:	04/22/24-01:28:55.099915
SID:	2046266
Source Port:	58709
Destination Port:	49730
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Activity) - Source IP: 192.168.2.4 - Destination IP: 147.45.47.93

Timestamp:	04/22/24-01:28:58.805975
SID:	2046269
Source Port:	49730
Destination Port:	58709
Protocol:	TCP
Classtype:	A Network Trojan was detected

Code function: 0_2_004F2150 GdiplusStartup,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetDC,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,GdipCreateBitmapFromHBITMAP,GdipGetImageEncodersSize,GdipGetImageEncoders,GdipSaveImageToFile,DeleteObject,GdipDisposeImage,DeleteObject,ReleaseDC,GdiplusShutdown,

0_2_004F2150

System Summary

Malicious sample detected (through community Yara rule)

Source: 00000000.00000002.2009091900.000000000459F000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000000.00000002.2009188631.0000000005ED0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005041A0	0_2_005041A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040E58B	0_2_0040E58B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004F6660	0_2_004F6660
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004CC610	0_2_004CC610
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00516730	0_2_00516730
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0045A790	0_2_0045A790
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0043A8BD	0_2_0043A8BD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00506920	0_2_00506920
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005209F0	0_2_005209F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040CA55	0_2_0040CA55
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00506DD0	0_2_00506DD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0045504E	0_2_0045504E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0045B010	0_2_0045B010
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0049D110	0_2_0049D110
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004091BF	0_2_004091BF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00453450	0_2_00453450
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040D468	0_2_0040D468
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004B36B0	0_2_004B36B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0045578C	0_2_0045578C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0054B990	0_2_0054B990
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00453C30	0_2_00453C30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0042A040	0_2_0042A040
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0052A080	0_2_0052A080
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004FC0A0	0_2_004FC0A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005040A0	0_2_005040A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00510140	0_2_00510140
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00506210	0_2_00506210
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00552230	0_2_00552230
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0054E340	0_2_0054E340
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00448314	0_2_00448314
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0050E450	0_2_0050E450
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0052E510	0_2_0052E510
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00502580	0_2_00502580
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004FC8B0	0_2_004FC8B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00504A90	0_2_00504A90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0043ABFF	0_2_0043ABFF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004FECA0	0_2_004FECA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00552DC0	0_2_00552DC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00420DB0	0_2_00420DB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00504FE0	0_2_00504FE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040EFAF	0_2_0040EFAF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0044F050	0_2_0044F050
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00409010	0_2_00409010
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004FB0A0	0_2_004FB0A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00553170	0_2_00553170
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004371F0	0_2_004371F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00541180	0_2_00541180
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004351B8	0_2_004351B8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00547260	0_2_00547260
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040F27E	0_2_0040F27E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004D3280	0_2_004D3280
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004F7290	0_2_004F7290
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00513320	0_2_00513320
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005233F0	0_2_005233F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004FF450	0_2_004FF450
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040D5B3	0_2_0040D5B3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0050F620	0_2_0050F620
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004536D0	0_2_004536D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004DF790	0_2_004DF790
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004DB860	0_2_004DB860
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004F3910	0_2_004F3910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00431A30	0_2_00431A30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00503BD0	0_2_00503BD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00545BF0	0_2_00545BF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00553BB0	0_2_00553BB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00453E0C	0_2_00453E0C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004FBE00	0_2_004FBE00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00503E00	0_2_00503E00

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 00553960 appears 85 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 0042EC10 appears 58 times

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 2896 -s 784

Source: file.exe	Binary or memory string: OriginalFilename vs file.exe
Source: file.exe, 00000000.00000002.2007216495.0000000000400000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameCrossDeviceSettingsHost.exeX vs file.exe
Source: file.exe, 00000000.00000000.1635935851.00000000040D8000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameFires( vs file.exe
Source: file.exe, 00000000.00000002.2009188631.0000000005ED0000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCrossDeviceSettingsHost.exeX vs file.exe
Source: file.exe, 00000000.00000003.1636879616.0000000006070000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCrossDeviceSettingsHost.exeX vs file.exe
Source: file.exe	Binary or memory string: OriginalFilenameFires( vs file.exe

Source: file.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 00000000.00000002.2009091900.000000000459F000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000000.00000002.2009188631.0000000005ED0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@15/94@2/3

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00550C20 GetLastError,GetVersionExA,FormatMessageW,LocalFree,FormatMessageA,

0_2_00550C20

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00550E80 GetDiskFreeSpaceW,GetDiskFreeSpaceA,

0_2_00550E80

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0049B950 CreateDirectoryA,CreateToolhelp32Snapshot,Process32First,Process32Next,CloseHandle,

0_2_0049B950

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\signons.sqlite

Jump to behavior

Source: C:\Windows\SysWOW64\WerFault.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess2896

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Temp\trixyBKaHSrnNvXxX

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Command line argument: 131	0_2_00453C30
Source: C:\Users\user\Desktop\file.exe	Command line argument: 131	0_2_00453C30
Source: C:\Users\user\Desktop\file.exe	Command line argument: Dk43l_dwmk438*	0_2_00453C30
Source: C:\Users\user\Desktop\file.exe	Command line argument: N.E	0_2_00452DA0

Source: file.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe, file.exe, 00000000.00000002.2007216495.0000000000400000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2009188631.0000000005ED0000.00000040.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000003.1636879616.0000000006070000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: file.exe, 00000000.00000002.2007216495.0000000000400000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2009188631.0000000005ED0000.00000040.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000003.1636879616.0000000006070000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: UPDATE %Q.%s SET sql = sqlite_rename_table(sql, %Q), tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q AND (type='table' OR type='index' OR type='trigger');
Source: KsnNQ7qbgZr8Login Data.0.dr, vbwxzHO_00KHLogin Data For Account.0.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: file.exe	ReversingLabs: Detection: 39%
Source: file.exe	Virustotal: Detection: 45%

Source: file.exe

String found in binary or memory: https://www.maxmind.com/en/locate-my-ip-address

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\file.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 2896 -s 784
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 2896 -s 880
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 2896 -s 912
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 2896 -s 980
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 2896 -s 1332
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 2896 -s 1772
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 2896 -s 1880
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 2896 -s 1920
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 2896 -s 1960
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 2896 -s 1972
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 2896 -s 1916
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 2896 -s 1760
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 2896 -s 1880
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 2896 -s 1892

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dxcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: file.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:

Binary string: C:\wigidefebeyugo\sizaf.pdb source: file.exe

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.400000.0.unpack

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_004DB380 VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,VirtualAllocEx,LoadLibraryA,GetProcAddress,WriteProcessMemory,WriteProcessMemory,CreateRemoteThread,WaitForSingleObject,

0_2_004DB380

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0042E7E9 push ecx; ret

0_2_0042E7FC

Source: C:\Users\user\Desktop\file.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Users\user\Desktop\file.exe

Code function: GetCursorPos,GetCursorPos,GetCursorPos,Sleep,GetCursorPos,Sleep,GetCursorPos,

0_2_0045A5C0

Source: C:\Users\user\Desktop\file.exe

Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes

graph_0-77292

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00550DF0 GetSystemTime followed by cmp: cmp eax, 04h and CTI: jc 00550E31h

0_2_00550DF0

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004D0620 FindFirstFileA,FindNextFileA,GetLastError,FindClose,	0_2_004D0620
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004F2870 FindFirstFileA,SetFileAttributesA,DeleteFileA,FindNextFileA,FindClose,GetLastError,SetFileAttributesA,GetLastError,RemoveDirectoryA,GetLastError,GetLastError,std::_Throw_Cpp_error,std::_Throw_Cpp_error,CreateDirectoryA,std::_Throw_Cpp_error,std::_Throw_Cpp_error,	0_2_004F2870
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0042C82B FindClose,FindFirstFileExW,GetLastError,	0_2_0042C82B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004EC100 CreateDirectoryA,FindFirstFileA,CreateDirectoryA,CopyFileA,FindNextFileA,FindClose,GetLastError,GetLastError,	0_2_004EC100
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004A0880 FindFirstFileA,FindNextFileA,GetLastError,FindClose,	0_2_004A0880
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0042C8B1 GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,___std_fs_open_handle@16,GetFileInformationByHandleEx,GetLastError,GetFileInformationByHandleEx,GetFileInformationByHandleEx,	0_2_0042C8B1

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00452968 VirtualQuery,GetSystemInfo,

0_2_00452968

Source: Amcache.hve.3.dr	Binary or memory string: VMware
Source: Amcache.hve.3.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.3.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.3.dr	Binary or memory string: VMware, Inc.
Source: file.exe, 00000000.00000002.2008702665.0000000004180000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000&1
Source: file.exe, 00000000.00000003.1659576324.00000000041E9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: Amcache.hve.3.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.3.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.3.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.3.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: file.exe, 00000000.00000002.2009564997.0000000008CD2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}5VGY2Uv8hsqNeqQA6vNfh0mAV2LIP4QsiYwsZfzvE4DRGbeyXnmwlF9DIQVlwgYOLdGblpA6OTbmY1TFi/S3g/V5aWA4opD8xHSyuVrplJa8RRTH9BwbPO7Bhbym04QHzjgA70UkjV11miVXoAudUWW7gWJgKUHYPDNs/iMVSsL5Y00MGtWB26nUyKwAPci7VeFkfhBKr0/FGEViKWrxT2RbqYieC5h++XJMJjhOzSS1Bqsykj1Sv8XwbrIOJkVmTyTcogd+OhCziIksLu+Gr4Al8HjMJJiCDKsQcxmWOvE1KVgR/l13pNJrf0cK3T+33wDhRGiZVLoHGcfaGkrTL5I25CM2EpffCGyiAJD+Q7YerOw6EKE40In4hYWRXC4viMdZIlIyS0VMfX72EjkdGZCtkN3SSJN0iH8WDcVeGlXtL4aPTLZIPMD4xMDu0Z5pnXDQIkCtKAfE4Gipi7FwmBKlOe2UNXV+GYUEqW68JBASqXL89TbQXCIt2UvXKXkSnK8HCZ2E1e8KRJ7SRT70XssFYQzU2Qq/3uTyggFWzGcZbep6K4HI4s+szGz2Uc5+ZqY2EqXqknUgpH6oCFyW/SwlkltNsdwG0IiPX9UX11rVdhzlFCaipm6aO0i/7CII7Yq+LEqLm9rpYJrK3ULqBRqDEBTh9d6+CZaypzIzGNDGm4ysNXdx3m0i5fK/lNg2qMUo/ChIPMkJ8NhZfGlwpasZbX0krEGUtvZGB0que2iWj2jF6nZJrYttWzbN68v+k2UewSHPfSFU7LOfvaeNu1Mz8mEZautfUd8U1DSQkcul8ZvdX5peEXk2HzltYDWqGy4MVxHfdrvbjZE0qR4QxQfw96hUQqy59vsa/0g1qVNvzHOi8IdYBuTlKrP1QRDu0S0apDPMhU2m2aAvwBOMw7ovdy3USh6ccCWVqV+Q8K5fXX3L0zH1CGwxzcPL3fXmatVlN6+Wgvn/HmAxmLRWO8oDrJpPK40z77FTSvHjne+3sKnFgl0ieLJiZK2XZjs4R3BMdKRdNNQrwXp+OeezuMo6WSM/3SLPsun4QJFjjvK5w6w/3L2NC8vxAqonCrXqCO6/BCDPQ6Z+dnXyv6AvNuSonodI6YgnIg4oquLEbV2tjij1haavZjnRLf78g0lrUqwdAYbfa+3NASlfz3XnOkuA2slV3qrF7xkej5uHBK6gaNoy3c+y6XUdGiNcurZE/KMcMWZ0e3MBGvxK6fobDXCrxaydRkCuf9gyoFXH42XWvRdx86qZIXpfWo6FKoMD7O6ltK9gQP3DLkCff+jfMpLc0uqugYyYl8JcXYK5VaEceMoqme0EoXScvdGkpSXX39Rxz5ooSGnK/Qkbq1i1uisBrIjtIfRZdTTH0Nv33gUj3Ne40txU4Fbzsdx207bsfx2kgE51/tNn46zqe286njfG47nzvOWds56zi/tZ3fOk4HCh3nvO2cQ68FxRaeTAAGFxSux3x4gsMFiQsWFzQueFwQuWByQeWCy+3wwniCzgWfBz4PfB74PLaITfLYMjzB54HPA58HPg98Hvg88Hng88DndXgLeILPA1+71S7Di+lruTf9wRXzUzPuIZh57u6v+qx13NUF19OPTAY7DrYGjzdni2Lx06o4lTuwRdtZtP/tnfPvu9bn1q5K2Rs92Th9eiWjn4y1J1YwhItHpUuJDGM1rZ7W0kBdLgmXy9MSnZtMkTAqTHdovNbeooId8MT9EhSi7ZBXtyglOljssXlu69w928UEC77J4x2UX8THx7iSF1sc7g8j86kg1UzZQ7SdJ2ezesAOifoVCQPY+CmafxwGjHw6Kdq0/PeJNhTjQUBbtS2aV8
Source: file.exe, 00000000.00000002.2008702665.0000000004206000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2008702665.00000000041DC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Amcache.hve.3.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: file.exe, 00000000.00000003.1659576324.00000000041F1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: Amcache.hve.3.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.3.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.3.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.3.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.3.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.3.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.3.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.3.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: file.exe, 00000000.00000002.2009564997.0000000008CD2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 9e146be9-c76a-4720-bcdb-53011b87bd06_{a33c7340-61ca-11ee-8c18-806e6f6e6963}_\\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}_EAC1505Eo
Source: Amcache.hve.3.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.3.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.3.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.3.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: file.exe, 00000000.00000002.2009564997.0000000008CD2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 9e146be9-c76a-4720-bcdb-53011b87bd06_{a33c7340-61ca-11ee-8c18-806e6f6e6963}_\\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}_EAC1505E
Source: file.exe, 00000000.00000003.1659576324.00000000041F1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}W
Source: Amcache.hve.3.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.3.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.3.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.3.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.3.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.3.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.3.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.3.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_004E2080 IsDebuggerPresent,IsProcessorFeaturePresent,GetVolumeInformationA,

0_2_004E2080

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0045504E CreateThread,FindCloseChangeNotification,Sleep,GetTempPathA,CreateDirectoryA,CreateDirectoryA,CreateDirectoryA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,OutputDebugStringA,CreateMutexA,GetLastError,Sleep,Sleep,Sleep,Sleep,shutdown,closesocket,Sleep,

0_2_0045504E

Source: C:\Users\user\Desktop\file.exe

0_2_004DB380

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0045A5C0 mov eax, dword ptr fs:[00000030h]	0_2_0045A5C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0045A5C0 mov eax, dword ptr fs:[00000030h]	0_2_0045A5C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0045504E mov eax, dword ptr fs:[00000030h]	0_2_0045504E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0045504E mov ecx, dword ptr fs:[00000030h]	0_2_0045504E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0045578C mov eax, dword ptr fs:[00000030h]	0_2_0045578C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0045578C mov eax, dword ptr fs:[00000030h]	0_2_0045578C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0045578C mov eax, dword ptr fs:[00000030h]	0_2_0045578C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0045578C mov eax, dword ptr fs:[00000030h]	0_2_0045578C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0045578C mov eax, dword ptr fs:[00000030h]	0_2_0045578C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0045578C mov eax, dword ptr fs:[00000030h]	0_2_0045578C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0045578C mov eax, dword ptr fs:[00000030h]	0_2_0045578C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0045578C mov eax, dword ptr fs:[00000030h]	0_2_0045578C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0045578C mov eax, dword ptr fs:[00000030h]	0_2_0045578C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0045578C mov eax, dword ptr fs:[00000030h]	0_2_0045578C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0045578C mov eax, dword ptr fs:[00000030h]	0_2_0045578C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0045578C mov eax, dword ptr fs:[00000030h]	0_2_0045578C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0045578C mov eax, dword ptr fs:[00000030h]	0_2_0045578C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0045578C mov eax, dword ptr fs:[00000030h]	0_2_0045578C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0045578C mov eax, dword ptr fs:[00000030h]	0_2_0045578C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0045578C mov eax, dword ptr fs:[00000030h]	0_2_0045578C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00453C30 mov eax, dword ptr fs:[00000030h]	0_2_00453C30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00453C30 mov ecx, dword ptr fs:[00000030h]	0_2_00453C30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00454577 mov eax, dword ptr fs:[00000030h]	0_2_00454577
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004E2C80 mov eax, dword ptr fs:[00000030h]	0_2_004E2C80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004D3280 mov eax, dword ptr fs:[00000030h]	0_2_004D3280
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004D1480 mov eax, dword ptr fs:[00000030h]	0_2_004D1480
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004DF790 mov ecx, dword ptr fs:[00000030h]	0_2_004DF790
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00453E0C mov eax, dword ptr fs:[00000030h]	0_2_00453E0C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00453E0C mov eax, dword ptr fs:[00000030h]	0_2_00453E0C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00453E0C mov eax, dword ptr fs:[00000030h]	0_2_00453E0C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00453E0C mov eax, dword ptr fs:[00000030h]	0_2_00453E0C

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_004FA050 GetProcessHeap,InternetOpenA,InternetOpenUrlA,InternetReadFile,InternetReadFile,InternetCloseHandle,InternetCloseHandle,

0_2_004FA050

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00453C30 Sleep,GetCurrentProcess,SetPriorityClass,SetUnhandledExceptionFilter,SetThreadExecutionState,SetThreadExecutionState,LoadLibraryA,GetModuleFileNameA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,GetProcessId,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,SetThreadExecutionState,SetThreadExecutionState,LoadLibraryA,CreateThread,FindCloseChangeNotification,GetTempPathA,CreateDirectoryA,CreateDirectoryA,CreateDirectoryA,SetCurrentDirectoryA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,OutputDebugStringA,OutputDebugStringA,OutputDebugStringA,CreateThread,CreateThread,CreateThread,OutputDebugStringA,CreateMutexA,GetLastError,Sleep,Sleep,Sleep,Sleep,Sleep,shutdown,closesocket,Sleep,	0_2_00453C30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0042EA14 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_0042EA14
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0042EBA1 SetUnhandledExceptionFilter,	0_2_0042EBA1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0042EDAD SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_0042EDAD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004332F4 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_004332F4

HIPS / PFW / Operating System Protection Evasion

Contains functionality to inject threads in other processes

Source: C:\Users\user\Desktop\file.exe

0_2_004DB380

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0042E615 cpuid

0_2_0042E615

Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoEx,FormatMessageA,	0_2_0042C623
Source: C:\Users\user\Desktop\file.exe	Code function: GetACP,IsValidCodePage,GetLocaleInfoW,	0_2_0044D3EB
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,	0_2_0044D5F0
Source: C:\Users\user\Desktop\file.exe	Code function: EnumSystemLocalesW,	0_2_0044D6E2
Source: C:\Users\user\Desktop\file.exe	Code function: EnumSystemLocalesW,	0_2_0044D697
Source: C:\Users\user\Desktop\file.exe	Code function: EnumSystemLocalesW,	0_2_0044D77D
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	0_2_0044D808
Source: C:\Users\user\Desktop\file.exe	Code function: EnumSystemLocalesW,	0_2_00445A41
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,	0_2_0044DA5B
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_0044DB84
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,	0_2_0044DC8A
Source: C:\Users\user\Desktop\file.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_0044DD60

Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0043C1FB GetSystemTimeAsFileTime,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,

0_2_0043C1FB

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_004E2AC0 GetUserNameA,GetComputerNameA,GetCurrentProcess,TerminateProcess,

0_2_004E2AC0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_004479BE GetTimeZoneInformation,

0_2_004479BE

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00551070 GetVersionExA,GetFileAttributesW,GetFileAttributesA,

0_2_00551070

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: Amcache.hve.3.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.3.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.3.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.3.dr	Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information

Yara detected RisePro Stealer

Source: Yara match	File source: 00000000.00000002.2008702665.000000000418E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2009564997.0000000008CB9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 2896, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\W9yZG_t61Z_J7GfmBn540XA.zip, type: DROPPED

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe, 00000000.00000002.2008702665.0000000004206000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Electrum\walletsq
Source: file.exe, 00000000.00000003.1910906464.0000000008CED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\ElectronCash\wallets
Source: file.exe, 00000000.00000002.2008702665.0000000004206000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\com.liberty.jaxx;
Source: file.exe, 00000000.00000002.2008702665.0000000004206000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: file.exe, 00000000.00000002.2008702665.0000000004206000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\Ethereum\wallets
Source: file.exe, 00000000.00000002.2008702665.0000000004206000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: file.exe, 00000000.00000002.2008702665.0000000004206000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\Ethereum\wallets
Source: file.exe, 00000000.00000003.1910906464.0000000008CED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: file.exe, 00000000.00000002.2008702665.0000000004206000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\Ledger Live

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj\CURRENT	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig\CURRENT	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi\CURRENT	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj\CURRENT	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao\CURRENT	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn\CURRENT	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi\CURRENT	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\kncchdigobghenbbaddojjnnaogfppfj\CURRENT	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\chrome-extension_blnieiiffboillknjnepogjhkgnoapac_0.indexeddb.leveldb\CURRENT	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\chrome-extension_cjelfplplebdjjenllpjcblmjkfcffne_0.indexeddb.leveldb\CURRENT	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj\CURRENT	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih\CURRENT	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn\CURRENT	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln\CURRENT	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\signons.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\logins.json	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\blnieiiffboillknjnepogjhkgnoapac\CURRENT	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec\CURRENT	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec\CURRENT	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln\CURRENT	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac\CURRENT	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk\CURRENT	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\signons.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\logins.json	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih\CURRENT	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm\CURRENT	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai\CURRENT	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao\CURRENT	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn\CURRENT	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig\CURRENT	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne\CURRENT	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai\CURRENT	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk\CURRENT	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\kpfopkelmapcoipemfendmdcghnegimn\CURRENT	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm\CURRENT	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne\CURRENT	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Jump to behavior

Source: Yara match	File source: 00000000.00000002.2008702665.0000000004206000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 2896, type: MEMORYSTR

Remote Access Functionality

Yara detected RisePro Stealer

Source: Yara match	File source: 00000000.00000002.2008702665.000000000418E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2009564997.0000000008CB9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 2896, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\W9yZG_t61Z_J7GfmBn540XA.zip, type: DROPPED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	1 OS Credential Dumping	12 System Time Discovery	Remote Services	1 Archive Collected Data	2 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	3 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	11 Process Injection	2 Obfuscated Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	2 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	2 Software Packing	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	1 Screen Capture	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	47 System Information Discovery	Distributed Component Object Model	1 Email Collection	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Masquerading	LSA Secrets	1 Query Registry	SSH	Keylogging	13 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Virtualization/Sandbox Evasion	Cached Domain Credentials	61 Security Software Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	11 Process Injection	DCSync	1 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	2 Process Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	1 Application Window Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	Dynamic API Resolution	Network Sniffing	1 System Owner/User Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	Stripped Payloads	Input Capture	1 System Network Configuration Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	39%	ReversingLabs
file.exe	45%	Virustotal		Browse
file.exe	100%	Avira	HEUR/AGEN.1313019
file.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
http://193.233.132.167/cost/lenin.exe	100%	URL Reputation	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
ipinfo.io	34.117.186.192	true	false		high
db-ip.com	172.67.75.166	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://ipinfo.io/widget/demo/81.181.57.52	false		high
https://db-ip.com/demo/home.php?s=81.181.57.52	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	file.exe, 00000000.00000003.1769245344.0000000008D1C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1767408508.0000000008D05000.00000004.00000020.00020000.00000000.sdmp, kpoRIew0KmbRWeb Data.0.dr, 6xWctsbrfVe0Web Data.0.dr, v9sfzApO2m4MWeb Data.0.dr	false		high
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF	D87fZN3R3jFeplaces.sqlite.0.dr	false		high
http://.102:57amadka.	file.exe, 00000000.00000002.2008702665.0000000004206000.00000004.00000020.00020000.00000000.sdmp	false		low
https://duckduckgo.com/ac/?q=	file.exe, 00000000.00000003.1769245344.0000000008D1C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1767408508.0000000008D05000.00000004.00000020.00020000.00000000.sdmp, kpoRIew0KmbRWeb Data.0.dr, 6xWctsbrfVe0Web Data.0.dr, v9sfzApO2m4MWeb Data.0.dr	false		high
http://www.winimage.com/zLibD	file.exe, 00000000.00000002.2009091900.000000000459F000.00000040.00000020.00020000.00000000.sdmp	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	file.exe, 00000000.00000003.1769245344.0000000008D1C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1767408508.0000000008D05000.00000004.00000020.00020000.00000000.sdmp, kpoRIew0KmbRWeb Data.0.dr, 6xWctsbrfVe0Web Data.0.dr, v9sfzApO2m4MWeb Data.0.dr	false		high
http://147.45.47.102:57893/hera/amadka.exe-	file.exe, 00000000.00000002.2008702665.0000000004206000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://db-ip.com/demo/home.php?s=81.181.57.524	file.exe, 00000000.00000002.2008702665.0000000004206000.00000004.00000020.00020000.00000000.sdmp	false		high
http://147.45.47.102:57893/hera/amadka.exe	file.exe, 00000000.00000002.2008702665.0000000004206000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://db-ip.com/	file.exe, 00000000.00000002.2008702665.0000000004206000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	file.exe, 00000000.00000003.1769245344.0000000008D1C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1767408508.0000000008D05000.00000004.00000020.00020000.00000000.sdmp, kpoRIew0KmbRWeb Data.0.dr, 6xWctsbrfVe0Web Data.0.dr, v9sfzApO2m4MWeb Data.0.dr	false		high
http://upx.sf.net	Amcache.hve.3.dr	false		high
https://t.me/RiseProSUPPORT	file.exe, 00000000.00000002.2008702665.000000000418E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2009564997.0000000008CB9000.00000004.00000020.00020000.00000000.sdmp, W9yZG_t61Z_J7GfmBn540XA.zip.0.dr	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	file.exe, 00000000.00000003.1769245344.0000000008D1C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1767408508.0000000008D05000.00000004.00000020.00020000.00000000.sdmp, kpoRIew0KmbRWeb Data.0.dr, 6xWctsbrfVe0Web Data.0.dr, v9sfzApO2m4MWeb Data.0.dr	false		high
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	file.exe, 00000000.00000003.1768920337.0000000008CFB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1766930296.0000000008CE3000.00000004.00000020.00020000.00000000.sdmp, Cma6mvK3hWvIHistory.0.dr, ZP9OgwnUTBtwHistory.0.dr	false		high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	file.exe, 00000000.00000003.1768920337.0000000008CFB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1766930296.0000000008CE3000.00000004.00000020.00020000.00000000.sdmp, Cma6mvK3hWvIHistory.0.dr, ZP9OgwnUTBtwHistory.0.dr	false		high
https://www.ecosia.org/newtab/	file.exe, 00000000.00000003.1769245344.0000000008D1C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1767408508.0000000008D05000.00000004.00000020.00020000.00000000.sdmp, kpoRIew0KmbRWeb Data.0.dr, 6xWctsbrfVe0Web Data.0.dr, v9sfzApO2m4MWeb Data.0.dr	false		high
https://db-ip.com:443/demo/home.php?s=81.181.57.52?9d1	file.exe, 00000000.00000002.2008702665.0000000004206000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ipinfo.io/Mozilla/5.0	file.exe, 00000000.00000002.2008702665.0000000004206000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	D87fZN3R3jFeplaces.sqlite.0.dr	false		high
https://ipinfo.io/B	file.exe, 00000000.00000002.2008702665.00000000041BE000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ipinfo.io/Content-Type:	file.exe, 00000000.00000002.2007216495.0000000000400000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2009188631.0000000005ED0000.00000040.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000003.1636879616.0000000006070000.00000004.00001000.00020000.00000000.sdmp	false		high
http://193.233.132.167/cost/go.exe.1	file.exe, 00000000.00000002.2008702665.0000000004206000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://ipinfo.io:443/widget/demo/81.181.57.520%	file.exe, 00000000.00000002.2008702665.0000000004206000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.233.132.167/cost/go.exe	file.exe, 00000000.00000002.2008702665.0000000004206000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://ac.ecosia.org/autocomplete?q=	file.exe, 00000000.00000003.1769245344.0000000008D1C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1767408508.0000000008D05000.00000004.00000020.00020000.00000000.sdmp, kpoRIew0KmbRWeb Data.0.dr, 6xWctsbrfVe0Web Data.0.dr, v9sfzApO2m4MWeb Data.0.dr	false		high
https://t.me/risepro_bot	file.exe, 00000000.00000002.2008702665.0000000004206000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1880373194.0000000008CFF000.00000004.00000020.00020000.00000000.sdmp, passwords.txt.0.dr	false		high
https://ipinfo.io/	file.exe, 00000000.00000002.2008702665.0000000004206000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.maxmind.com/en/locate-my-ip-address	file.exe, file.exe, 00000000.00000002.2007216495.0000000000400000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2009188631.0000000005ED0000.00000040.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000003.1636879616.0000000006070000.00000004.00001000.00020000.00000000.sdmp	false		high
https://ipinfo.io/1D	file.exe, 00000000.00000002.2008702665.00000000041C3000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install	Cma6mvK3hWvIHistory.0.dr, ZP9OgwnUTBtwHistory.0.dr	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	file.exe, 00000000.00000003.1769245344.0000000008D1C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1767408508.0000000008D05000.00000004.00000020.00020000.00000000.sdmp, kpoRIew0KmbRWeb Data.0.dr, 6xWctsbrfVe0Web Data.0.dr, v9sfzApO2m4MWeb Data.0.dr	false		high
http://www.winimage.com/zLibDll	file.exe, 00000000.00000003.1636879616.0000000006070000.00000004.00001000.00020000.00000000.sdmp	false		high
https://db-ip.com/demo/home.php?s=81.181.57.52q.	file.exe, 00000000.00000002.2008702665.00000000041EB000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.mozilla.org	D87fZN3R3jFeplaces.sqlite.0.dr	false		high
http://193.233.132.167/cost/lenin.exe	file.exe, 00000000.00000002.2008702665.0000000004206000.00000004.00000020.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	Cma6mvK3hWvIHistory.0.dr, ZP9OgwnUTBtwHistory.0.dr	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	file.exe, 00000000.00000003.1769245344.0000000008D1C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1767408508.0000000008D05000.00000004.00000020.00020000.00000000.sdmp, kpoRIew0KmbRWeb Data.0.dr, 6xWctsbrfVe0Web Data.0.dr, v9sfzApO2m4MWeb Data.0.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
34.117.186.192	ipinfo.io	United States	139070	GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	false
147.45.47.93	unknown	Russian Federation	2895	FREE-NET-ASFREEnetEU	true
172.67.75.166	db-ip.com	United States	13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1429353
Start date and time:	2024-04-22 01:28:04 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 22s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	40
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@15/94@2/3
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 56% Number of executed functions: 96 Number of non-executed functions: 55
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): WerFault.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 13.89.179.12
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, login.live.com, blobcollector.events.data.trafficmanager.net, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, onedsblobprdcus17.centralus.cloudapp.azure.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
34.117.186.192	SecuriteInfo.com.Win32.Evo-gen.24318.16217.exe	Get hash	malicious	Unknown	Browse	ipinfo.io/json
	SecuriteInfo.com.Win32.Evo-gen.28489.31883.exe	Get hash	malicious	Unknown	Browse	ipinfo.io/json
	Raptor.HardwareService.Setup 1.msi	Get hash	malicious	Unknown	Browse	ipinfo.io/ip
	Conferma_Pdf_Editor.exe	Get hash	malicious	Planet Stealer	Browse	ipinfo.io/
	Conferma_Pdf_Editor.exe	Get hash	malicious	Planet Stealer	Browse	ipinfo.io/
	w.sh	Get hash	malicious	Xmrig	Browse	/ip
	Raptor.HardwareService.Setup_2.3.6.0.msi	Get hash	malicious	Unknown	Browse	ipinfo.io/ip
	Raptor.HardwareService.Setup_2.3.6.0.msi	Get hash	malicious	Unknown	Browse	ipinfo.io/ip
	uUsgzQ3DoW.exe	Get hash	malicious	RedLine	Browse	ipinfo.io/ip
	8BZBgbeCcz.exe	Get hash	malicious	RedLine	Browse	ipinfo.io/ip
147.45.47.93	file.exe	Get hash	malicious	RisePro Stealer	Browse
	qk9TaBBxh8.exe	Get hash	malicious	LummaC, Glupteba, Mars Stealer, PureLog Stealer, RedLine, RisePro Stealer, SmokeLoader	Browse
	s2dwlCsA95.exe	Get hash	malicious	RisePro Stealer	Browse
	SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	Get hash	malicious	Amadey, RedLine, RisePro Stealer	Browse
	SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe	Get hash	malicious	LummaC, Glupteba, LummaC Stealer, Mars Stealer, PureLog Stealer, RedLine, RisePro Stealer	Browse
	UeW2b6mU6Z.exe	Get hash	malicious	Amadey, RisePro Stealer	Browse
	tA6etkt3gb.exe	Get hash	malicious	Amadey, PureLog Stealer, RedLine, RisePro Stealer, zgRAT	Browse
	file.exe	Get hash	malicious	RisePro Stealer	Browse
	dendy.exe	Get hash	malicious	RisePro Stealer	Browse
	Q73YlTAmWe.exe	Get hash	malicious	RisePro Stealer	Browse
172.67.75.166	s2dwlCsA95.exe	Get hash	malicious	RisePro Stealer	Browse
	file.exe	Get hash	malicious	Clipboard Hijacker, RisePro Stealer	Browse
	TANQUIVUIA.exe	Get hash	malicious	LummaC, RisePro Stealer	Browse
	oZ8kX4OA5q.exe	Get hash	malicious	RisePro Stealer	Browse
	S2ruRfajig.exe	Get hash	malicious	RisePro Stealer	Browse
	WARYTtjh4l.exe	Get hash	malicious	RisePro Stealer	Browse
	fzrGl94EQ2.exe	Get hash	malicious	RisePro Stealer	Browse
	SeR6QESSMe.exe	Get hash	malicious	RisePro Stealer	Browse
	z21FdylQJD.exe	Get hash	malicious	RisePro Stealer	Browse
	tBtJCF8REJ.exe	Get hash	malicious	RisePro Stealer	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ipinfo.io	file.exe	Get hash	malicious	Clipboard Hijacker, RisePro Stealer	Browse	34.117.186.192
	Dj43d18ukx.exe	Get hash	malicious	DCRat	Browse	34.117.186.192
	SenPalia.exe	Get hash	malicious	Unknown	Browse	34.117.186.192
	UnderWars.exe	Get hash	malicious	Unknown	Browse	34.117.186.192
	SenPalia.exe	Get hash	malicious	Unknown	Browse	34.117.186.192
	UnderWars.exe	Get hash	malicious	Unknown	Browse	34.117.186.192
	2q45IEa3Ee.exe	Get hash	malicious	LummaC, RisePro Stealer	Browse	34.117.186.192
	file.exe	Get hash	malicious	Clipboard Hijacker, RisePro Stealer	Browse	34.117.186.192
	SajWKdHxdF.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192
	file.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192
db-ip.com	file.exe	Get hash	malicious	Clipboard Hijacker, RisePro Stealer	Browse	104.26.5.15
	2q45IEa3Ee.exe	Get hash	malicious	LummaC, RisePro Stealer	Browse	104.26.5.15
	file.exe	Get hash	malicious	Clipboard Hijacker, RisePro Stealer	Browse	104.26.4.15
	SajWKdHxdF.exe	Get hash	malicious	RisePro Stealer	Browse	104.26.5.15
	file.exe	Get hash	malicious	RisePro Stealer	Browse	104.26.4.15
	s2dwlCsA95.exe	Get hash	malicious	RisePro Stealer	Browse	172.67.75.166
	SecuriteInfo.com.Win32.Evo-gen.15237.11182.exe	Get hash	malicious	Amadey, RedLine, RisePro Stealer	Browse	104.26.5.15
	UeW2b6mU6Z.exe	Get hash	malicious	Amadey, RisePro Stealer	Browse	104.26.5.15
	file.exe	Get hash	malicious	RisePro Stealer	Browse	104.26.4.15
	dendy.exe	Get hash	malicious	RisePro Stealer	Browse	104.26.5.15

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	file.exe	Get hash	malicious	Clipboard Hijacker, RisePro Stealer	Browse	34.117.186.192
	Dj43d18ukx.exe	Get hash	malicious	DCRat	Browse	34.117.186.192
	SenPalia.exe	Get hash	malicious	Unknown	Browse	34.117.186.192
	UnderWars.exe	Get hash	malicious	Unknown	Browse	34.117.186.192
	SenPalia.exe	Get hash	malicious	Unknown	Browse	34.117.186.192
	UnderWars.exe	Get hash	malicious	Unknown	Browse	34.117.186.192
	2q45IEa3Ee.exe	Get hash	malicious	LummaC, RisePro Stealer	Browse	34.117.186.192
	file.exe	Get hash	malicious	Clipboard Hijacker, RisePro Stealer	Browse	34.117.186.192
	SajWKdHxdF.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192
	file.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192
CLOUDFLARENETUS	file.exe	Get hash	malicious	Clipboard Hijacker, RisePro Stealer	Browse	104.26.5.15
	https://shiny-haze-e3f9.oriental-chef-hrg9939.workers.dev/	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	https://pub-a7051849f97e40258b2898070eea69ef.r2.dev/index.html	Get hash	malicious	HTMLPhisher	Browse	104.18.3.35
	https://yxv.ens.mybluehost.me/Ca/net/login.php	Get hash	malicious	Unknown	Browse	162.247.243.29
	https://yzkgxjyz0y4417anol.pages.dev/smart89/	Get hash	malicious	Unknown	Browse	172.66.45.32
	https://pub-ad26986ae16e4366a1d34c587ca0df93.r2.dev/megme.html	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	https://topwingroups.top/login.php	Get hash	malicious	Unknown	Browse	104.21.19.92
	https://pub-cece57d8d2864d24b41d6f56ef2fee01.r2.dev/light.html	Get hash	malicious	HTMLPhisher	Browse	104.18.2.35
	https://www.itstoreindia.com/web/info.php	Get hash	malicious	DHL Phishing	Browse	104.21.36.246
	https://funne.freewebhostmost.com/DHL-MULTI_M-2024/MTTRBDFH/	Get hash	malicious	HTMLPhisher	Browse	104.17.24.14
FREE-NET-ASFREEnetEU	file.exe	Get hash	malicious	Clipboard Hijacker, RisePro Stealer	Browse	193.233.132.175
	2q45IEa3Ee.exe	Get hash	malicious	LummaC, RisePro Stealer	Browse	193.233.132.253
	file.exe	Get hash	malicious	Clipboard Hijacker, RisePro Stealer	Browse	193.233.132.175
	SajWKdHxdF.exe	Get hash	malicious	RisePro Stealer	Browse	193.233.132.226
	SajWKdHxdF.exe	Get hash	malicious	RisePro Stealer	Browse	193.233.132.226
	file.exe	Get hash	malicious	RisePro Stealer	Browse	147.45.47.93
	jNeaezBuo8.exe	Get hash	malicious	Glupteba, Mars Stealer, PureLog Stealer, Stealc, Vidar, zgRAT	Browse	193.233.132.175
	74fa486WVX.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, Stealc, Vidar, zgRAT	Browse	193.233.132.234
	qk9TaBBxh8.exe	Get hash	malicious	LummaC, Glupteba, Mars Stealer, PureLog Stealer, RedLine, RisePro Stealer, SmokeLoader	Browse	193.233.132.226
	s2dwlCsA95.exe	Get hash	malicious	RisePro Stealer	Browse	147.45.47.93

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	file.exe	Get hash	malicious	Clipboard Hijacker, RisePro Stealer	Browse	34.117.186.192 172.67.75.166
	https://yxv.ens.mybluehost.me/Ca/net/login.php	Get hash	malicious	Unknown	Browse	34.117.186.192 172.67.75.166
	2q45IEa3Ee.exe	Get hash	malicious	LummaC, RisePro Stealer	Browse	34.117.186.192 172.67.75.166
	Pictures.com.exe	Get hash	malicious	DBatLoader	Browse	34.117.186.192 172.67.75.166
	2FjvjcayaH.exe	Get hash	malicious	LummaC	Browse	34.117.186.192 172.67.75.166
	qrLdMv1QXG.exe	Get hash	malicious	LummaC	Browse	34.117.186.192 172.67.75.166
	PASS-1234.exe	Get hash	malicious	LummaC	Browse	34.117.186.192 172.67.75.166
	file.exe	Get hash	malicious	LummaC	Browse	34.117.186.192 172.67.75.166
	file.exe	Get hash	malicious	LummaC	Browse	34.117.186.192 172.67.75.166
	file.exe	Get hash	malicious	Clipboard Hijacker, RisePro Stealer	Browse	34.117.186.192 172.67.75.166

Dropped Files

⊘No context

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_file.exe_4d3f288dd4798765eb91273da4b76d6bea17316_52238708_10335d55-7344-4798-868a-642b323fdb2a\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.0284214926729556
Encrypted:	false
SSDEEP:	192:uiTN4kvxOPyS056rPI3jS3ZrYbajzuiFcZ24IO8kVBb4:cmxO6Z56rIj0jzuiFcY4IO8a
MD5:	4A45F971BB3539C6096FE946B73C4AAE
SHA1:	FD7A1065C5EB47852B7342DD14D8C5533954B47C
SHA-256:	31D8A872F4DC5B030E495325D79E5C5CC85F74322D4C96E13AD03AA026F46C20
SHA-512:	9BC2FC02C3802D56F1F5417A4DD777C31F846B67C10FA0E45D7F417577292EDE04C6DC769A98A6069466F98193BF57698C5D4017DCFE65D4DB6A01BBA042082B
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.8.2.1.5.7.4.1.5.7.1.9.6.3.5.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.1.0.3.3.5.d.5.5.-.7.3.4.4.-.4.7.9.8.-.8.6.8.a.-.6.4.2.b.3.2.3.f.d.b.2.a.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.5.6.2.d.e.b.8.b.-.c.2.1.0.-.4.f.7.d.-.b.a.8.e.-.5.b.1.6.3.4.5.2.7.f.3.7.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.f.i.l.e...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.b.5.0.-.0.0.0.1.-.0.0.1.4.-.8.1.a.6.-.d.7.a.a.4.3.9.4.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.7.a.8.4.5.2.c.e.3.e.f.7.3.0.5.5.2.d.9.8.1.1.8.7.1.8.1.d.5.4.2.b.0.0.0.0.0.a.1.6.!.0.0.0.0.f.e.b.e.9.d.2.6.8.d.3.1.c.1.7.a.2.4.c.0.c.a.e.2.d.2.e.2.b.5.d.6.1.7.d.8.6.0.8.f.!.f.i.l.e...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.0.4././.2.1.:.0.7.:.5.8.:.4.0.!.0.!.f.i.l.e...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.9.6.7.2.9.5.....S.e.r.v.i.c.e.S.p.l.i.t.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_file.exe_4d3f288dd4798765eb91273da4b76d6bea17316_52238708_15d3ae8c-14d8-47b4-889c-158b8969f6cd\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9343928585093682
Encrypted:	false
SSDEEP:	192:7iTN4kvuPyS056rPI3jS3ZrYDzuiFcZ24IO8kVBb4Y:lmu6Z56rIjpzuiFcY4IO8a
MD5:	7E4259CEF75EB08D1677112E2DCE38E7
SHA1:	AE947F27280C5741B2161BE8DD571C5DBF75DED2
SHA-256:	DA672A81F2CFE9D0655E03406669AE074528CA6BFFC6DE6FBAE972FDF5CE7DF3
SHA-512:	D6AB6BE1B2F5A6D48C1605082E3790243CF8EC550D0B0FEDFEDB0AFB4620F67AE57F3FBC51353BFF90B493FDCFECF3A2A947DEEFE8E7C47A375DF208AEE75DAC
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.8.2.1.5.7.3.4.9.7.1.7.7.2.4.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.1.5.d.3.a.e.8.c.-.1.4.d.8.-.4.7.b.4.-.8.8.9.c.-.1.5.8.b.8.9.6.9.f.6.c.d.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.3.1.3.2.5.4.8.f.-.4.6.1.b.-.4.0.a.0.-.8.0.c.e.-.9.2.c.0.1.d.6.9.7.3.a.f.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.f.i.l.e...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.b.5.0.-.0.0.0.1.-.0.0.1.4.-.8.1.a.6.-.d.7.a.a.4.3.9.4.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.7.a.8.4.5.2.c.e.3.e.f.7.3.0.5.5.2.d.9.8.1.1.8.7.1.8.1.d.5.4.2.b.0.0.0.0.0.a.1.6.!.0.0.0.0.f.e.b.e.9.d.2.6.8.d.3.1.c.1.7.a.2.4.c.0.c.a.e.2.d.2.e.2.b.5.d.6.1.7.d.8.6.0.8.f.!.f.i.l.e...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.0.4././.2.1.:.0.7.:.5.8.:.4.0.!.0.!.f.i.l.e...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.9.6.7.2.9.5.....S.e.r.v.i.c.e.S.p.l.i.t.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_file.exe_4d3f288dd4798765eb91273da4b76d6bea17316_52238708_407a37f6-a980-4391-8494-bf9bcb7a1c8d\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.047780135809523
Encrypted:	false
SSDEEP:	192:0diTN4kvsPyS056rPI3jS3ZrYbWJzuiFcZ24IO8kVBb4:0jms6Z56rIj4JzuiFcY4IO8a
MD5:	F32465F1358D010B64EED37847639D7C
SHA1:	7A6882F9D7E248C7349BC7644A8DD822DFCFD7A8
SHA-256:	FD0FAFE9C2D3CF8F49EFFA5DD3022CB1C609B099332DB5C9EFF3A9FD19148C19
SHA-512:	ACCA33C1160B252646BD7D9912E9D61449CD7D2FAB2545A08753863113FAB5E15F58853C423FEA9BF924590BBD05854ECC7D80BDA9826F67052ED5B253226DEC
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.8.2.1.5.7.5.0.5.5.2.0.3.5.9.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.4.0.7.a.3.7.f.6.-.a.9.8.0.-.4.3.9.1.-.8.4.9.4.-.b.f.9.b.c.b.7.a.1.c.8.d.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.3.d.8.1.0.8.e.8.-.2.1.b.c.-.4.d.d.0.-.8.5.2.3.-.a.e.a.d.f.d.3.1.2.5.2.b.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.f.i.l.e...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.b.5.0.-.0.0.0.1.-.0.0.1.4.-.8.1.a.6.-.d.7.a.a.4.3.9.4.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.7.a.8.4.5.2.c.e.3.e.f.7.3.0.5.5.2.d.9.8.1.1.8.7.1.8.1.d.5.4.2.b.0.0.0.0.0.a.1.6.!.0.0.0.0.f.e.b.e.9.d.2.6.8.d.3.1.c.1.7.a.2.4.c.0.c.a.e.2.d.2.e.2.b.5.d.6.1.7.d.8.6.0.8.f.!.f.i.l.e...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.0.4././.2.1.:.0.7.:.5.8.:.4.0.!.0.!.f.i.l.e...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.9.6.7.2.9.5.....S.e.r.v.i.c.e.S.p.l.i.t.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_file.exe_4d3f288dd4798765eb91273da4b76d6bea17316_52238708_681b8baa-75ab-45c4-b7b0-ae76b7b2d453\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9080577808324307
Encrypted:	false
SSDEEP:	192:XiTN4kvfPyS056rPI3jS3ZrYszuiFcZ24IO8kVBb4:pmf6Z56rIjWzuiFcY4IO8a
MD5:	3285F04756C85B4413534794F0936FD0
SHA1:	74E97A927EAD7E7B16B5404F3D9E9B4C79462394
SHA-256:	E64FADA14199ED663C419B596691C0BF88A497E9D4B7621BBFA7B09CEF8A2EB6
SHA-512:	D1BCE5152B4ED1F90DD95CC571F623BA8B84F21753EF31DE23831EF01A76A29BE7A2E65E53B1CB2102C2D00A702EB4CEF82ABC0870BF4747FB556C9C59B9076F
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.8.2.1.5.7.3.4.3.4.7.7.7.0.0.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.6.8.1.b.8.b.a.a.-.7.5.a.b.-.4.5.c.4.-.b.7.b.0.-.a.e.7.6.b.7.b.2.d.4.5.3.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.3.8.5.d.2.a.b.4.-.6.3.b.4.-.4.a.e.8.-.8.b.c.d.-.f.c.1.3.7.f.5.e.3.8.2.8.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.f.i.l.e...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.b.5.0.-.0.0.0.1.-.0.0.1.4.-.8.1.a.6.-.d.7.a.a.4.3.9.4.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.7.a.8.4.5.2.c.e.3.e.f.7.3.0.5.5.2.d.9.8.1.1.8.7.1.8.1.d.5.4.2.b.0.0.0.0.0.a.1.6.!.0.0.0.0.f.e.b.e.9.d.2.6.8.d.3.1.c.1.7.a.2.4.c.0.c.a.e.2.d.2.e.2.b.5.d.6.1.7.d.8.6.0.8.f.!.f.i.l.e...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.0.4././.2.1.:.0.7.:.5.8.:.4.0.!.0.!.f.i.l.e...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.9.6.7.2.9.5.....S.e.r.v.i.c.e.S.p.l.i.t.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_file.exe_4d3f288dd4798765eb91273da4b76d6bea17316_52238708_688cbf8b-67c3-4b5a-8f65-1c3ad19de2a6\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9888250838635992
Encrypted:	false
SSDEEP:	192:YjiTN4kvuPyS056rPI3jS3ZrYbNzuiFcZ24IO8kVBb4:2mu6Z56rIjDzuiFcY4IO8a
MD5:	00CE2C3901C6B8D1CBB8A604CF066132
SHA1:	EC25C076C648E507A590F2C84B1C673139DEAEB1
SHA-256:	FBDC70BD536146DC6D122F2024C95E06D587E8491463EAD22EC1C81B08F87D8B
SHA-512:	2916E5E5EEAA5F9A4ECB902D3D8FBA3DAA004CB663B1FD18921BBB11CEA2017F3B80DDDB3523F09F4D8AFF2ADEA03E4656EE9AFAE7BD044D444533C02C6B842D
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.8.2.1.5.7.3.7.1.6.2.0.3.7.0.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.6.8.8.c.b.f.8.b.-.6.7.c.3.-.4.b.5.a.-.8.f.6.5.-.1.c.3.a.d.1.9.d.e.2.a.6.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.6.9.2.c.e.7.b.1.-.c.4.5.4.-.4.d.0.6.-.b.7.d.8.-.0.a.0.e.e.1.1.4.3.5.8.4.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.f.i.l.e...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.b.5.0.-.0.0.0.1.-.0.0.1.4.-.8.1.a.6.-.d.7.a.a.4.3.9.4.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.7.a.8.4.5.2.c.e.3.e.f.7.3.0.5.5.2.d.9.8.1.1.8.7.1.8.1.d.5.4.2.b.0.0.0.0.0.a.1.6.!.0.0.0.0.f.e.b.e.9.d.2.6.8.d.3.1.c.1.7.a.2.4.c.0.c.a.e.2.d.2.e.2.b.5.d.6.1.7.d.8.6.0.8.f.!.f.i.l.e...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.0.4././.2.1.:.0.7.:.5.8.:.4.0.!.0.!.f.i.l.e...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.9.6.7.2.9.5.....S.e.r.v.i.c.e.S.p.l.i.t.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_file.exe_4d3f288dd4798765eb91273da4b76d6bea17316_52238708_83ca9a92-fbbd-4d11-a1a6-fbba96d67552\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9345700594944922
Encrypted:	false
SSDEEP:	192:oeMiTN4kvnPyS056rPI3jS3ZrYDzuiFcZ24IO8kVBb4:Pumn6Z56rIjpzuiFcY4IO8a
MD5:	FA5BB8E5A8753FA52CA7360EA984AC1A
SHA1:	8E713B704632C015E045352200F1CD36CCDA9858
SHA-256:	34812D813BE432C81EB40C0F41416C9F2D8FD258524A3488232F7CF4E88694C2
SHA-512:	6CA920BB22315CE004626AC36D8DD1BC3F5D36A22BF19B13FD972182901383934B7D3DE5A906703058116F7FF2CE2878FDDDB07ECB0DB0E4934B292FFCA8542E
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.8.2.1.5.7.3.5.5.6.4.6.7.8.2.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.8.3.c.a.9.a.9.2.-.f.b.b.d.-.4.d.1.1.-.a.1.a.6.-.f.b.b.a.9.6.d.6.7.5.5.2.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.3.1.b.5.e.7.3.7.-.9.e.9.1.-.4.4.e.1.-.9.2.a.b.-.9.6.d.2.f.8.f.0.f.f.b.3.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.f.i.l.e...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.b.5.0.-.0.0.0.1.-.0.0.1.4.-.8.1.a.6.-.d.7.a.a.4.3.9.4.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.7.a.8.4.5.2.c.e.3.e.f.7.3.0.5.5.2.d.9.8.1.1.8.7.1.8.1.d.5.4.2.b.0.0.0.0.0.a.1.6.!.0.0.0.0.f.e.b.e.9.d.2.6.8.d.3.1.c.1.7.a.2.4.c.0.c.a.e.2.d.2.e.2.b.5.d.6.1.7.d.8.6.0.8.f.!.f.i.l.e...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.0.4././.2.1.:.0.7.:.5.8.:.4.0.!.0.!.f.i.l.e...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.9.6.7.2.9.5.....S.e.r.v.i.c.e.S.p.l.i.t.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_file.exe_4d3f288dd4798765eb91273da4b76d6bea17316_52238708_84b6f306-bf5a-493e-9e98-3770969605f7\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.0481064330216645
Encrypted:	false
SSDEEP:	192:WciTN4kvfnPyS056rPI3jS3ZrYbWJzuiFcZ24IO8kVBb45:W+mf6Z56rIj4JzuiFcY4IO8aG
MD5:	F56CE1230974A9506CA40F4E64B6A273
SHA1:	6773ACE1CC36127C298A0F79DF79D777A154C7C5
SHA-256:	4B141BBA003DC7769D4DEDD8E04280BD3AA408A2F6ADEA21EC1FAA246B05A266
SHA-512:	F8A70E9F0C7EF22DC027FDD536B4825CC803AC79E9B2081324F67C85409ACF17488C664C905FCC8CEDF18D706728138120424EC8F4FB1BF589CD4D49A5DA11CA
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.8.2.1.5.7.5.1.4.1.3.6.2.6.4.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.8.4.b.6.f.3.0.6.-.b.f.5.a.-.4.9.3.e.-.9.e.9.8.-.3.7.7.0.9.6.9.6.0.5.f.7.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.9.7.0.9.8.a.0.e.-.6.7.9.0.-.4.f.e.a.-.8.1.5.8.-.3.f.0.2.2.7.1.5.6.0.0.7.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.f.i.l.e...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.b.5.0.-.0.0.0.1.-.0.0.1.4.-.8.1.a.6.-.d.7.a.a.4.3.9.4.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.7.a.8.4.5.2.c.e.3.e.f.7.3.0.5.5.2.d.9.8.1.1.8.7.1.8.1.d.5.4.2.b.0.0.0.0.0.a.1.6.!.0.0.0.0.f.e.b.e.9.d.2.6.8.d.3.1.c.1.7.a.2.4.c.0.c.a.e.2.d.2.e.2.b.5.d.6.1.7.d.8.6.0.8.f.!.f.i.l.e...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.0.4././.2.1.:.0.7.:.5.8.:.4.0.!.0.!.f.i.l.e...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.9.6.7.2.9.5.....S.e.r.v.i.c.e.S.p.l.i.t.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_file.exe_4d3f288dd4798765eb91273da4b76d6bea17316_52238708_85a5fc3c-0a1c-48df-b75b-a51156fea0d7\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9344893344241797
Encrypted:	false
SSDEEP:	192:fbiTN4kvdPyS056rPI3jS3ZrYDzuiFcZ24IO8kVBb4:fFmd6Z56rIjpzuiFcY4IO8a
MD5:	3630E135CB74084DEE22D860ED92C1B3
SHA1:	6E2E4A2A2DB79696F9006DECEA3B26C8989358F0
SHA-256:	C96CFA154A417D6A59811CB053C5229B03D16E1E5960D14F9A19B8BFAA6C45CB
SHA-512:	F5ECE5B79BE4197E0177E6703E170CC50A32D3A19C88DF5E02D5F8E2766899157FDA0A3C08B76D84525F45232DD6E9803B419A9C19BEFEECDF250FC7FB90CE2E
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.8.2.1.5.7.3.6.1.7.9.2.6.7.2.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.8.5.a.5.f.c.3.c.-.0.a.1.c.-.4.8.d.f.-.b.7.5.b.-.a.5.1.1.5.6.f.e.a.0.d.7.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.4.8.2.0.8.a.e.4.-.c.1.2.e.-.4.f.3.1.-.a.4.7.1.-.7.a.5.3.1.e.f.2.7.9.4.8.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.f.i.l.e...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.b.5.0.-.0.0.0.1.-.0.0.1.4.-.8.1.a.6.-.d.7.a.a.4.3.9.4.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.7.a.8.4.5.2.c.e.3.e.f.7.3.0.5.5.2.d.9.8.1.1.8.7.1.8.1.d.5.4.2.b.0.0.0.0.0.a.1.6.!.0.0.0.0.f.e.b.e.9.d.2.6.8.d.3.1.c.1.7.a.2.4.c.0.c.a.e.2.d.2.e.2.b.5.d.6.1.7.d.8.6.0.8.f.!.f.i.l.e...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.0.4././.2.1.:.0.7.:.5.8.:.4.0.!.0.!.f.i.l.e...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.9.6.7.2.9.5.....S.e.r.v.i.c.e.S.p.l.i.t.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_file.exe_4d3f288dd4798765eb91273da4b76d6bea17316_52238708_9042f83a-504d-4950-abc0-e4e4679bb0f8\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	modified
Size (bytes):	65536
Entropy (8bit):	1.0480111729930894
Encrypted:	false
SSDEEP:	192:hiTN4kvtPyS056rPI3jS3ZrYbWJzuiFcZ24IO8kVBb4:/mt6Z56rIj4JzuiFcY4IO8a
MD5:	A4C27846ACC9B8F66DCC86073E80E7AF
SHA1:	0EC3189731027A4542E41BABD52B57235B0D33A9
SHA-256:	CFE44F1656F2AAF0183CBBC4C4906E7F53C23439EE7FCD21481892D93383DD6C
SHA-512:	1D372C0FB4847F49D92E103521870CA39901D238DACBF2818F2A5F2260299A6B4DE33A819E155ACAA0B3F3B0398FDDB57B6733159892C3C69971DE68DB3434D5
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.8.2.1.5.7.4.7.2.7.7.4.9.7.9.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.9.0.4.2.f.8.3.a.-.5.0.4.d.-.4.9.5.0.-.a.b.c.0.-.e.4.e.4.6.7.9.b.b.0.f.8.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.d.1.3.3.5.3.3.9.-.9.e.4.8.-.4.2.d.9.-.9.5.4.d.-.b.2.d.6.a.4.f.7.b.3.c.f.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.f.i.l.e...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.b.5.0.-.0.0.0.1.-.0.0.1.4.-.8.1.a.6.-.d.7.a.a.4.3.9.4.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.7.a.8.4.5.2.c.e.3.e.f.7.3.0.5.5.2.d.9.8.1.1.8.7.1.8.1.d.5.4.2.b.0.0.0.0.0.a.1.6.!.0.0.0.0.f.e.b.e.9.d.2.6.8.d.3.1.c.1.7.a.2.4.c.0.c.a.e.2.d.2.e.2.b.5.d.6.1.7.d.8.6.0.8.f.!.f.i.l.e...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.0.4././.2.1.:.0.7.:.5.8.:.4.0.!.0.!.f.i.l.e...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.9.6.7.2.9.5.....S.e.r.v.i.c.e.S.p.l.i.t.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_file.exe_4d3f288dd4798765eb91273da4b76d6bea17316_52238708_b4ee208a-c92f-4f51-be05-eaa535ab5445\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.0150491058888564
Encrypted:	false
SSDEEP:	192:FiTN4kvqPyS056rPI3jS3ZrYbzzuiFcZ24IO8kVBb4:Lmq6Z56rIjdzuiFcY4IO8a
MD5:	22BA37ADF5E2264826C08F7ECEA9FA49
SHA1:	D61C0F86C734470C1BFBBF89A9C31A0BFF6CC7A6
SHA-256:	70701C8AD7E1AA9AECA0D9675395C2EB708953357088D22E27251E55275AD553
SHA-512:	7E778DF5DDE777B70C6E129918BA22CBBDAC81C43458E977DFB74BEF2CC46FD560C173C460B49F9614DB98913802310B55B1D7B6909A139B593015CFC7D40C85
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.8.2.1.5.7.4.0.7.6.5.4.0.0.1.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.b.4.e.e.2.0.8.a.-.c.9.2.f.-.4.f.5.1.-.b.e.0.5.-.e.a.a.5.3.5.a.b.5.4.4.5.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.6.8.c.d.c.3.b.1.-.f.5.6.9.-.4.a.d.a.-.9.1.8.b.-.d.8.9.f.c.d.f.e.2.9.9.4.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.f.i.l.e...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.b.5.0.-.0.0.0.1.-.0.0.1.4.-.8.1.a.6.-.d.7.a.a.4.3.9.4.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.7.a.8.4.5.2.c.e.3.e.f.7.3.0.5.5.2.d.9.8.1.1.8.7.1.8.1.d.5.4.2.b.0.0.0.0.0.a.1.6.!.0.0.0.0.f.e.b.e.9.d.2.6.8.d.3.1.c.1.7.a.2.4.c.0.c.a.e.2.d.2.e.2.b.5.d.6.1.7.d.8.6.0.8.f.!.f.i.l.e...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.0.4././.2.1.:.0.7.:.5.8.:.4.0.!.0.!.f.i.l.e...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.9.6.7.2.9.5.....S.e.r.v.i.c.e.S.p.l.i.t.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_file.exe_4d3f288dd4798765eb91273da4b76d6bea17316_52238708_b621ded2-faf3-4fb3-a976-16024740780d\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.04778575666465
Encrypted:	false
SSDEEP:	192:yAiTN4kvTjPyS056rPI3jS3ZrYbWJzuiFcZ24IO8kVBb4:nmX6Z56rIj4JzuiFcY4IO8a
MD5:	EA070C6F99993907679093EDF4E87DF4
SHA1:	312DB2E97E3EB70270E917697F6963849A9C1814
SHA-256:	479FD874B30A1A3214350C5EA6DA57CF7ECBE0A412C7731BA5E85B717DA7BE19
SHA-512:	01FC43A49579A1064562613D561894C8F6B162B70B7B9BD586437E0A383EF6041C5967B779A353AE1395CB3D85AFE0107E9CA6F9B8B03F94FF27768B22FF91C0
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.8.2.1.5.7.4.5.1.0.7.5.6.0.7.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.b.6.2.1.d.e.d.2.-.f.a.f.3.-.4.f.b.3.-.a.9.7.6.-.1.6.0.2.4.7.4.0.7.8.0.d.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.b.b.2.4.0.e.d.6.-.b.2.e.2.-.4.8.5.c.-.9.b.4.c.-.4.9.9.7.e.6.d.1.f.5.3.9.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.f.i.l.e...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.b.5.0.-.0.0.0.1.-.0.0.1.4.-.8.1.a.6.-.d.7.a.a.4.3.9.4.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.7.a.8.4.5.2.c.e.3.e.f.7.3.0.5.5.2.d.9.8.1.1.8.7.1.8.1.d.5.4.2.b.0.0.0.0.0.a.1.6.!.0.0.0.0.f.e.b.e.9.d.2.6.8.d.3.1.c.1.7.a.2.4.c.0.c.a.e.2.d.2.e.2.b.5.d.6.1.7.d.8.6.0.8.f.!.f.i.l.e...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.0.4././.2.1.:.0.7.:.5.8.:.4.0.!.0.!.f.i.l.e...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.9.6.7.2.9.5.....S.e.r.v.i.c.e.S.p.l.i.t.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_file.exe_4d3f288dd4798765eb91273da4b76d6bea17316_52238708_f6dc93c5-cb1c-438e-a34b-3e15d7234d4b\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.894583972830973
Encrypted:	false
SSDEEP:	192:GjiTN4kvMPyS056rPI3jS3ZrY6zuiFcZ24IO8kVBb4:GNmM6Z56rIjgzuiFcY4IO8a
MD5:	E8A2D93108ED3B21A89651006466B617
SHA1:	9A460E070E5F7093F9BB3F223ACDBBCA48CC351E
SHA-256:	918AF43415E945CF80422982DDA02043A534382EDB7FB1FA792B4BAAAB6DBBF3
SHA-512:	F3C01D4CB87C19B69F1E3A6105016E0F56BB914DFF897F184C7A8560E59AB504C0E7AF6E7A279E024B37D422BEC0F01CCF0D7BC9D4DD24B48440BFD8BC0B0AEB
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.8.2.1.5.7.3.2.9.6.0.4.0.9.1.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.f.6.d.c.9.3.c.5.-.c.b.1.c.-.4.3.8.e.-.a.3.4.b.-.3.e.1.5.d.7.2.3.4.d.4.b.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.d.0.e.1.a.4.c.f.-.c.b.2.0.-.4.7.5.9.-.a.3.b.4.-.6.0.2.4.4.7.8.0.9.1.7.5.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.f.i.l.e...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.b.5.0.-.0.0.0.1.-.0.0.1.4.-.8.1.a.6.-.d.7.a.a.4.3.9.4.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.7.a.8.4.5.2.c.e.3.e.f.7.3.0.5.5.2.d.9.8.1.1.8.7.1.8.1.d.5.4.2.b.0.0.0.0.0.a.1.6.!.0.0.0.0.f.e.b.e.9.d.2.6.8.d.3.1.c.1.7.a.2.4.c.0.c.a.e.2.d.2.e.2.b.5.d.6.1.7.d.8.6.0.8.f.!.f.i.l.e...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.0.4././.2.1.:.0.7.:.5.8.:.4.0.!.0.!.f.i.l.e...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.9.6.7.2.9.5.....S.e.r.v.i.c.e.S.p.l.i.t.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_file.exe_bf3ace7eccf87db32bccac6338e1d4b03dc99b8f_52238708_302080a6-229b-410a-bd76-88077ad387bc\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.0478206956040896
Encrypted:	false
SSDEEP:	192:6iTN4kvTPyi0JsAnbcAgI3jS3ZrYbWJzuiFcZ24IO8kVBb4:QmT6pJsAnbcA3j4JzuiFcY4IO8a
MD5:	F01F6802A73C8EDB833F75CF4A9AAD19
SHA1:	6D7397A7FD699FED26188F6EF12E87BD73C3C096
SHA-256:	CC9F808DE817C31D5D0941C0A7BF96337FBB591B0DEE4A0182CD7157E351E600
SHA-512:	0960961185A2B083CAEBC0230951BE6E8BADED5B56050886DBBCCFBBF99BE8F41D58EAA6AC308CF5DDEAA50C808D8B65F89500691A924F79DC505A2B6B67AF96
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.8.2.1.5.7.5.2.8.8.2.5.8.3.6.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.3.0.2.0.8.0.a.6.-.2.2.9.b.-.4.1.0.a.-.b.d.7.6.-.8.8.0.7.7.a.d.3.8.7.b.c.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.c.b.2.4.7.6.0.1.-.8.7.d.b.-.4.c.2.9.-.a.9.0.8.-.d.7.b.6.1.f.0.b.2.2.c.c.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.f.i.l.e...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.b.5.0.-.0.0.0.1.-.0.0.1.4.-.8.1.a.6.-.d.7.a.a.4.3.9.4.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.7.a.8.4.5.2.c.e.3.e.f.7.3.0.5.5.2.d.9.8.1.1.8.7.1.8.1.d.5.4.2.b.0.0.0.0.0.a.1.6.!.0.0.0.0.f.e.b.e.9.d.2.6.8.d.3.1.c.1.7.a.2.4.c.0.c.a.e.2.d.2.e.2.b.5.d.6.1.7.d.8.6.0.8.f.!.f.i.l.e...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.0.4././.2.1.:.0.7.:.5.8.:.4.0.!.0.!.f.i.l.e...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.9.6.7.2.9.5.....S.e.r.v.i.c.e.S.p.l.i.t.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_file.exe_bf3ace7eccf87db32bccac6338e1d4b03dc99b8f_52238708_73a5c60f-cccd-4bb6-87ec-0e77435d9d45\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.0479227251818521
Encrypted:	false
SSDEEP:	192:UzDiTN4kv9Pyi0JsAnbcAgI3jS3ZrYbWJzuiFcZ24IO8kVBb4:UJm96pJsAnbcA3j4JzuiFcY4IO8a
MD5:	F4F1E02A568ED67CE7AB2C4DB605303B
SHA1:	D2474D2F08B11498565441503EE4EE8D49EF129A
SHA-256:	1588CF346968A82EB1A176CC0172B46DE32EAF00091EE01C921C68E7B3C46E69
SHA-512:	C374FF6F3D14746AF6CBDD352B874C584D31D765DAE03BFC794E84224FE1AF7D8974C4002ABD30CD3A0459C554CB35F81CC7F5ACF594B9161F2F1B471CD2B868
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.8.2.1.5.7.4.9.5.9.7.7.7.4.1.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.7.3.a.5.c.6.0.f.-.c.c.c.d.-.4.b.b.6.-.8.7.e.c.-.0.e.7.7.4.3.5.d.9.d.4.5.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.5.a.8.f.7.f.5.f.-.b.b.b.6.-.4.5.0.9.-.b.2.3.4.-.f.b.6.0.b.3.8.3.8.0.b.a.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.f.i.l.e...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.b.5.0.-.0.0.0.1.-.0.0.1.4.-.8.1.a.6.-.d.7.a.a.4.3.9.4.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.7.a.8.4.5.2.c.e.3.e.f.7.3.0.5.5.2.d.9.8.1.1.8.7.1.8.1.d.5.4.2.b.0.0.0.0.0.a.1.6.!.0.0.0.0.f.e.b.e.9.d.2.6.8.d.3.1.c.1.7.a.2.4.c.0.c.a.e.2.d.2.e.2.b.5.d.6.1.7.d.8.6.0.8.f.!.f.i.l.e...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.0.4././.2.1.:.0.7.:.5.8.:.4.0.!.0.!.f.i.l.e...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.9.6.7.2.9.5.....S.e.r.v.i.c.e.S.p.l.i.t.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_file.exe_bf3ace7eccf87db32bccac6338e1d4b03dc99b8f_52238708_bfe9909b-817e-4821-a15d-d84abb4d0703\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.0417745596178778
Encrypted:	false
SSDEEP:	192:QViTN4kvlPyi0JsAnbcAgI3jS3ZrYbWlzuiFcZ24IO8kVBb4:Qbml6pJsAnbcA3j4lzuiFcY4IO8a
MD5:	E96958BC4C8111DF4392E827A3456DA0
SHA1:	1C96B2EEDBEA0676358DB1E663283E8F995AAE93
SHA-256:	68E9B318E19898030AC1CDCBCBF2FF350CF13DC057F28056F60C5CC56CD806A7
SHA-512:	E391A274101C756870D5C04B5B088492776B25B2C0154C255C277DBCBB620C54A251B48CAF7D70EF400AF73B2D992BC3A6F702E4B5A98A9C0C41CFA0973119D8
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.8.2.1.5.7.4.3.8.6.7.8.7.1.1.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.b.f.e.9.9.0.9.b.-.8.1.7.e.-.4.8.2.1.-.a.1.5.d.-.d.8.4.a.b.b.4.d.0.7.0.3.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.d.0.f.1.1.9.e.3.-.7.6.c.d.-.4.b.b.c.-.b.1.8.3.-.4.6.f.9.3.4.7.b.5.d.5.1.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.f.i.l.e...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.b.5.0.-.0.0.0.1.-.0.0.1.4.-.8.1.a.6.-.d.7.a.a.4.3.9.4.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.7.a.8.4.5.2.c.e.3.e.f.7.3.0.5.5.2.d.9.8.1.1.8.7.1.8.1.d.5.4.2.b.0.0.0.0.0.a.1.6.!.0.0.0.0.f.e.b.e.9.d.2.6.8.d.3.1.c.1.7.a.2.4.c.0.c.a.e.2.d.2.e.2.b.5.d.6.1.7.d.8.6.0.8.f.!.f.i.l.e...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.0.4././.2.1.:.0.7.:.5.8.:.4.0.!.0.!.f.i.l.e...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.9.6.7.2.9.5.....S.e.r.v.i.c.e.S.p.l.i.t.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_file.exe_bf3ace7eccf87db32bccac6338e1d4b03dc99b8f_52238708_d1f1775b-34ae-4862-b958-5a7fbc722829\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.047734375481204
Encrypted:	false
SSDEEP:	192:4iTN4kvgPyi0JsAnbcAgI3jS3ZrYbWJzuiFcZ24IO8kVBb4:ymg6pJsAnbcA3j4JzuiFcY4IO8a
MD5:	D77866FF92A38EF905605744B6C20414
SHA1:	12E1792285B28159AF67C3BFE5AB192FBB509871
SHA-256:	E60ED3E09DA65BAC0FF114796D88BADFDF4383C96154C3FF9C74F18864F1C5C5
SHA-512:	E483BDF1438C4843B41EC5E5617C6BACE1E070EC43FCCF0DAA89C6B240EF9D9AA692E7A6BE8E1B7847E7456FA37666CF3F2519F0F31713871D3EFEB0B0E8FAD3
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.8.2.1.5.7.5.2.2.6.3.9.0.0.6.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.d.1.f.1.7.7.5.b.-.3.4.a.e.-.4.8.6.2.-.b.9.5.8.-.5.a.7.f.b.c.7.2.2.8.2.9.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.f.c.c.5.8.a.c.7.-.2.b.d.f.-.4.8.4.7.-.8.4.4.e.-.f.6.d.5.c.e.3.b.f.2.e.3.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.f.i.l.e...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.b.5.0.-.0.0.0.1.-.0.0.1.4.-.8.1.a.6.-.d.7.a.a.4.3.9.4.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.7.a.8.4.5.2.c.e.3.e.f.7.3.0.5.5.2.d.9.8.1.1.8.7.1.8.1.d.5.4.2.b.0.0.0.0.0.a.1.6.!.0.0.0.0.f.e.b.e.9.d.2.6.8.d.3.1.c.1.7.a.2.4.c.0.c.a.e.2.d.2.e.2.b.5.d.6.1.7.d.8.6.0.8.f.!.f.i.l.e...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.0.4././.2.1.:.0.7.:.5.8.:.4.0.!.0.!.f.i.l.e...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.9.6.7.2.9.5.....S.e.r.v.i.c.e.S.p.l.i.t.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_file.exe_bf3ace7eccf87db32bccac6338e1d4b03dc99b8f_52238708_ed24c999-a2a5-41aa-9fbc-f46e42155e4d\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	modified
Size (bytes):	65536
Entropy (8bit):	1.0412899645235876
Encrypted:	false
SSDEEP:	192:pfiTN4kv8Pyi0JsAnbcAgI3jS3ZrYbWlzuiFcZ24IO8kVBb4:pxm86pJsAnbcA3j4lzuiFcY4IO8a
MD5:	36BBAFCDA35A632DD875FD8E7751118B
SHA1:	030BACAA24193A392C6FE40D890C2BBC598AC1D1
SHA-256:	63038A47ABC00A59AAAC6C57F7A25CE49FB02554EE578BDE51F83297A7E783C2
SHA-512:	2F761A685C1F4EC17B1B5D2824F3E45F111686256F5F596007FECAD8F1792A5D10FE013B3AC08E8D372846EFEFF8B4DC4187168CBBFAE426A954178936B5C287
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.8.2.1.5.7.4.3.0.4.8.3.9.2.3.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.e.d.2.4.c.9.9.9.-.a.2.a.5.-.4.1.a.a.-.9.f.b.c.-.f.4.6.e.4.2.1.5.5.e.4.d.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.9.9.b.0.a.5.3.7.-.e.6.6.c.-.4.1.a.f.-.b.d.6.3.-.a.a.9.9.1.1.4.4.d.3.e.3.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.f.i.l.e...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.b.5.0.-.0.0.0.1.-.0.0.1.4.-.8.1.a.6.-.d.7.a.a.4.3.9.4.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.7.a.8.4.5.2.c.e.3.e.f.7.3.0.5.5.2.d.9.8.1.1.8.7.1.8.1.d.5.4.2.b.0.0.0.0.0.a.1.6.!.0.0.0.0.f.e.b.e.9.d.2.6.8.d.3.1.c.1.7.a.2.4.c.0.c.a.e.2.d.2.e.2.b.5.d.6.1.7.d.8.6.0.8.f.!.f.i.l.e...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.0.4././.2.1.:.0.7.:.5.8.:.4.0.!.0.!.f.i.l.e...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.9.6.7.2.9.5.....S.e.r.v.i.c.e.S.p.l.i.t.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_file.exe_bf3ace7eccf87db32bccac6338e1d4b03dc99b8f_52238708_f1cbd908-8b84-401d-9fbd-c08ff655e859\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.0478763068056167
Encrypted:	false
SSDEEP:	192:UiTN4kvSPyi0JsAnbcAgI3jS3ZrYbWJzuiFcZ24IO8kVBb4:2mS6pJsAnbcA3j4JzuiFcY4IO8a
MD5:	5F00822AFA89EDE83C4EED94D19881B6
SHA1:	AD4DB0BC6D5E9B0F4C2339B204E1AC7B88B19C01
SHA-256:	CFAEEAEBFC0D88F0F17EFB8EF55A561584FF36DFC2388E6EF19475DB06778470
SHA-512:	39ED3F1CC6D5312864F8FE88DF7061CFEC67863AC1FD29BFA1439744DE7D30493FEB5EE0CDEFFC4F43522DCB4A969A9472485F07C28E4A3B61BBCD7473F876FC
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.8.2.1.5.7.4.8.8.7.9.0.1.3.4.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.f.1.c.b.d.9.0.8.-.8.b.8.4.-.4.0.1.d.-.9.f.b.d.-.c.0.8.f.f.6.5.5.e.8.5.9.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.7.d.d.c.d.3.4.7.-.6.e.a.b.-.4.0.3.7.-.b.e.c.4.-.9.2.a.9.4.c.c.9.d.8.7.1.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.f.i.l.e...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.b.5.0.-.0.0.0.1.-.0.0.1.4.-.8.1.a.6.-.d.7.a.a.4.3.9.4.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.7.a.8.4.5.2.c.e.3.e.f.7.3.0.5.5.2.d.9.8.1.1.8.7.1.8.1.d.5.4.2.b.0.0.0.0.0.a.1.6.!.0.0.0.0.f.e.b.e.9.d.2.6.8.d.3.1.c.1.7.a.2.4.c.0.c.a.e.2.d.2.e.2.b.5.d.6.1.7.d.8.6.0.8.f.!.f.i.l.e...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.0.4././.2.1.:.0.7.:.5.8.:.4.0.!.0.!.f.i.l.e...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.9.6.7.2.9.5.....S.e.r.v.i.c.e.S.p.l.i.t.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER152.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Sun Apr 21 23:29:10 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	140240
Entropy (8bit):	1.9798375541558633
Encrypted:	false
SSDEEP:	768:3n6n8CND4lTv8UYwGaAYZP60+qeT2rCqm:9hJa06T2rCqm
MD5:	0211715AE8B79DB1ED8D844F0EDFE6A5
SHA1:	68BA1C186E546525F391ADAFF1D44F590DEDA27B
SHA-256:	7A272CE9D2F11C49C2701AB3D6E769E01DA6B3C9A81A989D0174A8C9CA8306FE
SHA-512:	631E22348A53FDEC9994352C387F30ED9C4DB4646AB160A6B8AF43F5858DF4EF3A9C39BA8655FB388B5CBE1C3FE35D041AD36EEE3E49D799322CB0176E164055
Malicious:	false
Preview:	MDMP..a..... .......F.%f........................p...........l...(%...........Y..........`.......8...........T............K...............%...........'..............................................................................eJ.......(......GenuineIntel............T.......P...3.%f.............................0..................W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER22D.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8412
Entropy (8bit):	3.6983669681177425
Encrypted:	false
SSDEEP:	192:R6l7wVeJfCT6W6Y9fSU9mIgmf6EVpBG89bSRsf9mm:R6lXJW6W6YVSU9mIgmf9lSKfl
MD5:	217E15AAD1632D6C4B25FFC7BB954FA5
SHA1:	46FC76F04D010497889F70F97C64EED6A97BCEE9
SHA-256:	AD3C1306D7FF349933024B97CFD908BD948DE6E8FB187513CC584608280FA71A
SHA-512:	3B2D07F76600EDD47B44C97E8DCA4C414396E4209B6D131425C68F190531CC3EDB9ABEAD9FC97E90042654A09E23E4BF7942FE8CD0D28CE15DAB1EE7A6C72F26
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.2.8.9.6.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER25D.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4692
Entropy (8bit):	4.4549568887778035
Encrypted:	false
SSDEEP:	48:cvIwWl8zsoJg77aI9TAWpW8VYaYm8M4JhNJFsB7+q8vMNLjyvkd:uIjfuI7h57VWJhSB7KM5+vkd
MD5:	794B56B4B0C378397D1CD91A3A6173BC
SHA1:	52170EB4DB7D7D4D068933C49DBB5A103A466874
SHA-256:	957622B76F911FF215170C348BDFB228783C50B897B9E831C1EA7042A18D3B30
SHA-512:	73B72F879B7474B1037A98C065B2E92325A14FAC19498A969B8562FDCD0298AF3B62464FDBF44C317883B5349E0A67DB894F6923C216BD95F5AB14496981F453
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="290311" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4AD.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Sun Apr 21 23:29:11 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	139788
Entropy (8bit):	1.9897167434272096
Encrypted:	false
SSDEEP:	768:zq3KCNz4lTv6l6MEqWwuaAYZP6NmtrF4QZ4:fdivEqcNOFLZ4
MD5:	635B33B96E95D7A50C5404C5B53B0ED2
SHA1:	1D7B972836F7B35F6A45B82456D53C774C31B4C0
SHA-256:	707D33AED2621369F4B040C6A98138B8BDA59CC73F64E895ED9F23D3BAD87CDF
SHA-512:	9F0831D683460A8A44CE70251AA7C7AEFB4C177CA057498B508AE21D655D754785071CEF4BC1845D0932E89E4BFE491964B73FBD02571222487B49E53511F32E
Malicious:	false
Preview:	MDMP..a..... .......G.%f........................p...........l...(%...........Y..........`.......8...........T............K...............%...........'..............................................................................eJ.......(......GenuineIntel............T.......P...3.%f.............................0..................W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER5A8.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8412
Entropy (8bit):	3.6984980914267735
Encrypted:	false
SSDEEP:	192:R6l7wVeJfC8676Y9XGSU9UIgmf6EVpBT89bbRsfppm:R6lXJp676YtGSU9UIgmf9+bKfm
MD5:	634F791A807C9DB37A4B8B806DCC0F09
SHA1:	2B5459F491D1F4418F864E67177D2C91ED93C895
SHA-256:	12FD70FE5E34EC416DA7A5256CE61A22DE1EDCB8A81AB3B62F3112BDD30E3A9D
SHA-512:	BAA87F54173C65C425B8841F8CFFBA9463D1D22E6C9E3F782A6767E3D71DEE3599237F2DEEDCFECDC7EBD25C11558361B6F2D248909DDDC2CA7B3C42D29A6F6F
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.2.8.9.6.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER5F7.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4692
Entropy (8bit):	4.4546786695870875
Encrypted:	false
SSDEEP:	48:cvIwWl8zsoJg77aI9TAWpW8VYLYm8M4JhNJFr+q8vMNLjyvkd:uIjfuI7h57VHJh5KM5+vkd
MD5:	04CEC444752D5B36ECC9E8FF0A6F6A94
SHA1:	41215E8E5AE77A1032F22D13288D908B61246DDB
SHA-256:	A1126D5E1382493D3B1EA978A83AF7AF84897B8C9F419A966C61B1EB9593B9C7
SHA-512:	781D40D9422A5B11A9241094C0C98E6524DBD384EAC8C489D35A5222738214DE2491978DB74D4E16B9DF59D59659299C45EC4DE6E5DF27BA092C3B593EF509F9
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="290311" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER7F9.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Sun Apr 21 23:29:12 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	139336
Entropy (8bit):	2.0018313386600046
Encrypted:	false
SSDEEP:	768:MaH2CN+4lTvF+Pwq9WwGaAYZP66XxXDwhtP2uIbts5kf:caNXq9UWxXDw32uIbt7f
MD5:	8CA5CB6147D5B5DB1485E4379FF98258
SHA1:	67F7A72EE98FF7AFB16E2E085430614EC07F359B
SHA-256:	51061A70C6530A4B647F0C402F915CF2F9D61475841CD93A489C2D4B3A526093
SHA-512:	750A119F86EA16FFA0AD6F1DCDAC131BF33F85AFE8C19FC12D36690396F2692E108EE25F9F2EB310858D75D06AE77AA04C1CC8DB320F2B9B5D6B1B6A8DC0C4C9
Malicious:	false
Preview:	MDMP..a..... .......H.%f........................p...........l...(%...........Y..........`.......8...........T............K..8............%...........'..............................................................................eJ.......(......GenuineIntel............T.......P...3.%f.............................0..................W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER8B5.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8412
Entropy (8bit):	3.6975970351840965
Encrypted:	false
SSDEEP:	192:R6l7wVeJfCs676Y9XSSU9UIgmf60aAjAypBT89bgRsfjAm:R6lXJ5676YtSSU9UIgmftaAjAxgKfh
MD5:	E2BC416F878BE4FA70922D56E9F19375
SHA1:	955A4BAE1F7B39A1D32C5AF101075ECB7C3ED392
SHA-256:	8F99917C747BEEC4AB8A5C0AA9C0751191D1F09B7255938A991CE4024A254B42
SHA-512:	C2810CD7BB6F851EAF06F5B44FD8429AB14788191BAD451757BE9B93C470D3CC9375B9F39053D2CD0D04274AB44D3E6B3DBE1A1E3B816C4BB6EB2628185E266B
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.2.8.9.6.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER8D5.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4692
Entropy (8bit):	4.455703457400895
Encrypted:	false
SSDEEP:	48:cvIwWl8zsoJg77aI9TAWpW8VYCYm8M4JhNBFH+q8vMNTjyvkd:uIjfuI7h57VqJhVKMp+vkd
MD5:	8B9C6B5B800AD399F16047CB3781C642
SHA1:	EF9B53D738E225A2AEDE4C75248F4CB880BB91D8
SHA-256:	C07CAC194CFC2D6434DCDB7EC68218EA680E78C9C293C8DA86D1C70C0C772842
SHA-512:	2E372CC6C4762341CFC892E17BA9838DEF90969CD47868EED745EC6E6EFB9801815F30C30FE124953F7CCC849B3098F0233ACE276E6C053E229D6E4B57910C2D
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="290311" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERA6A.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Sun Apr 21 23:29:13 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	133880
Entropy (8bit):	2.031095165529541
Encrypted:	false
SSDEEP:	768:FXXq7RL+e4lTvgG2wF1+hwXwGaAYZP6RBKyFgc0HU:o7orhFkhw/7Kn1HU
MD5:	16614756322A4B562CB850BBE8CC9F0E
SHA1:	ACE7A430584CD5902E35B7C5CC6204BBD814197A
SHA-256:	602465E540CB147A7B0C53ABBB731E979ED379628117EC9E0D63B05E2C31101D
SHA-512:	E6BE9AE7CCF4AE25F1A9DC8DE4B6FEEA305F5CD9A2C811556221A0FBE3C7A50FA33F7746661DB57D5BD39668187E3D05CEAA991C71490B954B65809CD7BD43BC
Malicious:	false
Preview:	MDMP..a..... .......I.%f............t...........p...........l....$...........V..........`.......8...........T............K.............d%..........P'..............................................................................eJ.......'......GenuineIntel............T.......P...3.%f.............................0..................W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERB84.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8412
Entropy (8bit):	3.6957175341409654
Encrypted:	false
SSDEEP:	192:R6l7wVeJfCj6q6Y9XzSU97Egmf60aAjAypB089bpRsf1Dm:R6lXJG6q6YtzSU97EgmftaAjAUpKfc
MD5:	D70306D47F301A744098392CEEF643BF
SHA1:	FA829EBE8C823D3C875AE5F4C082132EAFCE22F6
SHA-256:	89397A317786BAE36AD723F151E438E35CEF74ED5A8CB7D8C0CF12A851FCE461
SHA-512:	973965CCE17FBAC7D5F493C38AE36B9DE68BAF934796EFEBC8F19C775109BCA29F4B91D87B779F52578027E42FAC7F69C6A2CC3D7497D018232ED5138516F604
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.2.8.9.6.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERBA4.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4692
Entropy (8bit):	4.4533227116304435
Encrypted:	false
SSDEEP:	48:cvIwWl8zsoJg77aI9TAWpW8VYi0Ym8M4JhNBFx+q8vMNTjyvkd:uIjfuI7h57VBJhLKMp+vkd
MD5:	A77B0719430595944E17BE591A81461B
SHA1:	66427264EC919594EF03C0BA71CB6ABE6DC15A52
SHA-256:	3C0953B449E9128E4D88E603CD2CFA482CB73E6F67433D5E0A0EE90A7A38EFC5
SHA-512:	E545B313511E119AC3C77BA7ACB12B808446F69CC84BDB392B44CA82134EC343AF82C8CCBFDEF0CAAA3574CB2FB841D8136196B26196DC5F753556C7E495DBE5
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="290311" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERBC98.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Sun Apr 21 23:28:53 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	60284
Entropy (8bit):	2.30660068036045
Encrypted:	false
SSDEEP:	384:74BR3KlTve7NsRMX0pvqG+AYxVF680UnUp6xHC0Pd:8BRalTve7Nr0pvqCYx76gLPd
MD5:	17A1E728DA268C1D7960A996105B96A5
SHA1:	8E003348902197BEC4E18872FBC8C058E640C9A2
SHA-256:	E3FB89C469172AD80E6528D8EE99E993F90168E514462197F302464EDE69500A
SHA-512:	FF6A27F4F7A6A5352228E40DD693A486664DE0BC41967510572903BE8817F3D0747F5460A8DAE6503FB3C30300280CF02BC8CA99AF78947919CD95AA81B7C9C4
Malicious:	false
Preview:	MDMP..a..... .......5.%f....................................$...........t..../..........`.......8...........T...........(...T.......................................................................................................eJ......<.......GenuineIntel............T.......P...3.%f.............................0..................W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERBD74.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8410
Entropy (8bit):	3.7004833515937072
Encrypted:	false
SSDEEP:	192:R6l7wVeJfCf6dci6Y97LSU9Wglgmf6EVpBH89bMRsfDkm:R6lXJy6ei6YFSU9Wwgmf9yMKfl
MD5:	A7152751191EC7079E331705B7767182
SHA1:	2BE9CE9C681524BB05B119056C1E3F0907A9BF88
SHA-256:	07FBC6C1519D1A0F70CCD352C235DE8988A2F59843CC3C9AA3D3D6B6AB479D13
SHA-512:	ABC257FBB79A9358CACEED5E4205D1418F3DD308D11FB7B980F5DC2B3BFA777EF2D239C7B5565521DBF5D8954007EAEBA961506E5606C98BC0B8897F7184665F
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.2.8.9.6.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERBD94.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4692
Entropy (8bit):	4.4550027892048965
Encrypted:	false
SSDEEP:	48:cvIwWl8zsoJg77aI9TAWpW8VYpYm8M4JhNJFP4+q8vMNLjyvkd:uIjfuI7h57VhJhCKM5+vkd
MD5:	C443AA3359E8B236FABC40910B8D0B0B
SHA1:	BB9D5FF7465988D88A098F28EF953EB94AFA953E
SHA-256:	E2A18937E44211B207541F976E6D3537F7CA12D2C80E6677FA7CA922DCE0D63E
SHA-512:	B6A9096856152709D702EEB8B8C92DD45D94BCBB49C6AF4313075B6798FEFE89775B295ADC3B5780000C556CF1CDA8E30EE1C253F4453A4BC70F8AD5208A4347
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="290311" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERC206.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Sun Apr 21 23:28:54 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	74324
Entropy (8bit):	2.3773242483396575
Encrypted:	false
SSDEEP:	384:utmep3lTvrQ3bVsKh1FLWJOYG+AYxVT6cljnUpOIgSqgLf/Y:nep3lTvkxDlWJOYCYxt6KqX
MD5:	CF7298300615DCF00A0530A9C660829A
SHA1:	D3227DB83A807A3C3576C39E89A0507331E14DAF
SHA-256:	248F569075C6448A47FE96A39BCA111040B993A9F4CDAB2083A84C8E296FFDAF
SHA-512:	D3DA11C53F853F5FF053469A5AAF842B32F687FBE881E61DF5CE6B9FAD2DC697EE8E741F244BAE02FC3995D702F14B1BF43E1BEB893A710C91A8928F2055A74B
Malicious:	false
Preview:	MDMP..a..... .......6.%f....................................<...............\|3..........`.......8...........T............"..l.......................................................................................................eJ......\.......GenuineIntel............T.......P...3.%f.............................0..................W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERC275.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8408
Entropy (8bit):	3.6996844437731253
Encrypted:	false
SSDEEP:	192:R6l7wVeJfC26Q6Y9ZSU9cg8gmf6EVpBe89bjRsfoBm:R6lXJ76Q6YzSU9c5gmf9tjKfD
MD5:	237B6EEAFD00BF88FBB348FAA18C9F5D
SHA1:	0D78BF4DDA65BBB390F90AE708168DBC338B80B1
SHA-256:	A2857F4F1EA8FE6EBF2F52D715C6A6CF19ED530A251280CF99B43C410335C4DD
SHA-512:	C09E1DA9001EC3FF4768D535B79F0C018160E583095F947E696CA8B4858326C35EDED230ABF6B34080DC713A4C011E5C395004E5E304DE6EC3756F6A5C4A0B06
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.2.8.9.6.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERC295.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4692
Entropy (8bit):	4.456489061413185
Encrypted:	false
SSDEEP:	48:cvIwWl8zsoJg77aI9TAWpW8VYzYm8M4JhNJFhp+q8vMNLjyvkd:uIjfuI7h57VfJhrpKM5+vkd
MD5:	B0B410D254BC7D0B737F800450D714F5
SHA1:	70CD85305D8CA65A2467DA20EAD9A037CB750F53
SHA-256:	6F501CDA83FF76BEBA3A12AB8FF1E9FE286631ABE4A4D9548464A6A43231C06A
SHA-512:	AB081DEEF34F003B0CE20088C99BFAC510D47A757E6000E657B8D6423F8A1C9909B92CCE713D6BF51019961A398B9FAC4EA023F88B2080FDB7B788F16F49C17C
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="290311" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERC477.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Sun Apr 21 23:28:55 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	85814
Entropy (8bit):	2.2405398440582838
Encrypted:	false
SSDEEP:	384:Vy/osidNZlTvSjNuBx3NpXdsr2yRJOYG+AYxVF6cYj8UpOdSET97CqW:Q/QdrlTvSjNGdpXdXyRJOYCYx76kto
MD5:	3243903D53F3487A1369F7CB3C1F220B
SHA1:	68D30DAA2AD119EBAB6E9DEBD36DD631D7D15652
SHA-256:	D8913CDD63D38D7525C2BE47A49B58682A19AE035ACBE7A0C94532D327938CB2
SHA-512:	1C24B3C5B69E3530F80528F0D130AE9B88EEAD97477303F0A596F1D498D86BC2B8D98D73418D9EC2D9B408EEBB57430AF9890D9CE02E8DC89AD4C60A7F8079F6
Malicious:	false
Preview:	MDMP..a..... .......7.%f............T...........D...h.......<................;..........`.......8...........T...........($...+......................................................................................................eJ......l.......GenuineIntel............T.......P...3.%f.............................0..................W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERC4E6.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8410
Entropy (8bit):	3.6999951237730953
Encrypted:	false
SSDEEP:	192:R6l7wVeJfCS6G6Y9eSU9cg8gmf6EVpBy89baRsfE+m:R6lXJf6G6Y0SU9c5gmf9xaKfU
MD5:	65A1491B06FC899D445C8261A5BEF2B0
SHA1:	FD0BC562962547D1ED4CCF4CED9C906604F967B9
SHA-256:	7F5D3F354B9DBB94545F7F742601F4AD7B5C3C16504B6B3AB28639118F310784
SHA-512:	E000C5A7A963737AF742F0696D4FE9E74E76296B2284538B2A9EDDE2F6B04B8E9620C8D011F29F2D09C9227AB916EF69480ED42D0B573683F8CA923E2C1F7A13
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.2.8.9.6.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERC506.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4692
Entropy (8bit):	4.4545400977649345
Encrypted:	false
SSDEEP:	48:cvIwWl8zsoJg77aI9TAWpW8VYtYm8M4JhNJF6/+q8vMNLjyvkd:uIjfuI7h57V9Jhg/KM5+vkd
MD5:	DB948BC05C1B239C14BC3D36DBDD44E1
SHA1:	9CE75D07B657F8673AFF6E89D56C2AE68373ED7E
SHA-256:	C2F61CCA95A002130BD0D5F8E6298BA8A85FB99DB82AFED2EA622B5D8FEE3E2F
SHA-512:	5D8B43F320B9679B03B0DEF227A7B58CC7D59FFF9CCB3692679395E9AE5BEA6D19CB5316E21A7CCF9AA9416861841DB55DB14561F357718AFA60B775E3732916
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="290311" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERC6C9.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Sun Apr 21 23:28:55 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	85390
Entropy (8bit):	2.2524435655962614
Encrypted:	false
SSDEEP:	384:SsidN0clTvdaB1sxp13uUyRJOYG+AYxVF6coj8UpOmSaeuIgJxUBreW:md+clTvdsyvyRJOYCYx76UspxU8W
MD5:	5B20EA73D3B2FB8CC26B020CF625005A
SHA1:	4EFA378AE0A968BB1E025E4FCB56F81DE32BFB31
SHA-256:	41177C575A4476287F8BD029928A4543372C8DB39C595E3AD23E5F2B36805FBE
SHA-512:	52C5620B1541C3A77CE3FEB437C9756C91F11AB9DBAC6C94B40A7AEE974452B10F5D2F78AEA9CD3E368CEA1FCB6327DD1AFB44C0215CF3A1E223A7505D0ED186
Malicious:	false
Preview:	MDMP..a..... .......7.%f............T...........D...h.......<................;..........`.......8...........T...........($..f)......................................................................................................eJ......l.......GenuineIntel............T.......P...3.%f.............................0..................W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERC786.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8410
Entropy (8bit):	3.700086302412444
Encrypted:	false
SSDEEP:	192:R6l7wVeJfCC6q6Y93SU9cg8gmf6EVpBa89baRsfqM+m:R6lXJv6q6YtSU9c5gmf9ZaKfT
MD5:	E8947F338FAA5680D970CE808100364B
SHA1:	3C16911B60749AD48D638523C4268E743A7FF7D5
SHA-256:	09305550FE0D7756E95F201AFEB471C486F6C7566C7193AD061205DD915035AB
SHA-512:	4DFE5BE214018C0BCF685705EA94B0A8E2D8D0A3491D764440DA2F558701D1B9FD2467937B5D6A4142951EFF825F94130B389E881123D068CAFCA1C834B3D309
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.2.8.9.6.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERC7A6.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4692
Entropy (8bit):	4.4576093902618
Encrypted:	false
SSDEEP:	48:cvIwWl8zsoJg77aI9TAWpW8VYQYm8M4JhNJFGR5P+q8vMNLjyvkd:uIjfuI7h57VYJh0R5PKM5+vkd
MD5:	90CC64AECCB2C4496A339CEE2A4B287B
SHA1:	80504013BB3037765C2D980EAF74064A71E82586
SHA-256:	082CFF0E25CB111585950AA317068BE1DE8BF5EF858871C828E50BD6A5788A6F
SHA-512:	690DEA0AB56D743B94A9832212C75A230A06EF2DDE01D6F8F78D602BC4FFF14086210BB3C3FCC10A11E9C514A98EEA7F4E79B8299B36374C82815B676EB4A39E
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="290311" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERC92B.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Sun Apr 21 23:28:56 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	93712
Entropy (8bit):	2.242917721722728
Encrypted:	false
SSDEEP:	384:QZnD+oIGlTvvBvX31Uhsjp5k3mk12DJOYG+AYxVT6c/jFUpOwSF0MfCaU+pmdGBb:W+vGlTvx6Ep302DJOYCYxt62tKaUik
MD5:	145A8B08AB9DFECFBF2E09CFB74B54C9
SHA1:	8BBC663B24060340D31D31E09B02EFEE73A5CDAF
SHA-256:	D8857C030BC70F2D5C0346285F117A02E6EB1B36B3593FC5F07015AE0AB31717
SHA-512:	E9390A054576BCA967C51241883F2588C2F6C8E93086B9BAC8A6A094BF6DD23A44CD52858DCD427105FC7F1BCF7CA7B7D2DBF3CDC0ED73841A92AFE47A736A50
Malicious:	false
Preview:	MDMP..a..... .......8.%f........................D...........<................>..........`.......8...........T...........p'...F......................................................................................................eJ..............GenuineIntel............T.......P...3.%f.............................0..................W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERC9B8.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8410
Entropy (8bit):	3.6987200406669825
Encrypted:	false
SSDEEP:	192:R6l7wVeJfCl6be6Y9cSU9cg8gmf6EVpBw89bxRsfsbm:R6lXJ46i6Y2SU9c5gmf9nxKf9
MD5:	819E1C850F81A5A0D4F041DCDA8D656F
SHA1:	28B97BBADA1B3C691D517C87B97D417D7A16F610
SHA-256:	F366945DF8DC039772D0FAA4EF4B848BB2FCA4BA31A6FFE551DF6E8AFEB7D85A
SHA-512:	1B8F22B0BCE1F2E5CF661DB280F567843A81A65612BB0395E014F5E7818F4FE5E6F7187AB558BFCD0A8A6B0E2D59CDE3EA9731CBFA1A557E167C283F816E8407
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.2.8.9.6.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERC9D8.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4692
Entropy (8bit):	4.455224705879269
Encrypted:	false
SSDEEP:	48:cvIwWl8zsoJg77aI9TAWpW8VYlYm8M4JhNJFem+q8vMNLjyvkd:uIjfuI7h57VlJhzKM5+vkd
MD5:	B324375F5A2CA60676C95718FF3B5D38
SHA1:	E5E82FA18D562CE2459091FCE4BF49255F3D60AB
SHA-256:	BEF5E7896228EC3D7A913BCEA9081D9D394BABA5517D5786E882FDC09C773816
SHA-512:	A822DF87599AF61392042CD5525300E22A559BAD465A3AC9022FBE1AFB92D8F7624D1F870C873C0AAEE386453FEFCB006BED9EAD7442D59B192635D47F287AC9
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="290311" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERCD03.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Sun Apr 21 23:28:57 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	110494
Entropy (8bit):	2.323407152108866
Encrypted:	false
SSDEEP:	768:swTlTvvBVVlwMCU8RJGBmYZT6GL4nNT6:s0xVVlgfOv4NT6
MD5:	498661DA3479E08299EC4B90EE62A32C
SHA1:	342D3A5B9161BAF8EFA89E92DCED9C8CBAB0DC3C
SHA-256:	E98277BEF2306FEE698B8D6DAF49BD542B3EDBFF4583CA496410CEBA53F859B7
SHA-512:	794BAC99454E70D3F500437ABC02E69CD8014ACB44466DE774F6F2D116A794D749FBD8D11DD203BC1236DC87E1FBDAEBFC74B58A0B62D6F35142086B8994046B
Malicious:	false
Preview:	MDMP..a..... .......9.%f....................................<...l ...........E..........`.......8...........T............5...z........... ..........."..............................................................................eJ......,#......GenuineIntel............T.......P...3.%f.............................0..................W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERCDBF.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8410
Entropy (8bit):	3.699740934607127
Encrypted:	false
SSDEEP:	192:R6l7wVeJfCy6I6Y90SU9PgQvGgmf6EVpBw89boRsfkYm:R6lXJf6I6YuSU9PEgmf9noKfK
MD5:	F0C3C611E65F9EAF96DC8598DE451908
SHA1:	B3E44F01BA3C040A7B2387BB7AF35444D5BD0179
SHA-256:	2F8D4A77A3A941146B1F05F732E9CA3E5E4752C6580147DDAD99A0818573E95C
SHA-512:	3AAEA266C6BEBD624F90097CAABA2CDAA441E20451C67EFC06C2B52CD9F14E96A37D4446B7516A0508EE71BBB1DFE9C8CA6C6B38EFF41A79C9FC928EB8BE280E
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.2.8.9.6.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERCDE0.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4692
Entropy (8bit):	4.455784850300265
Encrypted:	false
SSDEEP:	48:cvIwWl8zsoJg77aI9TAWpW8VYmYm8M4JhNJFM+q8vMNLjyvkd:uIjfuI7h57VOJhmKM5+vkd
MD5:	87407C8BC306446747187311722823A0
SHA1:	A194A8818A29646BF04FB181C25FD2CCEE267212
SHA-256:	286376C6B8328BF161466029F21428007177831927446A7930161F4A1EEE57B3
SHA-512:	F003FE6ED14BF5F75F72BA7D2CA921478A995FC3D0E6A9534BC9CF5D3D928D3DFA7C1BA839323FC6F345BCE06BA2A5E8E2FEE6A27DFC3035EA787C6AD4F44519
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="290311" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERDB2C.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Sun Apr 21 23:29:00 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	120208
Entropy (8bit):	2.0886264725898527
Encrypted:	false
SSDEEP:	384:8DTJSV6SlTvMtCHX6dso2ur1AaGaWYZFN6V5jmUpqiSwiCl1mijc4UCQieLA:8PJDSlTv/3eTl1AaAYZT662PmigwCA
MD5:	E719C15FE67B3A4B85C48C8530B14266
SHA1:	C502FD6EB6980B937597B2E8BF6C1E4A8950B2FF
SHA-256:	DD463D99DE9C56FD59D44DBEB2DD79BFA96916CDC7F69AC3883FE6017285755F
SHA-512:	B20AFFB8535E8B8D73E4BC9327A9F908A7091398D2537048DADE40C3965A7AD7F6C78D512823478EF82DA02E64FED016D6A22AFAC6DFC102018072E52DB60752
Malicious:	false
Preview:	MDMP..a..... .......<.%f........................T...(.......<...\|"......$....M..........`.......8...........T...........pE.. ............"...........$..............................................................................eJ......<%......GenuineIntel............T.......P...3.%f.............................0..................W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERDBD9.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8410
Entropy (8bit):	3.697009881681015
Encrypted:	false
SSDEEP:	192:R6l7wVeJfCY666Y9sSU93pgmf6EVpBB89bDRsfZhm:R6lXJF666YGSU93pgmf9kDKfO
MD5:	3E4C5555C2D689EFDF4E2C47D064D749
SHA1:	7FE3F271557D8ADD6A0E84066888077B83CB135F
SHA-256:	FB1B0C60C21CB6620ABBD274E70563DF186EA206C9D2699D06725D5F8AC4C8CA
SHA-512:	7C4C7B1BEE35FEAF92213F37203048133293EEE98B271B772107684EB3043837AE4CDA4CC16EC283505451646BD41A668A23DE90E7F0E8B7403ED7BC708E5342
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.2.8.9.6.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERDBF9.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4692
Entropy (8bit):	4.456286374618758
Encrypted:	false
SSDEEP:	48:cvIwWl8zsoJg77aI9TAWpW8VYbYm8M4JhNJFq+q8vMNLjyvkd:uIjfuI7h57VfJhsKM5+vkd
MD5:	8A077FB29A7E3FE4E0FF137C906A51C8
SHA1:	946ECD7DB48408C15D2FABF777D739856A7A57E9
SHA-256:	3B717C69CF607B2B975B8678028C74AFD56B50767BB89A163FAFAA37736F6468
SHA-512:	24DF7FBEEBFDD03E0DD4A2BE0618F0E44DB10C0B65C49027B1FCE7E14F62B1620D45F929D0D1CBC47FB54FB89503992B47CA3771156F05828C9E3649C4CDEEB9
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="290311" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERDE49.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Sun Apr 21 23:29:01 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	150308
Entropy (8bit):	1.8493139304742745
Encrypted:	false
SSDEEP:	768:smfplTvaQRQU3+dL4zwaAYZT69tkfzlW3IbwAYD9GK:smvvyLlQfzlW3IbwAYD9GK
MD5:	29BB501BB75768766A93749168D51DD5
SHA1:	1402A03DD7234D2F312B39852C259AC823196884
SHA-256:	4F4AD30CB2780709647B2E114F8EE502C1F5C60D1FE09230403EA34E0012A137
SHA-512:	CBF1610BE678C423A705764DB607046A05E08E2A52E9E7515AC3002295575F356FC936AD4036907786BF8D7F483C7B20AB55B26CB571008DB420319FB73089F5
Malicious:	false
Preview:	MDMP..a..... .......=.%f........................,...(.......<...T#......$....N..........`.......8...........T...........8F...............#..........\|%..............................................................................eJ.......&......GenuineIntel............T.......P...3.%f.............................0..................W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERDF73.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8412
Entropy (8bit):	3.6975274701715266
Encrypted:	false
SSDEEP:	192:R6l7wVeJfCjf6uSYh6Y9ASU99pgmf6EVpBP89b6Rsfcuem:R6lXJ8f6uSYh6YKSU99pgmf9K6Kfce
MD5:	20304CAE3A5B796FCFA51ED0966FFB37
SHA1:	BC54CB83C9841A2E49A9233E8D3259916954E7F4
SHA-256:	65A596CFACD0CD7D8E0424BB2E441DD62D539E7CBA63214ACAE5764A085CB792
SHA-512:	4B673BA773E116A73984D420031D6E2B6783210EB4E61D60B1BF0C3D11876E3B023E2F379D37EE7278226AE4352AAF0E3FC244AC099FAC6A005EED670A3D603C
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.2.8.9.6.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERDF93.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4692
Entropy (8bit):	4.457452473521463
Encrypted:	false
SSDEEP:	48:cvIwWl8zsoJg77aI9TAWpW8VY1Ym8M4JhNJFpH+q8vMNLjyvkd:uIjfuI7h57VpJhfKM5+vkd
MD5:	9A471223257D890379BEE6BD8A8B43D6
SHA1:	04542873D6AC804EC29ACB536E510C864CABFF89
SHA-256:	51A621DEF16F6798E40E6D5E7F6A10FD6ED321B7E186C5E78A7EAA3AC1B3D925
SHA-512:	63104042876DEF8AD0CC5B01107E92920AC80EF2B45D7910E4CED60803E0E6237D671DA945740F65A3E14ECE0F100AB38C7BC2F4A290CB3FCFBCCA114106AF0E
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="290311" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE406.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Sun Apr 21 23:29:03 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	120602
Entropy (8bit):	2.1150610939545147
Encrypted:	false
SSDEEP:	768:iRtwWt4lTve+z1wG90wGaAYZP6uH1rtdR5fVw:iRtmGA1wG9u+rtdR3
MD5:	D7FEFC0E60AA0125EFEB17AF5B40A531
SHA1:	0F9FD1891C3EDEA91AEA7AE5983317628E57D419
SHA-256:	C26D4904EDF8FEA5AFE69F3A617DB9BBA7239FA5E9E0C5C93B4D39BDFAA48B06
SHA-512:	D18803245A7C9FD287166BC4823759FB591FE415561E6E65E75BA2484C164B56C23136FA25740D09543639DD68E5DB024255861D4CDE04D8BC63B33ED2E059FB
Malicious:	false
Preview:	MDMP..a..... .......?.%f............................(.......l...,$......T...\|P..........`.......8...........T............I..r............$...........&..............................................................................eJ.......'......GenuineIntel............T.......P...3.%f.............................0..................W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE52F.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8412
Entropy (8bit):	3.6952816697682493
Encrypted:	false
SSDEEP:	192:R6l7wVeJfCH6w0m6Y9zvSU9aQgmf60aAjAypBZ89bIRsf54m:R6lXJC6i6YBvSU9aQgmftaAjAzIKfj
MD5:	F26502973E2111A05B4B4033D8CBE05C
SHA1:	CCD5A7E36841AF875097172F564C109008E33004
SHA-256:	D7B6426CE76A05F992370436277075A52F5EA523B02631BF8C1EE660ABE6F8DD
SHA-512:	375B414E15C1ECA04FFA48D04C4F3B26C95D57DA4D9FB6B9E73AD5D9CE04E787B31A945E7452ED5BDA88491FDC577442B42A621669D2EE9F965C04DBEAFFB065
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.2.8.9.6.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE55F.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4692
Entropy (8bit):	4.453345672510294
Encrypted:	false
SSDEEP:	48:cvIwWl8zsoJg77aI9TAWpW8VY7Ym8M4JhNBFkE+q8vMNTjyvkd:uIjfuI7h57VzJhjKMp+vkd
MD5:	F1D47C7E5B392567AE683C8871300D2F
SHA1:	C69576B283B91AFE8DE6F32A31CD66DC84E1C5F4
SHA-256:	B4BDEFD4F9191A3CD7A9BB45BC40AFD07E97F40762D0FD442826D582D89C2AD3
SHA-512:	8FDB4F21A2077252D5EED11A4AFD8CB57F162D1C3D04A70FBFA249B25ED7E02E0FF395CEE95E4684F4F138997ADAE446BCB96DF7D94735D995E98339A55DF50F
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="290311" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE732.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Sun Apr 21 23:29:04 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	115126
Entropy (8bit):	2.1536972780188384
Encrypted:	false
SSDEEP:	768:ztMjZhp4lTvv+UuYwfwGaAYZP6qqNBjG7jX:zkXSHfuYwXNN9G7b
MD5:	35EFAD8A16D07C63AE3C307FD9656660
SHA1:	EB3453B53DE6A5779C54E0D4C3E5A28A430EB2EA
SHA-256:	0EBD36B88603F43369E57A9E21CA49CB7D0CE3E9E948F77A069E87DFBA546990
SHA-512:	00BD248A6933170432FEB9BC82A737C8E0F7C9C2B9E6A2DBD8A082D732CFCD522A1A2C461AD59D206E0CF392924A6BD60228F4DD50E119AE9CCBC6D4FC4FBF14
Malicious:	false
Preview:	MDMP..a..... .......@.%f....................................l....#......$....M..........`.......8...........T............I...x..........h$..........T&..............................................................................eJ.......&......GenuineIntel............T.......P...3.%f.............................0..................W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE7EF.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8412
Entropy (8bit):	3.6959009564632064
Encrypted:	false
SSDEEP:	192:R6l7wVeJfCh6m4m6Y9PSU9aQgmf60aAjAypBa89bnRsfptm:R6lXJE6Y6YFSU9aQgmftaAjAGnKfK
MD5:	E58D6F2A19C77FBF95EB8BF4F3B189C7
SHA1:	25FD36DF0D427536682F21E8814D065DB7633746
SHA-256:	AE868E33C5C7BB393440DC18D14DCEFF8FB7F105E48E876975545A9C21FBF22B
SHA-512:	F7651E217D458E0A8C66FE15A19B29CCCFFE69BBF85D1D3EC3B7C8B928C8A09B30CF2E10D4910DCBE7F3735D9094267FD161B4CB534B353CBE01F9DC1344A97E
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.2.8.9.6.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE80F.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4692
Entropy (8bit):	4.455519333234965
Encrypted:	false
SSDEEP:	48:cvIwWl8zsoJg77aI9TAWpW8VYZYm8M4JhNBFT+q8vMNTjyvkd:uIjfuI7h57VRJhZKMp+vkd
MD5:	260F64159633BFC207F6AA1893DB766A
SHA1:	BAAEA9EAC95277F1AA53E2D414501DE5B090845B
SHA-256:	DF8AA3B5478F6285036AB72AFD52BD4991B900A0B08FFDC9DE2DF8C0B5D39F66
SHA-512:	E8FD4118B1A30E755E94238033707DB635E2D6F5B12178C3E0CDC957A596C48FA9287C3A44B46DB51E5B8E7B3D5030DC534E7921ED6C5E4A4E30F20BF8F55128
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="290311" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WEREC04.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Sun Apr 21 23:29:05 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	152116
Entropy (8bit):	1.9053283694109437
Encrypted:	false
SSDEEP:	768:GVeQuM3sp6KW34lTvLCOdo7wGaAYZP6NCZ/Nzwo57QvoMQTJO9mKuB:KsIMDxdobQZ1Mo57QvoMQTJO9mKuB
MD5:	69740F057E604A29ACDC06673565EBA1
SHA1:	360389A2025BB039E2D36ED2BE3612D43154392D
SHA-256:	47A57CCF1B4A522DDBDB44A125AD7009953877CDA73CE8EB6C7C236C26324C1B
SHA-512:	4B437971EA6C434A012A42FCC2A4CE20C9F517B2DAA3CB0898C3C31115BDD1331D453B3CF9DDDEBAC8B0874E59057E13B8898776E1D68E874634DBF33250C939
Malicious:	false
Preview:	MDMP..a..... .......A.%f........................p...........l....%..........._..........`.......8...........T............K..$............%...........'..............................................................................eJ......x(......GenuineIntel............T.......P...3.%f.............................0..................W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERECD1.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8412
Entropy (8bit):	3.698411100482801
Encrypted:	false
SSDEEP:	192:R6l7wVeJfCe616Y9DSU9Z5gmf6EVpBa89beRsfXAqm:R6lXJb616YZSU9Z5gmf9ZeKfXc
MD5:	471EC40A0C4A5B051AAFE7D408B97A2B
SHA1:	6125BA114B750B0EBFD25E3A0AD02431716D8C75
SHA-256:	2E74D3018A5C370EFFF8E41307307E3DCCAE07F686803F397F72FC5905A80D32
SHA-512:	851A049C945546BAA557E2EC013D1D63B6318619FC0F2AD976BD3B319997E2B5AC1F57B33F7F86F0582D3D244E14AB3D18BFA7033C7B522FC6A1B353802D0D8A
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.2.8.9.6.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERED5E.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4692
Entropy (8bit):	4.455769659011207
Encrypted:	false
SSDEEP:	48:cvIwWl8zsoJg77aI9TAWpW8VYdYm8M4JhNJFv+q8vMNLjyvkd:uIjfuI7h57V5JhBKM5+vkd
MD5:	75940B10124AA64A45B36335984EA5A4
SHA1:	9E5DCD336AC386D351DE5E138897E247AE57318A
SHA-256:	488C401645D8F42DFAFE0586AB272894F5C45967D2D8E90C0BA7B425E7C66D27
SHA-512:	D8E19ACFBEC86A9B3D87263BB5F4F0109918DFB73DF22157694E8537895311E9EADCE39DC13BF5E5E30838421E6751690F78B88AD92A115A18EAC85A11560FFF
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="290311" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERF490.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Sun Apr 21 23:29:07 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	151664
Entropy (8bit):	1.9126789958067452
Encrypted:	false
SSDEEP:	768:bZ8y4crhsp6Kp4lTvvUxzRQU3BkdwGaAYZP6Npj8xLIZe2Wt7kvEM0:bBscenkpDj8tIZe2Wt7kvEM0
MD5:	BEB1D1D25EF16E9E292EA7F81A1BD87D
SHA1:	9E1361A57023CC4FE1FA282D3104C7F9F9056919
SHA-256:	D595E4743BF7B65136AA43D83CFD4C1D35855C77C014E0351A95C0703E225320
SHA-512:	89FD7E7E431B0E826D0939DEB902CF9BF185C5EB37473F6A698D98E80E6259A8C8614D3C8ECE8DAF365D43CFAD22622932A0D6EA9C8BF3078795BDE75FD1D91C
Malicious:	false
Preview:	MDMP..a..... .......C.%f........................p...........l....%..........._..........`.......8...........T............K..`............%...........'..............................................................................eJ......x(......GenuineIntel............T.......P...3.%f.............................0..................W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERF6B4.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8412
Entropy (8bit):	3.6991458845765512
Encrypted:	false
SSDEEP:	192:R6l7wVeJfC56x6Y9/mSU9p6gmf6EVpBl89bGbRsfrAjm:R6lXJ86x6YESU9p6gmf9YGbKf86
MD5:	140968D3B787B4747C19B7B3F82768B3
SHA1:	8511DA398ED0057BE43100C0F76C640DFEC0F177
SHA-256:	0E444501FAAE333C3FE6356E205EDB3DBA7BD81FEB94B7FF7FF636872CF94064
SHA-512:	9E560B1998EE2248E773E01734E6B81BEDC882B9B8E1F6DF96B688A7DD32E86A954C56B6B51F651C49B09C3B983C587BB74499F83C689AA642099D40C04C2B11
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.2.8.9.6.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERF6D4.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4692
Entropy (8bit):	4.4578670689810025
Encrypted:	false
SSDEEP:	48:cvIwWl8zsoJg77aI9TAWpW8VYZYm8M4JhNJFn+q8vMNLjyvkd:uIjfuI7h57VFJhBKM5+vkd
MD5:	FE01A48CB7EBBE666EF0F02C94B3FC5A
SHA1:	70A379D01A498EDBD2CC4FC9E7DEB2E8498D40E7
SHA-256:	653F26E6D52FD3C5CB7C1BBB9D5A3595BA5E9A89DF1D214F3A44CE6B8421D144
SHA-512:	6B023BB1B4FAD9B447C69B1EFF71C2B90FA7F2C1C3BC3E5F64E67C7CA4133D747AF0566646852375FAFB07E2D495F7F560FD2E63A9CE637C741D87D76E5FF416
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="290311" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERFAD9.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Sun Apr 21 23:29:09 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	151172
Entropy (8bit):	1.9275516387321967
Encrypted:	false
SSDEEP:	768:xSsEMvsp6KD4lTvgqegOwqwGaAYZP6BBZ4oZzvhSjYR/+fS106s:LsCdegOwwLZ4EzvhSjYR/+fS106s
MD5:	0E5594C09311EAE4EDD34602F9999F8F
SHA1:	DE8D91EB5EB8789C36A89AF9412D412CABFA908A
SHA-256:	E2DD3F72EE59417C1FA6EC334E35F10DA653527B6E49E8F2FDFAEB5CEE74FBBA
SHA-512:	75931635594634E7ECB9627013E32ED81A3B736059A9B29EE49094D036C64FF8E9202B6A81D26CB4DF0382C7710C06A4FB1B157D2F6F25F24ABBFD8482B786E9
Malicious:	false
Preview:	MDMP..a..... .......E.%f........................p...........l....%..........._..........`.......8...........T............K..t............%...........'..............................................................................eJ......x(......GenuineIntel............T.......P...3.%f.............................0..................W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERFB96.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8412
Entropy (8bit):	3.697815845654339
Encrypted:	false
SSDEEP:	192:R6l7wVeJfCI6V6Y9eSU9mIgmf60aAjAypB989bCRsf42m:R6lXJd6V6Y0SU9mIgmftaAjAvCKfQ
MD5:	BA313197542CD4E87DB8AFE6D7791B20
SHA1:	B5B3567C118A5F89CC1C1619C35805B72A2FD13E
SHA-256:	6E44E58D3B8029955A2DF6BCEB37A52B6B7D9A37D54F1371ABB039C9D9CEB646
SHA-512:	AFCEFBE6F7E9F269F44914BE7ED7DC0717A470E006FD7690DA80ED2E25FA4FA785FE27A8EF33D12C8DD4CED7C596BE2D4D9424E6D26C4D4579875C9317A6C90B
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.2.8.9.6.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERFBB6.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4692
Entropy (8bit):	4.452740239107526
Encrypted:	false
SSDEEP:	48:cvIwWl8zsoJg77aI9TAWpW8VY+Ym8M4JhNBF44+q8vMNTjyvkd:uIjfuI7h57V2JhvKMp+vkd
MD5:	BFCAD7A79D80DBC2A446EE5F5B8E9D7B
SHA1:	CA0439C196BD38D3EC5F9B87CFDA5BB36086A105
SHA-256:	BB781E6079CED5773FA2E204BCDED88C8DC1C69F408F4062D1138D92C74F8A6B
SHA-512:	A7F80DE3E35DB52464A9403F42C32DBAE08B1CE4D6CCF43D4A9075A5A40A32CD133E991008C3707B0F4AD6DDCB966030D2EC4D87E5FEF303FF640DEDFA4C3C5C
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="290311" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERFD98.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Sun Apr 21 23:29:09 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	145696
Entropy (8bit):	1.9541136968837163
Encrypted:	false
SSDEEP:	768:3+LAAYL1Jj9W4lTvcHjwrMwGaAYZP6BAUX/tLJZF:3bRZKjwrWrX1LJZF
MD5:	C4167176EB0B89D7C9CE4AF98B2BF922
SHA1:	A69B3626216243739A45692A80A127B51FAE0CBA
SHA-256:	FC4D5BDC952C6C6BE545F1FF1E36792559EDDE2721496E8B105351F386CF4917
SHA-512:	EB8902931A3D7CC71D7CB39B107D0D83718D641B9E13E351E4A1EE1EEF26A07947A91B887B5448FC08829EF95E13E3B8A8451AC3ED52F561880170BC2875E5C2
Malicious:	false
Preview:	MDMP..a..... .......E.%f........................p...........l...X%...........\..........`.......8...........T............K...............%...........'..............................................................................eJ......H(......GenuineIntel............T.......P...3.%f.............................0..................W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERFEF1.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8412
Entropy (8bit):	3.6976586447083672
Encrypted:	false
SSDEEP:	192:R6l7wVeJfCM6G6Y9mSU9mIgmf60aAjAypBB89bCRsfL2m:R6lXJp6G6YsSU9mIgmftaAjA7CKfj
MD5:	C14B55EC67CF087BD1AB50C637BD289B
SHA1:	28A361EF8B33315FE7CBED85723DA9A546ACB67C
SHA-256:	27217515CEA3CB4AF1BA38DE16535400A01D86550DBF4F2C5D418C87681BF8E6
SHA-512:	552C0B4F0F87B571EF2DC356D02C15AFB2C7E4625F5DE9DCBEBFD43B73D29C50D22EB3860F96DA2849CA265A54C8636A3F9BE02B2CA97D8A76AC4AFF928881BB
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.2.8.9.6.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERFF11.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4692
Entropy (8bit):	4.456814442687764
Encrypted:	false
SSDEEP:	48:cvIwWl8zsoJg77aI9TAWpW8VYtYm8M4JhNBFP+q8vMNTjyvkd:uIjfuI7h57VJJhRKMp+vkd
MD5:	76130B511AEA58092885A5F2F18BABA0
SHA1:	DA6C0730558951AD98CF2B7892ECE8AB7BCE925F
SHA-256:	33DBE3126F9A426FF4129D19A45D8356C8947789EDBCA6F673C3EBD8AAEBC381
SHA-512:	B9298903EA65132A3842C963D2B5CE01EED4422127DA761936E3E9AD59A9F5EC5EDE39E6DC7FE21E67DC3A428DF2518F8A11C78D64C2CE7C38C4B6DDA977FDB5
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="290311" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Users\user\AppData\Local\Temp\W9yZG_t61Z_J7GfmBn540XA.zip

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	5495
Entropy (8bit):	7.899150804081277
Encrypted:	false
SSDEEP:	96:wk6yWGzqeAoMq+YK0KF8cAJiI2i+uWbnYrIZlGAyujvIWFw3KJ5kgFaL:vhqASpF8wF9/ECvIx6JOp
MD5:	1236012D43014D116638CD0D693CA44F
SHA1:	3045600BD24CBA58BE4BE6DEEFC98E0CDEB68241
SHA-256:	39DBB196F9FF54A6E21383FCDDF77EC08F31CB284D8DCA4139D49671DF6616EE
SHA-512:	A14BE6E29196E36B5B14914577D4A2F6BF8D516D9CF962F68367A01C0B0883BD05842675392943571FA0F5E6834C2CEDC5632EB0E99E1CD43B24C2DC8DA1E931
Malicious:	true
Yara Hits:	Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: C:\Users\user\AppData\Local\Temp\W9yZG_t61Z_J7GfmBn540XA.zip, Author: Joe Security
Preview:	PK...........X................Cookies\..PK...........XQn.+............Cookies\Chrome_Default.txt.G..r...U.#.5C.....s$..-.D...7.\..$.G.)o....:....Z.C.f_..pm............"..t..t....}.k.@...a.2+P`.0.x.>....s..k%.._..b..P..((......B.....`.7..-m..JY..F....E..l.....I..&.....<J..M.......,V...)b.....Q..k......M?.5L....h}......X..'.0..tB.G...\;.a....4.......B4.......J.4.6.y:....4.-.UfE...3Ap.U5UX....Z.g:e.j.C..Bw..........e..a^.vU:....$..U......B..`._.e.....+...9.{u...7.e...H.]02...%yR".0...x...P<..N....R.}....{.G...;..c..x...kw.'S>.d\|.....B..k.9.t.!>.rh...~n.[....s#/....`.!..Kb8%&.vZB`....O\|.....>K......L...d0..03..t...T&.......`N.xp.."..J.......Q.....c..5...).Z.91.6.j..G.....Wr...a.52!..(^.U.....6....dB.D.^...7..0H.\J9.H.$^`e"..d...\....B.8Z=.qeP.3Y.>..'W.X..T..>z...,..K......g....%B.w4#...;.[]u\|....v...3.;L..U?..b.....u....... .......F...P.a...\|R3.=......r.:.64...#D..^..>.A..ZT.]E........t...f...1..3.....`...X.....C.]%...p.p.ym

C:\Users\user\AppData\Local\Temp\spanBKaHSrnNvXxX\02zdBXl47cvzcookies.sqlite

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanBKaHSrnNvXxX\2tsRP66QVQTmWeb Data

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanBKaHSrnNvXxX\3b6N2Xdh3CYwplaces.sqlite

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanBKaHSrnNvXxX\6xWctsbrfVe0Web Data

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanBKaHSrnNvXxX\73zD30s3rSfmHistory

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanBKaHSrnNvXxX\Cma6mvK3hWvIHistory

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanBKaHSrnNvXxX\D87fZN3R3jFeplaces.sqlite

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanBKaHSrnNvXxX\HhIb92Xvz5nICookies

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanBKaHSrnNvXxX\KsnNQ7qbgZr8Login Data

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanBKaHSrnNvXxX\Le1h_k1bUmDcLogin Data

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanBKaHSrnNvXxX\X4oeewryncyYWeb Data

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanBKaHSrnNvXxX\ZP9OgwnUTBtwHistory

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanBKaHSrnNvXxX\c7L3m01NgL1nHistory

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanBKaHSrnNvXxX\kpoRIew0KmbRWeb Data

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanBKaHSrnNvXxX\v9sfzApO2m4MWeb Data

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanBKaHSrnNvXxX\vbwxzHO_00KHLogin Data For Account

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanBKaHSrnNvXxX\xq4j8bDozcmeWeb Data

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\trixyBKaHSrnNvXxX\Cookies\Chrome_Default.txt

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with very long lines (769), with CRLF line terminators
Category:	dropped
Size (bytes):	6085
Entropy (8bit):	6.038274200863744
Encrypted:	false
SSDEEP:	96:gxsumX/xKO2KbcRfbZJ5Jxjxcx1xcbza5BC126oxgxA26Fxr/CxbTxqCGYURxOeb:gWFXZQHRFJ5Pts7c3avC126Ygb6Lr/WY
MD5:	ACB5AD34236C58F9F7D219FB628E3B58
SHA1:	02E39404CA22F1368C46A7B8398F5F6001DB8F5C
SHA-256:	05E5013B848C2E619226F9E7A084DC7DCD1B3D68EE45108F552DB113D21B49D1
SHA-512:	5895F39765BA3CEDFD47D57203FD7E716347CD79277EDDCDC83A729A86E2E59F03F0E7B6B0D0E7C7A383755001EDACC82171052BE801E015E6BF7E6B9595767F
Malicious:	false
Preview:	.google.com.TRUE./.TRUE.1712145003.NID.ENC893_djEw3+k+F2A/rK1XOX2BXUq6pY2LBCOzoXODiJnrrvDbDsPWiYwKZowg9PxHqkTm37HpwC52rXpnuUFrQMpV3iKtdSHegOm+XguZZ6tGaCY2hGVyR8JgIqQma1WLXyhCiWqjou7/c3qSeaKyNoUKHa4TULX4ZnNNtXFoCuZcBAAy4tYcz+0BF4j/0Pg+MgV+s7367kYcjO4q3zwc+XorjSs7PlgWlYrcc55rCJplhJ+H13M00HIdLm+1t9PACck2xxSWX2DsA61sEDJCHEc=_b3i0u6LLcKCMUaF/UlQgEPSL9PtLZ21CuT1dJkfCzME=..support.microsoft.com.FALSE./.TRUE.1696413835..AspNetCore.AuthProvider.ENC893_djEwVWJCCNyFkY3ZM/58ZZ/F/bz9H1yPvi6FOaroXC+KU8E=_b3i0u6LLcKCMUaF/UlQgEPSL9PtLZ21CuT1dJkfCzME=..support.microsoft.com.TRUE./signin-oidc.TRUE.1696414135..AspNetCore.Correlation.mdRqPJxLbpyv7vX0eK9YkTR-xwcrW3VBLE4Y3HEvxuU.ENC893_djEwBAKLrkJs5PZ6BD7Beoa9N/bOSh5JtRch10gZT+E=_b3i0u6LLcKCMUaF/UlQgEPSL9PtLZ21CuT1dJkfCzME=..support.microsoft.com.TRUE./signin-oidc.TRUE.1696414135..AspNetCore.OpenIdConnect.Nonce.CfDJ8Kiuy_B5JgFMo7PeP95NLhqwcJ8koDy5pXkfoWsb5SbbU2hVCbsH2qt9GF_OVCqFkLEwhvzeADNQOF5RSmkDfh5RqfqlOkx5QWo4Lltvwb0CvwBFD8ujlm3BAglOeGca3ZatkLMUkH

C:\Users\user\AppData\Local\Temp\trixyBKaHSrnNvXxX\information.txt

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	5576
Entropy (8bit):	5.370309588820505
Encrypted:	false
SSDEEP:	96:xraXZRbicT4Aisph+9hcmf/aPikANUbg3x:x0NivAtphWhcmf/aPOB
MD5:	1B4EAB0ACFE8F5F8589712E0AA58E893
SHA1:	3BA4DDA32E364E78E5C336FF57ECA3252D08A424
SHA-256:	6FF5E3C56706A12B2B04C92377A648B09F08FD18A5E0662BDC423659227AD72A
SHA-512:	372D97F0536A37BD136EC1D2C4D1C941351DC91E09A8A4AE0679BE91AF190DC34E084A6AC7FA4871E67B2C619CB43F441B7435DE196B52DDADDF8F2446AAACF4
Malicious:	false
Preview:	Build: fufes..Version: 1.9....Date: Mon Apr 22 01:29:04 2024.MachineID: 9e146be9-c76a-4720-bcdb-53011b87bd06..GUID: {a33c7340-61ca-11ee-8c18-806e6f6e6963}..HWID: 5dae1d66b9e5e9735be7dfdd4f60af51....Path: C:\Users\user\Desktop\file.exe..Work Dir: C:\Users\user\AppData\Local\Temp\trixyBKaHSrnNvXxX....IP: 81.181.57.52..Location: US, Atlanta..ZIP (Autofills): -..Windows: Windows 10 Pro [x64]..Computer Name: 066656 [WORKGROUP]..User Name: user..Display Resolution: 1280x1024..Display Language: en-CH..Keyboard Languages: English (United Kingdom) / English (United Kingdom)..Local Time: 22/4/2024 1:29:4..TimeZone: UTC1....[Hardware]..Processor: Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz..CPU Count: 4..RAM: 8191 MB..VideoCard #0: Microsoft Basic Display Adapter....[Processes]..System [4]..Registry [92]..smss.exe [324]..csrss.exe [408]..wininit.exe [484]..csrss.exe [492]..winlogon.exe [552]..services.exe [620]..lsass.exe [628]..svchost.exe [752]..fontdrvhost.exe [776]..fontdrvhost.exe [784]..svcho

C:\Users\user\AppData\Local\Temp\trixyBKaHSrnNvXxX\passwords.txt

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	Unicode text, UTF-8 text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	4897
Entropy (8bit):	2.518316437186352
Encrypted:	false
SSDEEP:	48:4MMMMMMMMMMdMMMM1MMMMMMMM1MMMMMMMM1MMMMMMMM1MMMMMMMMMMdMMMMMMMM3:q
MD5:	B3E9D0E1B8207AA74CB8812BAAF52EAE
SHA1:	A2DCE0FB6B0BBC955A1E72EF3D87CADCC6E3CC6B
SHA-256:	4993311FC913771ACB526BB5EF73682EDA69CD31AC14D25502E7BDA578FFA37C
SHA-512:	B17ADF4AA80CADC581A09C72800DA22F62E5FB32953123F2C513D2E88753C430CC996E82AAE7190C8CB3340FCF2D9E0D759D99D909D2461369275FBE5C68C27A
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.465279137708291
Encrypted:	false
SSDEEP:	6144:3IXfpi67eLPU9skLmb0b4+WSPKaJG8nAgejZMMhA2gX4WABl0uNPdwBCswSbG:4XD94+WlLZMM6YFH1+G
MD5:	E0248D14EA942B24B73A4C31C431A63B
SHA1:	44718D5C4D49339D2E90308F510A31A8FEED0D52
SHA-256:	DB7C1140A3BABD44910BB5849ED0E05DDEE0F75CA46D3BD5D376A4F09CBCCFF6
SHA-512:	45541AE50B683B846CE0FC99CB1650D1D063609CCA343C9729038896275E98DB2764EA54FD1412593A8BA4BAFAB764268518B336AE88EEB1B00F7791EA91967B
Malicious:	false
Preview:	regfG...G....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm.b.C................................................................................................................................................................................................................................................................................................................................................l..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.766442912330682
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	997'888 bytes
MD5:	5f30e027d147af1de92391f2e18644c8
SHA1:	febe9d268d31c17a24c0cae2d2e2b5d617d8608f
SHA256:	8f82f1de5cd507dd90c604c127dfe50e366530fbc0bbe2841ce68767d911cc65
SHA512:	671aaf72c280f56f5f5d11d138946d1b30e6625670c9be1350cc6eac560be5af2c48906b04b14c072efe4cd313d3d0694128475548d5efe0721f97990631e809
SSDEEP:	24576:V3l3jR7ECfW0DJfsOtKSpnywvEITMp2hiF3UdEbwQ:V3Jj2CfZJf1KSXsM22A3UdYw
TLSH:	68251202F6F2A434F5A70B3A48349B1506BFFD339A74859FA388320E69B15D06772B53
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......B.....\|...\|...\|.......\|.....z.\|.....*.\|.......\|...}.v.\|..4....\|.......\|..4....\|.Rich..\|.........PE..L....2.d...................

File Icon


Icon Hash:	cd0d3d2e4e054d05

Static PE Info

General

Entrypoint:	0x40405d
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x64C1320B [Wed Jul 26 14:47:39 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	43cb5d6ab6c623f5883f711e054621c1

Entrypoint Preview

Instruction
call 00007F66B87BC048h
jmp 00007F66B87B6415h
push 00000014h
push 004166D8h
call 00007F66B87B9592h
call 00007F66B87BB153h
movzx esi, ax
push 00000002h
call 00007F66B87BBFDBh
pop ecx
mov eax, 00005A4Dh
cmp word ptr [00400000h], ax
je 00007F66B87B6416h
xor ebx, ebx
jmp 00007F66B87B6445h
mov eax, dword ptr [0040003Ch]
cmp dword ptr [eax+00400000h], 00004550h
jne 00007F66B87B63FDh
mov ecx, 0000010Bh
cmp word ptr [eax+00400018h], cx
jne 00007F66B87B63EFh
xor ebx, ebx
cmp dword ptr [eax+00400074h], 0Eh
jbe 00007F66B87B641Bh
cmp dword ptr [eax+004000E8h], ebx
setne bl
mov dword ptr [ebp-1Ch], ebx
call 00007F66B87B9408h
test eax, eax
jne 00007F66B87B641Ah
push 0000001Ch
call 00007F66B87B64F1h
pop ecx
call 00007F66B87B8AE9h
test eax, eax
jne 00007F66B87B641Ah
push 00000010h
call 00007F66B87B64E0h
pop ecx
call 00007F66B87BAE9Ch
and dword ptr [ebp-04h], 00000000h
call 00007F66B87BA4F5h
test eax, eax
jns 00007F66B87B641Ah
push 0000001Bh
call 00007F66B87B64C6h
pop ecx
call dword ptr [004100C8h]
mov dword ptr [040D7A4Ch], eax
call 00007F66B87BC02Fh
mov dword ptr [004E6A00h], eax
call 00007F66B87BBC2Ch
test eax, eax
jns 00007F66B87B641Ah

Rich Headers

Programming Language:

[ASM] VS2013 build 21005
[ C ] VS2013 build 21005
[C++] VS2013 build 21005
[IMP] VS2008 SP1 build 30729
[RES] VS2013 build 21005
[LNK] VS2013 UPD5 build 40629

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x16b0c	0x50	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x3cd8000	0xee58	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x10200	0x38	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x160b0	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x16068	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x10000	0x190	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xe403	0xe600	590cc0bd6f8bcc8f80a46e1c375b800c	False	0.601953125	data	6.680942552005868	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x10000	0x7440	0x7600	1560bf9c69cef0ed073692a7553e3c60	False	0.3897974046610169	data	4.887444766557987	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x18000	0x3cbfa64	0xcea00	e7c90b233c7d1f1b2075f03b8765b98e	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x3cd8000	0xee58	0xf000	ce35a0ad0d757bc5db78cd7e6465e998	False	0.47861328125	data	5.238002400787557	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x3cd8570	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	Romanian	Romania	0.48667377398720685
RT_ICON	0x3cd9418	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	Romanian	Romania	0.5938628158844765
RT_ICON	0x3cd9cc0	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	Romanian	Romania	0.6526497695852534
RT_ICON	0x3cda388	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	Romanian	Romania	0.6589595375722543
RT_ICON	0x3cda8f0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216	Romanian	Romania	0.39180497925311203
RT_ICON	0x3cdce98	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096	Romanian	Romania	0.5077392120075047
RT_ICON	0x3cddf40	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2304	Romanian	Romania	0.5860655737704918
RT_ICON	0x3cde8c8	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024	Romanian	Romania	0.6773049645390071
RT_ICON	0x3cdeda8	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Romanian	Romania	0.4139125799573561
RT_ICON	0x3cdfc50	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Romanian	Romania	0.4598375451263538
RT_ICON	0x3ce04f8	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	Romanian	Romania	0.554147465437788
RT_ICON	0x3ce0bc0	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Romanian	Romania	0.44942196531791906
RT_ICON	0x3ce1128	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Romanian	Romania	0.46307053941908716
RT_ICON	0x3ce36d0	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Romanian	Romania	0.4793621013133208
RT_ICON	0x3ce4778	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	Romanian	Romania	0.494672131147541
RT_ICON	0x3ce5100	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Romanian	Romania	0.5540780141843972
RT_DIALOG	0x3ce57c8	0x52	data			0.8780487804878049
RT_STRING	0x3ce5820	0x322	data	Romanian	Romania	0.47256857855361595
RT_STRING	0x3ce5b48	0x5a8	data	Romanian	Romania	0.43577348066298344
RT_STRING	0x3ce60f0	0x1e4	data	Romanian	Romania	0.4772727272727273
RT_STRING	0x3ce62d8	0x322	data	Romanian	Romania	0.47381546134663344
RT_STRING	0x3ce6600	0x698	data	Romanian	Romania	0.4259478672985782
RT_STRING	0x3ce6c98	0x1ba	data	Romanian	Romania	0.5135746606334841
RT_GROUP_ICON	0x3cded30	0x76	data	Romanian	Romania	0.6610169491525424
RT_GROUP_ICON	0x3ce5568	0x76	data	Romanian	Romania	0.6694915254237288
RT_VERSION	0x3ce55e0	0x1e4	data			0.5371900826446281

Imports

DLL	Import
KERNEL32.dll	LocalCompact, GetUserDefaultLCID, AddConsoleAliasW, CreateHardLinkA, GetTickCount, EnumTimeFormatsW, GetUserDefaultLangID, FindResourceExA, GetVolumeInformationA, GetLocaleInfoW, GetCompressedFileSizeA, GetTempPathW, SetThreadLocale, SetLastError, GetProcAddress, CreateTimerQueueTimer, FindFirstChangeNotificationW, BuildCommDCBW, LoadLibraryA, WriteConsoleA, InterlockedExchangeAdd, LocalAlloc, SetCalendarInfoW, GetExitCodeThread, RemoveDirectoryW, AddAtomA, SetNamedPipeHandleState, GlobalFindAtomW, GetModuleFileNameA, GetOEMCP, GlobalUnWire, LoadLibraryExA, ReadConsoleInputW, GetWindowsDirectoryW, AddConsoleAliasA, SetFileAttributesA, GetComputerNameA, WriteConsoleW, OutputDebugStringW, GetLastError, HeapFree, EncodePointer, DecodePointer, ReadFile, ExitProcess, GetModuleHandleExW, MultiByteToWideChar, WideCharToMultiByte, GetCommandLineA, RaiseException, RtlUnwind, IsProcessorFeaturePresent, IsValidCodePage, GetACP, GetCPInfo, GetCurrentThreadId, IsDebuggerPresent, HeapAlloc, GetProcessHeap, HeapSize, EnterCriticalSection, LeaveCriticalSection, SetFilePointerEx, GetConsoleMode, GetStdHandle, GetFileType, DeleteCriticalSection, GetStartupInfoW, CloseHandle, UnhandledExceptionFilter, SetUnhandledExceptionFilter, InitializeCriticalSectionAndSpinCount, Sleep, GetCurrentProcess, TerminateProcess, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, GetModuleHandleW, WriteFile, GetModuleFileNameW, LoadLibraryExW, QueryPerformanceCounter, GetCurrentProcessId, GetSystemTimeAsFileTime, GetEnvironmentStringsW, FreeEnvironmentStringsW, GetStringTypeW, HeapReAlloc, LCMapStringW, SetStdHandle, GetConsoleCP, FlushFileBuffers, CreateFileW
ADVAPI32.dll	DeregisterEventSource
WINHTTP.dll	WinHttpConnect

Possible Origin

Language of compilation system	Country where language is spoken	Map
Romanian	Romania

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
04/22/24-01:28:54.900516	TCP	2049060	ET TROJAN RisePro TCP Heartbeat Packet	49730	58709	192.168.2.4	147.45.47.93
04/22/24-01:28:55.338745	TCP	2046267	ET TROJAN [ANY.RUN] RisePro TCP (External IP)	58709	49730	147.45.47.93	192.168.2.4
04/22/24-01:28:55.099915	TCP	2046266	ET TROJAN [ANY.RUN] RisePro TCP (Token)	58709	49730	147.45.47.93	192.168.2.4
04/22/24-01:28:58.805975	TCP	2046269	ET TROJAN [ANY.RUN] RisePro TCP (Activity)	49730	58709	192.168.2.4	147.45.47.93

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 22, 2024 01:28:54.661473036 CEST	49730	58709	192.168.2.4	147.45.47.93
Apr 22, 2024 01:28:54.880594969 CEST	58709	49730	147.45.47.93	192.168.2.4
Apr 22, 2024 01:28:54.880693913 CEST	49730	58709	192.168.2.4	147.45.47.93
Apr 22, 2024 01:28:54.900516033 CEST	49730	58709	192.168.2.4	147.45.47.93
Apr 22, 2024 01:28:55.099915028 CEST	58709	49730	147.45.47.93	192.168.2.4
Apr 22, 2024 01:28:55.119390965 CEST	58709	49730	147.45.47.93	192.168.2.4
Apr 22, 2024 01:28:55.119645119 CEST	49730	58709	192.168.2.4	147.45.47.93
Apr 22, 2024 01:28:55.222831011 CEST	49730	58709	192.168.2.4	147.45.47.93
Apr 22, 2024 01:28:55.338745117 CEST	58709	49730	147.45.47.93	192.168.2.4
Apr 22, 2024 01:28:55.394500971 CEST	49730	58709	192.168.2.4	147.45.47.93
Apr 22, 2024 01:28:55.483964920 CEST	58709	49730	147.45.47.93	192.168.2.4
Apr 22, 2024 01:28:57.981108904 CEST	49731	443	192.168.2.4	34.117.186.192
Apr 22, 2024 01:28:57.981194019 CEST	443	49731	34.117.186.192	192.168.2.4
Apr 22, 2024 01:28:57.981261969 CEST	49731	443	192.168.2.4	34.117.186.192
Apr 22, 2024 01:28:57.984538078 CEST	49731	443	192.168.2.4	34.117.186.192
Apr 22, 2024 01:28:57.984572887 CEST	443	49731	34.117.186.192	192.168.2.4
Apr 22, 2024 01:28:58.223450899 CEST	443	49731	34.117.186.192	192.168.2.4
Apr 22, 2024 01:28:58.223562956 CEST	49731	443	192.168.2.4	34.117.186.192
Apr 22, 2024 01:28:58.226178885 CEST	49731	443	192.168.2.4	34.117.186.192
Apr 22, 2024 01:28:58.226201057 CEST	443	49731	34.117.186.192	192.168.2.4
Apr 22, 2024 01:28:58.226548910 CEST	443	49731	34.117.186.192	192.168.2.4
Apr 22, 2024 01:28:58.269516945 CEST	49731	443	192.168.2.4	34.117.186.192
Apr 22, 2024 01:28:58.805974960 CEST	49730	58709	192.168.2.4	147.45.47.93
Apr 22, 2024 01:28:58.938863039 CEST	49731	443	192.168.2.4	34.117.186.192
Apr 22, 2024 01:28:58.980144024 CEST	443	49731	34.117.186.192	192.168.2.4
Apr 22, 2024 01:28:59.032304049 CEST	58709	49730	147.45.47.93	192.168.2.4
Apr 22, 2024 01:28:59.074306011 CEST	443	49731	34.117.186.192	192.168.2.4
Apr 22, 2024 01:28:59.074489117 CEST	443	49731	34.117.186.192	192.168.2.4
Apr 22, 2024 01:28:59.074585915 CEST	49731	443	192.168.2.4	34.117.186.192
Apr 22, 2024 01:28:59.077487946 CEST	49731	443	192.168.2.4	34.117.186.192
Apr 22, 2024 01:28:59.077529907 CEST	443	49731	34.117.186.192	192.168.2.4
Apr 22, 2024 01:28:59.077578068 CEST	49731	443	192.168.2.4	34.117.186.192
Apr 22, 2024 01:28:59.077595949 CEST	443	49731	34.117.186.192	192.168.2.4
Apr 22, 2024 01:28:59.082017899 CEST	49730	58709	192.168.2.4	147.45.47.93
Apr 22, 2024 01:28:59.188054085 CEST	49732	443	192.168.2.4	172.67.75.166
Apr 22, 2024 01:28:59.188169003 CEST	443	49732	172.67.75.166	192.168.2.4
Apr 22, 2024 01:28:59.188285112 CEST	49732	443	192.168.2.4	172.67.75.166
Apr 22, 2024 01:28:59.188553095 CEST	49732	443	192.168.2.4	172.67.75.166
Apr 22, 2024 01:28:59.188579082 CEST	443	49732	172.67.75.166	192.168.2.4
Apr 22, 2024 01:28:59.417783022 CEST	443	49732	172.67.75.166	192.168.2.4
Apr 22, 2024 01:28:59.417907000 CEST	49732	443	192.168.2.4	172.67.75.166
Apr 22, 2024 01:28:59.421648026 CEST	49732	443	192.168.2.4	172.67.75.166
Apr 22, 2024 01:28:59.421680927 CEST	443	49732	172.67.75.166	192.168.2.4
Apr 22, 2024 01:28:59.422092915 CEST	443	49732	172.67.75.166	192.168.2.4
Apr 22, 2024 01:28:59.424979925 CEST	49732	443	192.168.2.4	172.67.75.166
Apr 22, 2024 01:28:59.468123913 CEST	443	49732	172.67.75.166	192.168.2.4
Apr 22, 2024 01:28:59.879900932 CEST	443	49732	172.67.75.166	192.168.2.4
Apr 22, 2024 01:28:59.880007982 CEST	443	49732	172.67.75.166	192.168.2.4
Apr 22, 2024 01:28:59.880323887 CEST	49732	443	192.168.2.4	172.67.75.166
Apr 22, 2024 01:28:59.880450964 CEST	49732	443	192.168.2.4	172.67.75.166
Apr 22, 2024 01:28:59.880498886 CEST	443	49732	172.67.75.166	192.168.2.4
Apr 22, 2024 01:28:59.880531073 CEST	49732	443	192.168.2.4	172.67.75.166
Apr 22, 2024 01:28:59.880546093 CEST	443	49732	172.67.75.166	192.168.2.4
Apr 22, 2024 01:28:59.881858110 CEST	49730	58709	192.168.2.4	147.45.47.93
Apr 22, 2024 01:29:00.128200054 CEST	58709	49730	147.45.47.93	192.168.2.4
Apr 22, 2024 01:29:00.175782919 CEST	49730	58709	192.168.2.4	147.45.47.93
Apr 22, 2024 01:29:00.207223892 CEST	49730	58709	192.168.2.4	147.45.47.93
Apr 22, 2024 01:29:00.442692041 CEST	58709	49730	147.45.47.93	192.168.2.4
Apr 22, 2024 01:29:00.488415003 CEST	49730	58709	192.168.2.4	147.45.47.93
Apr 22, 2024 01:29:00.535403967 CEST	49730	58709	192.168.2.4	147.45.47.93
Apr 22, 2024 01:29:00.775589943 CEST	58709	49730	147.45.47.93	192.168.2.4
Apr 22, 2024 01:29:00.775645971 CEST	58709	49730	147.45.47.93	192.168.2.4
Apr 22, 2024 01:29:00.775684118 CEST	58709	49730	147.45.47.93	192.168.2.4
Apr 22, 2024 01:29:00.775712967 CEST	49730	58709	192.168.2.4	147.45.47.93
Apr 22, 2024 01:29:00.775748968 CEST	58709	49730	147.45.47.93	192.168.2.4
Apr 22, 2024 01:29:00.775787115 CEST	58709	49730	147.45.47.93	192.168.2.4
Apr 22, 2024 01:29:00.775801897 CEST	49730	58709	192.168.2.4	147.45.47.93
Apr 22, 2024 01:29:00.775825024 CEST	58709	49730	147.45.47.93	192.168.2.4
Apr 22, 2024 01:29:00.775861025 CEST	58709	49730	147.45.47.93	192.168.2.4
Apr 22, 2024 01:29:00.775873899 CEST	49730	58709	192.168.2.4	147.45.47.93
Apr 22, 2024 01:29:00.775898933 CEST	58709	49730	147.45.47.93	192.168.2.4
Apr 22, 2024 01:29:00.775954962 CEST	49730	58709	192.168.2.4	147.45.47.93
Apr 22, 2024 01:29:00.775955915 CEST	58709	49730	147.45.47.93	192.168.2.4
Apr 22, 2024 01:29:00.775993109 CEST	58709	49730	147.45.47.93	192.168.2.4
Apr 22, 2024 01:29:00.776041031 CEST	49730	58709	192.168.2.4	147.45.47.93
Apr 22, 2024 01:29:00.995244980 CEST	58709	49730	147.45.47.93	192.168.2.4
Apr 22, 2024 01:29:00.995363951 CEST	58709	49730	147.45.47.93	192.168.2.4
Apr 22, 2024 01:29:00.995402098 CEST	58709	49730	147.45.47.93	192.168.2.4
Apr 22, 2024 01:29:00.995441914 CEST	58709	49730	147.45.47.93	192.168.2.4
Apr 22, 2024 01:29:00.995484114 CEST	58709	49730	147.45.47.93	192.168.2.4
Apr 22, 2024 01:29:00.995568037 CEST	49730	58709	192.168.2.4	147.45.47.93
Apr 22, 2024 01:29:00.995568037 CEST	49730	58709	192.168.2.4	147.45.47.93
Apr 22, 2024 01:29:01.035257101 CEST	49730	58709	192.168.2.4	147.45.47.93
Apr 22, 2024 01:29:01.082250118 CEST	49730	58709	192.168.2.4	147.45.47.93
Apr 22, 2024 01:29:01.316823006 CEST	58709	49730	147.45.47.93	192.168.2.4
Apr 22, 2024 01:29:01.363362074 CEST	49730	58709	192.168.2.4	147.45.47.93
Apr 22, 2024 01:29:01.410321951 CEST	49730	58709	192.168.2.4	147.45.47.93
Apr 22, 2024 01:29:01.644783020 CEST	58709	49730	147.45.47.93	192.168.2.4
Apr 22, 2024 01:29:01.691412926 CEST	49730	58709	192.168.2.4	147.45.47.93
Apr 22, 2024 01:29:16.984997988 CEST	49730	58709	192.168.2.4	147.45.47.93
Apr 22, 2024 01:29:16.985105991 CEST	49730	58709	192.168.2.4	147.45.47.93
Apr 22, 2024 01:29:17.203995943 CEST	58709	49730	147.45.47.93	192.168.2.4
Apr 22, 2024 01:29:17.204020023 CEST	58709	49730	147.45.47.93	192.168.2.4
Apr 22, 2024 01:29:17.204035044 CEST	58709	49730	147.45.47.93	192.168.2.4
Apr 22, 2024 01:29:17.204086065 CEST	49730	58709	192.168.2.4	147.45.47.93
Apr 22, 2024 01:29:17.468429089 CEST	58709	49730	147.45.47.93	192.168.2.4
Apr 22, 2024 01:29:20.019617081 CEST	49730	58709	192.168.2.4	147.45.47.93
Apr 22, 2024 01:29:20.238773108 CEST	58709	49730	147.45.47.93	192.168.2.4
Apr 22, 2024 01:29:20.250283003 CEST	58709	49730	147.45.47.93	192.168.2.4
Apr 22, 2024 01:29:20.250499010 CEST	49730	58709	192.168.2.4	147.45.47.93

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 22, 2024 01:28:57.871700048 CEST	63352	53	192.168.2.4	1.1.1.1
Apr 22, 2024 01:28:57.976252079 CEST	53	63352	1.1.1.1	192.168.2.4
Apr 22, 2024 01:28:59.079485893 CEST	53568	53	192.168.2.4	1.1.1.1
Apr 22, 2024 01:28:59.186819077 CEST	53	53568	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Apr 22, 2024 01:28:57.871700048 CEST	192.168.2.4	1.1.1.1	0xa835	Standard query (0)	ipinfo.io	A (IP address)	IN (0x0001)	false
Apr 22, 2024 01:28:59.079485893 CEST	192.168.2.4	1.1.1.1	0xfe74	Standard query (0)	db-ip.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Apr 22, 2024 01:28:57.976252079 CEST	1.1.1.1	192.168.2.4	0xa835	No error (0)	ipinfo.io	34.117.186.192	A (IP address)	IN (0x0001)	false
Apr 22, 2024 01:28:59.186819077 CEST	1.1.1.1	192.168.2.4	0xfe74	No error (0)	db-ip.com	172.67.75.166	A (IP address)	IN (0x0001)	false
Apr 22, 2024 01:28:59.186819077 CEST	1.1.1.1	192.168.2.4	0xfe74	No error (0)	db-ip.com	104.26.4.15	A (IP address)	IN (0x0001)	false
Apr 22, 2024 01:28:59.186819077 CEST	1.1.1.1	192.168.2.4	0xfe74	No error (0)	db-ip.com	104.26.5.15	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

https:

ipinfo.io

db-ip.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49731	34.117.186.192	443	2896	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-21 23:28:58 UTC	237	OUT	GET /widget/demo/81.181.57.52 HTTP/1.1 Connection: Keep-Alive Referer: https://ipinfo.io/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Host: ipinfo.io
2024-04-21 23:28:59 UTC	513	IN	HTTP/1.1 200 OK server: nginx/1.24.0 date: Sun, 21 Apr 2024 23:28:59 GMT content-type: application/json; charset=utf-8 Content-Length: 980 access-control-allow-origin: * x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff referrer-policy: strict-origin-when-cross-origin x-envoy-upstream-service-time: 2 via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-21 23:28:59 UTC	742	IN	Data Raw: 7b 0a 20 20 22 69 6e 70 75 74 22 3a 20 22 38 31 2e 31 38 31 2e 35 37 2e 35 32 22 2c 0a 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 22 69 70 22 3a 20 22 38 31 2e 31 38 31 2e 35 37 2e 35 32 22 2c 0a 20 20 20 20 22 63 69 74 79 22 3a 20 22 41 74 6c 61 6e 74 61 22 2c 0a 20 20 20 20 22 72 65 67 69 6f 6e 22 3a 20 22 47 65 6f 72 67 69 61 22 2c 0a 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 53 22 2c 0a 20 20 20 20 22 6c 6f 63 22 3a 20 22 33 33 2e 37 34 39 30 2c 2d 38 34 2e 33 38 38 30 22 2c 0a 20 20 20 20 22 6f 72 67 22 3a 20 22 41 53 32 31 32 32 33 38 20 44 61 74 61 63 61 6d 70 20 4c 69 6d 69 74 65 64 22 2c 0a 20 20 20 20 22 70 6f 73 74 61 6c 22 3a 20 22 33 30 33 30 32 22 2c 0a 20 20 20 20 22 74 69 6d 65 7a 6f 6e 65 22 3a 20 22 41 6d 65 72 69 63 61 2f Data Ascii: { "input": "81.181.57.52", "data": { "ip": "81.181.57.52", "city": "Atlanta", "region": "Georgia", "country": "US", "loc": "33.7490,-84.3880", "org": "AS212238 Datacamp Limited", "postal": "30302", "timezone": "America/
2024-04-21 23:28:59 UTC	238	IN	Data Raw: 61 64 64 72 65 73 73 22 3a 20 22 41 76 65 72 65 73 63 75 20 4d 61 72 65 73 61 6c 20 38 2d 31 30 2c 20 42 75 63 68 61 72 65 73 74 2c 20 52 6f 6d 61 6e 69 61 22 2c 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 52 4f 22 2c 0a 20 20 20 20 20 20 22 65 6d 61 69 6c 22 3a 20 22 61 62 75 73 65 2d 62 69 6e 62 6f 78 40 72 6e 63 2e 72 6f 22 2c 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 41 62 75 73 65 20 63 6f 6e 74 61 63 74 20 72 6f 6c 65 20 6f 62 6a 65 63 74 22 2c 0a 20 20 20 20 20 20 22 6e 65 74 77 6f 72 6b 22 3a 20 22 38 31 2e 31 38 31 2e 34 38 2e 30 2f 32 30 22 2c 0a 20 20 20 20 20 20 22 70 68 6f 6e 65 22 3a 20 22 2b 34 30 20 33 37 38 20 36 30 30 20 30 30 30 22 0a 20 20 20 20 7d 0a 20 20 7d 0a 7d Data Ascii: address": "Averescu Maresal 8-10, Bucharest, Romania", "country": "RO", "email": "abuse-binbox@rnc.ro", "name": "Abuse contact role object", "network": "81.181.48.0/20", "phone": "+40 378 600 000" } }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49732	172.67.75.166	443	2896	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-21 23:28:59 UTC	261	OUT	GET /demo/home.php?s=81.181.57.52 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Host: db-ip.com
2024-04-21 23:28:59 UTC	660	IN	HTTP/1.1 200 OK Date: Sun, 21 Apr 2024 23:28:59 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close x-iplb-request-id: AC454715:4710_93878F2E:0050_6625A13B_9387A70:4F34 x-iplb-instance: 59215 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Md0UKWXUvmeXLRB0U%2BLgS1O1PpSt6%2Fz92a%2B3pNZztNIj88Nh%2BqzdOBrgCXj51KOS3NCpUHWor0AOvai5O%2BgMSaYG6Nuy7fCr2wMz1rihH5%2FwMGK0HE9qhy05Yg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 878127548dfa672f-ATL alt-svc: h3=":443"; ma=86400
2024-04-21 23:28:59 UTC	699	IN	Data Raw: 32 62 34 0d 0a 7b 22 73 74 61 74 75 73 22 3a 22 6f 6b 22 2c 22 64 65 6d 6f 49 6e 66 6f 22 3a 7b 22 69 70 41 64 64 72 65 73 73 22 3a 22 38 31 2e 31 38 31 2e 35 37 2e 35 32 22 2c 22 63 6f 6e 74 69 6e 65 6e 74 43 6f 64 65 22 3a 22 4e 41 22 2c 22 63 6f 6e 74 69 6e 65 6e 74 4e 61 6d 65 22 3a 22 4e 6f 72 74 68 20 41 6d 65 72 69 63 61 22 2c 22 63 6f 75 6e 74 72 79 43 6f 64 65 22 3a 22 55 53 22 2c 22 63 6f 75 6e 74 72 79 4e 61 6d 65 22 3a 22 55 6e 69 74 65 64 20 53 74 61 74 65 73 22 2c 22 69 73 45 75 4d 65 6d 62 65 72 22 3a 66 61 6c 73 65 2c 22 63 75 72 72 65 6e 63 79 43 6f 64 65 22 3a 22 55 53 44 22 2c 22 63 75 72 72 65 6e 63 79 4e 61 6d 65 22 3a 22 44 6f 6c 6c 61 72 22 2c 22 70 68 6f 6e 65 50 72 65 66 69 78 22 3a 22 31 22 2c 22 6c 61 6e 67 75 61 67 65 73 22 3a Data Ascii: 2b4{"status":"ok","demoInfo":{"ipAddress":"81.181.57.52","continentCode":"NA","continentName":"North America","countryCode":"US","countryName":"United States","isEuMember":false,"currencyCode":"USD","currencyName":"Dollar","phonePrefix":"1","languages":
2024-04-21 23:28:59 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	01:28:51
Start date:	22/04/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x400000
File size:	997'888 bytes
MD5 hash:	5F30E027D147AF1DE92391F2E18644C8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000000.00000002.2008702665.000000000418E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000000.00000002.2009564997.0000000008CB9000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000000.00000002.2009091900.000000000459F000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2008702665.0000000004206000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000000.00000002.2009188631.0000000005ED0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	01:28:52
Start date:	22/04/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 2896 -s 784
Imagebase:	0xd00000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	01:28:54
Start date:	22/04/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 2896 -s 880
Imagebase:	0xd00000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	01:28:54
Start date:	22/04/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 2896 -s 912
Imagebase:	0xd00000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	01:28:55
Start date:	22/04/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 2896 -s 920
Imagebase:	0xd00000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	01:28:56
Start date:	22/04/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 2896 -s 980
Imagebase:	0xd00000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	01:28:57
Start date:	22/04/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 2896 -s 1332
Imagebase:	0xd00000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	01:29:00
Start date:	22/04/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 2896 -s 1772
Imagebase:	0xd00000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	01:29:01
Start date:	22/04/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 2896 -s 1772
Imagebase:	0xd00000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	01:29:02
Start date:	22/04/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 2896 -s 1880
Imagebase:	0xd00000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	01:29:03
Start date:	22/04/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 2896 -s 1920
Imagebase:	0xd00000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	01:29:04
Start date:	22/04/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 2896 -s 1932
Imagebase:	0xd00000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	01:29:06
Start date:	22/04/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 2896 -s 1960
Imagebase:	0xd00000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	01:29:08
Start date:	22/04/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 2896 -s 1776
Imagebase:	0xd00000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	01:29:09
Start date:	22/04/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 2896 -s 1972
Imagebase:	0xd00000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	01:29:10
Start date:	22/04/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 2896 -s 1916
Imagebase:	0xd00000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	01:29:11
Start date:	22/04/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 2896 -s 1760
Imagebase:	0xd00000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	01:29:12
Start date:	22/04/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 2896 -s 1880
Imagebase:	0xd00000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	01:29:12
Start date:	22/04/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 2896 -s 1892
Imagebase:	0xd00000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	11.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	19.9%
Total number of Nodes:	2000
Total number of Limit Nodes:	132

Executed Functions

Function 0045578C Relevance: 82.6, APIs: 39, Strings: 6, Instructions: 3900sleeplibraryloaderCOMMON

Download Yara Rule

APIs

CreateMutexA.KERNEL32(00000000,00000001,00000000), ref: 0045586E
GetLastError.KERNEL32 ref: 00455880
Sleep.KERNEL32(00000529), ref: 004558A5
Sleep.KERNEL32(0000002F), ref: 00455985
shutdown.WS2_32(00000002), ref: 004559A3
closesocket.WS2_32 ref: 004559AF
WSACleanup.WS2_32 ref: 004559B5
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00455A77
Sleep.KERNELBASE(00000065), ref: 00455CD9
Sleep.KERNEL32(00000000), ref: 00455D96
GetProcAddress.KERNEL32(00000000,?), ref: 004567CD
GetCurrentProcess.KERNEL32(00000000), ref: 004567DB
OutputDebugStringA.KERNELBASE(Dk43l_dwmk438*,?,00000018,0000000A,Function_000031C0,?,?,?,?,?,?,?,?,?,?), ref: 004567EF
OutputDebugStringA.KERNELBASE(ewetwertyer eytdryrtdy,?,?), ref: 004569BE
OutputDebugStringA.KERNEL32(td ydrthrhfty,?,?,?,?,?,?,?), ref: 00456F72

Strings

ewetwertyer eytdryrtdy, xrefs: 004569B4
Dk43l_dwmk438*, xrefs: 004567EA
ntdll.dll, xrefs: 004567B6
er ert 346 34634 6ch, xrefs: 00458D6B
td ydrthrhfty, xrefs: 00456F68
43t res tgy45yfhyrt, xrefs: 0045A290

Memory Dump Source

Source File: 00000000.00000002.2007216495.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007216495.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007216495.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Sleep$DebugOutputString$AddressCleanupCreateCurrentErrorLastMutexProcProcessUnothrow_t@std@@@__ehfuncinfo$??2@closesocketshutdown
String ID: 43t res tgy45yfhyrt$Dk43l_dwmk438*$er ert 346 34634 6ch$ewetwertyer eytdryrtdy$ntdll.dll$td ydrthrhfty
API String ID: 3261302857-3574556348
Opcode ID: 80741dde7cb54c13108023b5ba987e2ca95ace5b307270e7db37f7bfc9f11f61
Instruction ID: b7004e79db67d020d65fac00f85910b7803af71aabf98f32d17772c606b18a4d
Opcode Fuzzy Hash: 80741dde7cb54c13108023b5ba987e2ca95ace5b307270e7db37f7bfc9f11f61
Instruction Fuzzy Hash: 74A302B45083818FC335CF19C491AABBBE1BFD8344F54495EE8899B352DB34A949CF86

Uniqueness

Uniqueness Score: -1.00%

Function 00453C30 Relevance: 68.1, APIs: 33, Strings: 5, Instructions: 1568sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00000025), ref: 00453C44

Part of subcall function 004E2FA0: __Xtime_get_ticks.LIBCPMT ref: 004E2FA1
Part of subcall function 004E2FA0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 004E2FAF

GetCurrentProcess.KERNEL32(00008000,00000000,00000000,00000001,00000000,00000000,00000001,00000000,00000000,00000001), ref: 00453DCD
SetPriorityClass.KERNELBASE(00000000), ref: 00453DD4
SetUnhandledExceptionFilter.KERNEL32(0045A780), ref: 00453DDF

Strings

Dk43l_dwmk438*, xrefs: 004567EA
147.45.47.93:58709, xrefs: 00453CE7
131, xrefs: 00453CA1, 00453CC4
er ert 346 34634 6ch, xrefs: 00458D6B
43t res tgy45yfhyrt, xrefs: 0045A290

Memory Dump Source

Source File: 00000000.00000002.2007216495.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007216495.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007216495.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ClassCurrentExceptionFilterPriorityProcessSleepUnhandledUnothrow_t@std@@@Xtime_get_ticks__ehfuncinfo$??2@
String ID: 131$147.45.47.93:58709$43t res tgy45yfhyrt$Dk43l_dwmk438*$er ert 346 34634 6ch
API String ID: 1211644118-3950233817
Opcode ID: 0ac0a5490fc185f1bf0b204bcce8c132e5f6f89f1fc6e605dcb6ff368d608395
Instruction ID: 58df280d1c5bcf31294a4ea42ed0208b52652377ae8c263acff41185647b5a58
Opcode Fuzzy Hash: 0ac0a5490fc185f1bf0b204bcce8c132e5f6f89f1fc6e605dcb6ff368d608395
Instruction Fuzzy Hash: F70326B45083829FC324DF29C491AABBBE4FFD8345F40491EE98997352DB30A549CF96

Uniqueness

Uniqueness Score: -1.00%

Function 004091BF Relevance: 49.3, APIs: 25, Strings: 1, Instructions: 3810COMMON

Download Yara Rule

APIs

Part of subcall function 004F2F40: GetModuleHandleA.KERNEL32(?), ref: 004F3048
Part of subcall function 004F2F40: GetProcAddress.KERNEL32(00000000,?), ref: 004F3053

CreateDirectoryA.KERNELBASE(00000000,00000000,?), ref: 0040A601

Strings

U5I, xrefs: 0040C4E4

Memory Dump Source

Source File: 00000000.00000002.2007216495.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007216495.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007216495.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: AddressCreateDirectoryHandleModuleProc
String ID: U5I
API String ID: 2385557062-2587217555
Opcode ID: 917595ce0c92c6884b07a30600ae673a975f8174c60f98ae381c5ae076f0d1ba
Instruction ID: 4cdd386919e838af970f59fa8ac5a494f476b57722eda99af27e3df303c9e173
Opcode Fuzzy Hash: 917595ce0c92c6884b07a30600ae673a975f8174c60f98ae381c5ae076f0d1ba
Instruction Fuzzy Hash: EAA3DFB4D052689BDB25CFA9D991ADDFBB0BF48304F1081DAE849B7341DB306A84CF65

Uniqueness

Uniqueness Score: -1.00%

Function 0049D110 Relevance: 41.6, APIs: 18, Strings: 4, Instructions: 3107registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNELBASE(80000001,?,00000000,00020019,?,?,?,?,?,?,?,?,?), ref: 0049D33D
RegEnumKeyA.ADVAPI32(?,00000000,?,00000104), ref: 0049D374
RegOpenKeyExA.ADVAPI32(?,?,00000000,00020019,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 0049D39A
RegQueryValueExA.ADVAPI32(00000000,?,00000000,00000001,?,?), ref: 0049D53A
RegQueryValueExA.ADVAPI32(00000000,?,00000000,00000001,?,00000104), ref: 0049D7A8
RegQueryValueExA.ADVAPI32(00000000,?,00000000,00000001,?,?), ref: 0049D895
RegQueryValueExA.ADVAPI32(00000000,?,00000000,00000003,?,?), ref: 0049D9D6
RegQueryValueExA.ADVAPI32(00000000,?,00000000,00000003,?,?), ref: 0049DAC3
RegQueryValueExA.ADVAPI32(00000000,?,00000000,00000003,?,?), ref: 0049DBB0
RegQueryValueExA.ADVAPI32(00000000,?,00000000,00000003,?,?), ref: 0049DC9D

Part of subcall function 0042FC4B: RaiseException.KERNEL32(E06D7363,00000001,00000003,00417EFB,?,?,?,0042C598,00417EFB,005784EC,?,00417EFB), ref: 0042FCAB

RegCloseKey.ADVAPI32(00000000), ref: 0049EE67
RegEnumKeyA.ADVAPI32(?,00000001,?,00000104), ref: 0049EEA0
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 0049EEB4

Strings

invalid stoi argument, xrefs: 004A002F
cannot use operator[] with a string argument with , xrefs: 0049EF75
stoi argument out of range, xrefs: 004A0025
cannot use push_back() with , xrefs: 0049EF16

Memory Dump Source

Source File: 00000000.00000002.2007216495.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007216495.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007216495.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: QueryValue$CloseEnumOpen$ExceptionRaise
String ID: cannot use operator[] with a string argument with $cannot use push_back() with $invalid stoi argument$stoi argument out of range
API String ID: 2021570681-1606007317
Opcode ID: 676ef7a70a303ec808f10bcd67f5a21b0b6396324d99fca486544f797c673394
Instruction ID: 57cc1c8c03c56a0844d741e814d2024dbcff269c685614372db8ad591986b9b7
Opcode Fuzzy Hash: 676ef7a70a303ec808f10bcd67f5a21b0b6396324d99fca486544f797c673394
Instruction Fuzzy Hash: 726336B4D002689FDB25CF68C885BEEBBB5BF49304F1481EAE449A7341DB346A85CF54

Uniqueness

Uniqueness Score: -1.00%

Function 0045504E Relevance: 30.3, APIs: 16, Strings: 1, Instructions: 544sleepsynchronizationthreadCOMMON

Download Yara Rule

APIs

CreateThread.KERNELBASE(00000000,00000000,Function_000D23C0,00000000,00000000,00000000), ref: 0045518C
FindCloseChangeNotification.KERNELBASE(00000000), ref: 00455193
Sleep.KERNELBASE(00000001), ref: 00455259
GetTempPathA.KERNELBASE(000000FC,?,?), ref: 00455358

Part of subcall function 004F2CD0: GetFileAttributesA.KERNELBASE(?,?,?,0055A5B3,000000FF), ref: 004F2D0C
Part of subcall function 004F2CD0: GetLastError.KERNEL32(?,?,0055A5B3,000000FF), ref: 004F2D17

Part of subcall function 004F2870: FindFirstFileA.KERNELBASE(?,?,00588E90,?,?,?,\*.*,00000004), ref: 004F298C

Part of subcall function 004F2870: FindNextFileA.KERNELBASE(00000000,00000010), ref: 004F2B28
Part of subcall function 004F2870: FindClose.KERNEL32(00000000), ref: 004F2B38
Part of subcall function 004F2870: GetLastError.KERNEL32 ref: 004F2B3E

CreateDirectoryA.KERNELBASE(00000000,00000000), ref: 00455601
CreateDirectoryA.KERNELBASE(00000000,00000000), ref: 00455628

Part of subcall function 00407B10: GetFileAttributesA.KERNEL32(?,7FFFFFFF,?,?,?,?,00000000,00558869,000000FF,?,?,00000000,00000001), ref: 00407B6A
Part of subcall function 00407B10: CreateDirectoryA.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,00000000,00558869,000000FF,?,?,00000000), ref: 00407BF2

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0045563F
OutputDebugStringA.KERNELBASE(43t res tgy45yfhyrt), ref: 0045A295
CreateMutexA.KERNEL32(00000000,00000001,00000000), ref: 0045A407
GetLastError.KERNEL32 ref: 0045A419
Sleep.KERNEL32(00007530), ref: 0045A435

Strings

43t res tgy45yfhyrt, xrefs: 0045A290

Memory Dump Source

Source File: 00000000.00000002.2007216495.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007216495.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007216495.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Create$FileFind$DirectoryErrorLast$AttributesCloseSleep$ChangeDebugFirstMutexNextNotificationOutputPathStringTempThreadUnothrow_t@std@@@__ehfuncinfo$??2@
String ID: 43t res tgy45yfhyrt
API String ID: 2654281156-696058833
Opcode ID: bbbbf47c8a5e06c1d7690fa1e27cfe45ee61c4ba94deedae21c20f28b54deb4a
Instruction ID: 9c8f78141530d7c3e3186ab54bd11a1a12a778bbd7b21b6fbf1c18c7b6f6a787
Opcode Fuzzy Hash: bbbbf47c8a5e06c1d7690fa1e27cfe45ee61c4ba94deedae21c20f28b54deb4a
Instruction Fuzzy Hash: 52425AB45093819FC324DF29C491AAEBBE1FFD8344F40491EE98997352DB34A949CF86

Uniqueness

Uniqueness Score: -1.00%

Function 004F2870 Relevance: 26.6, APIs: 14, Strings: 1, Instructions: 351
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileA.KERNELBASE(?,?,00588E90,?,?,?,\*.*,00000004), ref: 004F298C
SetFileAttributesA.KERNEL32(?,00000080,?,?,00588E90,?,?), ref: 004F2AFC
DeleteFileA.KERNEL32(?), ref: 004F2B16
FindNextFileA.KERNELBASE(00000000,00000010), ref: 004F2B28
FindClose.KERNEL32(00000000), ref: 004F2B38
GetLastError.KERNEL32 ref: 004F2B3E
SetFileAttributesA.KERNELBASE(?,00000080), ref: 004F2B5B
RemoveDirectoryA.KERNELBASE(?), ref: 004F2B79
GetLastError.KERNEL32 ref: 004F2B8E
std::_Throw_Cpp_error.LIBCPMT ref: 004F2C46
std::_Throw_Cpp_error.LIBCPMT ref: 004F2C57
CreateDirectoryA.KERNELBASE(?,00000000,00000005), ref: 004F2C92
std::_Throw_Cpp_error.LIBCPMT ref: 004F2CAD
std::_Throw_Cpp_error.LIBCPMT ref: 004F2CBE

Strings

\*.*, xrefs: 004F291D

Memory Dump Source

Source File: 00000000.00000002.2007216495.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007216495.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007216495.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: File$Cpp_errorThrow_std::_$Find$AttributesDirectoryErrorLast$CloseCreateDeleteFirstNextRemove
String ID: \*.*
API String ID: 2701998425-1173974218
Opcode ID: 3f1b56a47a2a23220f003d827ea7f97c620c789100f4a682782f552b8e55963f
Instruction ID: 6c1dec9a71fc218d50f2f533adda7eb018bfb0a0a602ed1d80391e42354044fb
Opcode Fuzzy Hash: 3f1b56a47a2a23220f003d827ea7f97c620c789100f4a682782f552b8e55963f
Instruction Fuzzy Hash: 37C17830D002089BDB24DF68CD897FEBBB5EF15314F14421AE944A7392DBB8AA85CB55

Uniqueness

Uniqueness Score: -1.00%

Function 004CC610 Relevance: 23.1, APIs: 1, Strings: 11, Instructions: 2064COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,8C8DEFFF), ref: 004CC77E

Part of subcall function 004D0620: FindFirstFileA.KERNELBASE(?,?,?,?,?,00000000,?,?), ref: 004D0771

Strings

I, xrefs: 004CE325
cannot use operator[] with a string argument with , xrefs: 004D05DB
$r(, xrefs: 004CEAFF
cannot use push_back() with , xrefs: 004D057C
MjL, xrefs: 004CEA4F
fGVm, xrefs: 004CEC8B
I, xrefs: 004CD2EF
xH>, xrefs: 004CEAA7
k>2, xrefs: 004CEC33
fGVm, xrefs: 004CEF51
I, xrefs: 004CE4DA

Memory Dump Source

Source File: 00000000.00000002.2007216495.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007216495.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007216495.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: FileFindFirstFolderPath
String ID: $r($MjL$cannot use operator[] with a string argument with $cannot use push_back() with $fGVm$fGVm$k>2$xH>$I$I$I
API String ID: 2195519125-3021718430
Opcode ID: ac6d604072661fe4c4676738c85422ba399c9a1032f14f84be955ce2e61e24eb
Instruction ID: 58fff7fa39e1a7d59a690a9eb2d20e9a3d742f11dd313cf94c949deb9fb380dd
Opcode Fuzzy Hash: ac6d604072661fe4c4676738c85422ba399c9a1032f14f84be955ce2e61e24eb
Instruction Fuzzy Hash: 5143DAB4D052688BDB65CF68C991BDDBBB5BF48304F1081DAE809BB281DB346E84CF55

Uniqueness

Uniqueness Score: -1.00%

Function 0045B010 Relevance: 20.2, APIs: 12, Instructions: 2241COMMON

Download Yara Rule

APIs

Part of subcall function 004091BF: CreateDirectoryA.KERNELBASE(00000000,00000000,?), ref: 0040A601

CreateDirectoryA.KERNELBASE(?,00000000), ref: 0045B14B
CreateDirectoryA.KERNEL32(0000000F,00000000,?,?), ref: 0045B6CD
CreateDirectoryA.KERNEL32(0000000F,00000000,0000000F,00000000,?,?), ref: 0045B8E9
CreateDirectoryA.KERNEL32(?,00000000,?,0000000F,00000000,?,?), ref: 0045BA77
CreateDirectoryA.KERNELBASE(?,00000000), ref: 0045C326
GetFileAttributesA.KERNEL32(00000000,?,?,?,?,?), ref: 0045C8B2
GetLastError.KERNEL32(?,?,?,?,?), ref: 0045C8BD

Part of subcall function 0042D43A: ReleaseSRWLockExclusive.KERNEL32(004F2D39), ref: 0042D44E

CreateDirectoryA.KERNEL32(?,00000000,?,?), ref: 0045C90D
CreateDirectoryA.KERNEL32(00000000,00000000,?,?,6F2977B7,?,00000000,00000000,?,?,?,?,?,?,?,?), ref: 0045CB49
CreateDirectoryA.KERNEL32(00000000,00000000,6F2977B7,?,?,6F2977B7,?,00000000,00000000,?,?,?,?,?,?,6F2977B7), ref: 0045D1EF
std::_Throw_Cpp_error.LIBCPMT ref: 0045DB22
std::_Throw_Cpp_error.LIBCPMT ref: 0045DB33

Memory Dump Source

Source File: 00000000.00000002.2007216495.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007216495.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007216495.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CreateDirectory$Cpp_errorThrow_std::_$AttributesErrorExclusiveFileLastLockRelease
String ID:
API String ID: 4067333799-0
Opcode ID: 6c67059c5e63add424eb0f0712fba8c52b150270e0a7de0dffa12fca63891b96
Instruction ID: 68c8495f6346b6796ce830d8594ba972bb16e4ec352a3aae9e85973fddee60a8
Opcode Fuzzy Hash: 6c67059c5e63add424eb0f0712fba8c52b150270e0a7de0dffa12fca63891b96
Instruction Fuzzy Hash: E1334770D042689BDB25CF68CD847EDBBB5BF49304F1082DAE849A7242DB346E89CF55

Uniqueness

Uniqueness Score: -1.00%

Function 00453E0C Relevance: 20.2, APIs: 9, Strings: 2, Instructions: 911libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?), ref: 00453EDB
GetModuleFileNameA.KERNEL32(00000000,?,00000200,?,?,?,00000000), ref: 00454150
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 004545B7

Strings

}Y5, xrefs: 00453F93
0Dl, xrefs: 00454124

Memory Dump Source

Source File: 00000000.00000002.2007216495.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007216495.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007216495.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: FileLibraryLoadModuleNameUnothrow_t@std@@@__ehfuncinfo$??2@
String ID: 0Dl$}Y5
API String ID: 930999232-1570795750
Opcode ID: 21cceb69790c5630be04a10a755475bbac4ffb76be7b30abaaa74e4562c39815
Instruction ID: 10a045a72fdef8fbde72ed29e00345329cee5710bca7ea7815d978a91b3df7d8
Opcode Fuzzy Hash: 21cceb69790c5630be04a10a755475bbac4ffb76be7b30abaaa74e4562c39815
Instruction Fuzzy Hash: CEA21BB45083828FC324CF19C49069AFBE1FFD9344F15491EE9999B352DB30A989CF96

Uniqueness

Uniqueness Score: -1.00%

Function 004D23C0 Relevance: 18.4, APIs: 12, Instructions: 351
networksleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

setsockopt.WS2_32(00000338,0000FFFF,00001006,?,00000008), ref: 004D2466
recv.WS2_32(?,00000004,00000002), ref: 004D2481
WSAGetLastError.WS2_32 ref: 004D2485
recv.WS2_32(00000000,0000000C,00000002,0000000C), ref: 004D24EE
recv.WS2_32(00000000,0000000C,00000008), ref: 004D250F
setsockopt.WS2_32(0000FFFF,00001006,?,00000008,?), ref: 004D258B
recv.WS2_32(00000000,?,00000008), ref: 004D25AC

Part of subcall function 004D3150: WSAStartup.WS2_32 ref: 004D317A
Part of subcall function 004D3150: getaddrinfo.WS2_32(?,?,?,00588CC0), ref: 004D31FC
Part of subcall function 004D3150: socket.WS2_32(?,?,?), ref: 004D321D
Part of subcall function 004D3150: connect.WS2_32(00000000,0055F6D1,?), ref: 004D3231
Part of subcall function 004D3150: closesocket.WS2_32(00000000), ref: 004D323D
Part of subcall function 004D3150: freeaddrinfo.WS2_32(?,?,?,?,00588CC0,?,?), ref: 004D324A
Part of subcall function 004D3150: WSACleanup.WS2_32 ref: 004D3250

recv.WS2_32(?,00000004,00000008), ref: 004D27D6
__Xtime_get_ticks.LIBCPMT ref: 004D27DA
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 004D27E8
Sleep.KERNELBASE(00000001,00000000,?,00002710,00000000), ref: 004D284F
Sleep.KERNELBASE(00000064,?,00002710,00000000), ref: 004D285D

Memory Dump Source

Source File: 00000000.00000002.2007216495.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007216495.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007216495.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: recv$Sleepsetsockopt$CleanupErrorLastStartupUnothrow_t@std@@@Xtime_get_ticks__ehfuncinfo$??2@closesocketconnectfreeaddrinfogetaddrinfosocket
String ID:
API String ID: 4125349891-0
Opcode ID: 0faf3052afb1c00782cdab9ebe53fd988e07a330ab3ea123e73c5a32e3e42a17
Instruction ID: 15ea99ae058cf58d21446cf462f8f8b9c5c04bab4b96d95aa166a16db5b48a04
Opcode Fuzzy Hash: 0faf3052afb1c00782cdab9ebe53fd988e07a330ab3ea123e73c5a32e3e42a17
Instruction Fuzzy Hash: 55E13230900244DFDB15DBA4CDA07ADBBF1BF66310F24425BE841AB2D2DBB45C8ADB95

Uniqueness

Uniqueness Score: -1.00%

Function 0040F27E Relevance: 15.1, APIs: 6, Strings: 2, Instructions: 1141
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004EC100: FindFirstFileA.KERNEL32(00000000,?,?,?,0040EE72,?,?,?,74DF3100,00000000), ref: 004EC2D1

Part of subcall function 004EC100: CreateDirectoryA.KERNEL32(00000000,00000000,0000002E,0000002F,?,?,?,?,0056AD5C,00000001,0000002E,0000002F,?,?), ref: 004EC51B

CopyFileA.KERNEL32(00000000,00000000,00000000), ref: 0040F987
CopyFileA.KERNEL32(00000000,00000000,00000000), ref: 0041005B
CreateDirectoryA.KERNELBASE(00000000,00000000), ref: 004101B0
CopyFileA.KERNEL32(00000000,00000000,00000000), ref: 004105C4
CreateDirectoryA.KERNELBASE(00000000,00000000), ref: 0040FACA

Part of subcall function 004F2870: FindFirstFileA.KERNELBASE(?,?,00588E90,?,?,?,\*.*,00000004), ref: 004F298C

Part of subcall function 004D0620: FindFirstFileA.KERNELBASE(?,?,?,?,?,00000000,?,?), ref: 004D0771

Strings

R, xrefs: 0040F29A
O, xrefs: 0040F9D8

Memory Dump Source

Source File: 00000000.00000002.2007216495.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007216495.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007216495.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: File$CopyCreateDirectoryFindFirst
String ID: O$R
API String ID: 373589188-4027237009
Opcode ID: 6ff6d5013c8434a8ee4947cc14be3fe5061ef08630dbc4a813d58d2dd30fbd95
Instruction ID: 017b9f8166701b81c76e149bd8a39be73d8c81c57d3f3376f9e00ba9977ba801
Opcode Fuzzy Hash: 6ff6d5013c8434a8ee4947cc14be3fe5061ef08630dbc4a813d58d2dd30fbd95
Instruction Fuzzy Hash: A0E2C1B4D1426C9BCB24CFA9D891ADDBBB0BF48308F4081DAE819B7351EB345A85CF55

Uniqueness

Uniqueness Score: -1.00%

Function 0040EFAF Relevance: 13.5, APIs: 6, Strings: 1, Instructions: 1248
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

O, xrefs: 0040F9D8

Memory Dump Source

Source File: 00000000.00000002.2007216495.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007216495.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007216495.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: AttributesErrorFileLast
String ID: O
API String ID: 1799206407-878818188
Opcode ID: 6b37fd79ffc1c9e46e022225280fd59d41bce1fa78d96697caf820a1ef18fd7c
Instruction ID: a1bdfb379abbadc3b7a25386895afbd508209c9c3625fe49d26d3726bebe9a46
Opcode Fuzzy Hash: 6b37fd79ffc1c9e46e022225280fd59d41bce1fa78d96697caf820a1ef18fd7c
Instruction Fuzzy Hash: 9FF2C0B8D1426C9BCB24CFA9D891ADDFBB0BF48304F4081AAE819B7351DB345A85CF55

Uniqueness

Uniqueness Score: -1.00%

Function 00516730 Relevance: 12.0, Strings: 9, Instructions: 760COMMON

Download Yara Rule

Strings

%s.%s, xrefs: 00516ECA
no such table: %s, xrefs: 00517059
, xrefs: 00516EBB
sqlite_subquery_%p_, xrefs: 00516858
no such table, xrefs: 005169CD, 005169ED
%s: %s.%s, xrefs: 005169D2
%s: %s, xrefs: 005169F2
no tables specified, xrefs: 00517069
too many columns in result set, xrefs: 005170BB

Memory Dump Source

Source File: 00000000.00000002.2007216495.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007216495.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007216495.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID: $%s.%s$%s: %s$%s: %s.%s$no such table$no such table: %s$no tables specified$sqlite_subquery_%p_$too many columns in result set
API String ID: 0-1803442545
Opcode ID: ed3eb76e38432dfcf2c41c3c2ff9c64b0abde587c075ee60f4f1a0e99f832519
Instruction ID: dbcf86031569527fedc52a40f5d4d288d03f0ee8d1881843e8073522b91ea1c3
Opcode Fuzzy Hash: ed3eb76e38432dfcf2c41c3c2ff9c64b0abde587c075ee60f4f1a0e99f832519
Instruction Fuzzy Hash: DE626F746043428FE720DF28C484B9ABFE1BF88314F14896DE8999B352E775ED85CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00409010 Relevance: 11.5, APIs: 5, Strings: 1, Instructions: 1046COMMON

Download Yara Rule

APIs

Part of subcall function 004F2F40: GetModuleHandleA.KERNEL32(?), ref: 004F3048
Part of subcall function 004F2F40: GetProcAddress.KERNEL32(00000000,?), ref: 004F3053

CreateDirectoryA.KERNELBASE(00000000,00000000,?), ref: 0040A601

Strings

cannot use operator[] with a string argument with , xrefs: 0040A47B

Memory Dump Source

Source File: 00000000.00000002.2007216495.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007216495.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007216495.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: AddressCreateDirectoryHandleModuleProc
String ID: cannot use operator[] with a string argument with
API String ID: 2385557062-2766135566
Opcode ID: f03af19c7f16ad732d3f9550e3d4c6533829a0b28d9025b2e739b9ffc88b3ed4
Instruction ID: ded7b3acff67d6fc93a9f934a04086679630f068c6daeca2e519d3ea19527e87
Opcode Fuzzy Hash: f03af19c7f16ad732d3f9550e3d4c6533829a0b28d9025b2e739b9ffc88b3ed4
Instruction Fuzzy Hash: 74C210B4D042689BDB25CF58C984BDDBBB0BF58304F1481DAE849B7381DB746A84CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 004F6660 Relevance: 11.4, APIs: 2, Strings: 4, Instructions: 909COMMON

Download Yara Rule

APIs

Part of subcall function 00424C30: ___std_fs_convert_narrow_to_wide@20.LIBCPMT ref: 00424CC9
Part of subcall function 00424C30: ___std_fs_convert_narrow_to_wide@20.LIBCPMT ref: 00424D11

GetFileAttributesA.KERNELBASE(?), ref: 004F6A45
std::ios_base::_Ios_base_dtor.LIBCPMT ref: 004F7081

Strings

@G@, xrefs: 004F7077
status, xrefs: 004F7251
.zip, xrefs: 004F677F
recursive_directory_iterator::recursive_directory_iterator, xrefs: 004F7267

Memory Dump Source

Source File: 00000000.00000002.2007216495.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007216495.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007216495.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ___std_fs_convert_narrow_to_wide@20$AttributesFileIos_base_dtorstd::ios_base::_
String ID: .zip$@G@$recursive_directory_iterator::recursive_directory_iterator$status
API String ID: 3330089674-1374571796
Opcode ID: a254c811bd66006a2e106c1ce27d34735d39606b8b5d0ca17b880f5d563773b2
Instruction ID: 5c112c02936b25d4fb78ed62e4cf61e9fc9cdc42541c04c932bd90300030b25b
Opcode Fuzzy Hash: a254c811bd66006a2e106c1ce27d34735d39606b8b5d0ca17b880f5d563773b2
Instruction Fuzzy Hash: 8482CE70D002588FDB14DF68C884BEEBBB1BF55304F1441AEE549A7292DB38AE85CF95

Uniqueness

Uniqueness Score: -1.00%

Function 005209F0 Relevance: 11.3, Strings: 8, Instructions: 1305COMMON

Download Yara Rule

Strings

WITHOUT ROWID, xrefs: 00520A2C, 00520A51, 00520A54
library routine called out of sequence, xrefs: 0052191B, 0052196F
out of memory, xrefs: 00521990, 00521A00
d, xrefs: 00520D79
WITHOUT ROWID, xrefs: 00520A83, 00520AA7
unknown error, xrefs: 005219C4, 00521A34
pkU, xrefs: 0052117C, 005214F8, 0052180A
hU, xrefs: 00520BD1, 00520DE9, 00520E11, 00521172, 005214EE, 00521800, 00521981, 005219F1

Memory Dump Source

Source File: 00000000.00000002.2007216495.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007216495.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007216495.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID: WITHOUT ROWID$WITHOUT ROWID$d$library routine called out of sequence$out of memory$pkU$unknown error$hU
API String ID: 0-3288033085
Opcode ID: 068cd0329f20d8736a8f955442bc76b3a7b22ac43507fa51aa49c9a64e506910
Instruction ID: 497802968e842dde83b933efc766fcc9b30b40c45d497888dbf4db774b5c934f
Opcode Fuzzy Hash: 068cd0329f20d8736a8f955442bc76b3a7b22ac43507fa51aa49c9a64e506910
Instruction Fuzzy Hash: 5CB2CF70605B52DFC728CF28E494A6BBBF1BF96304F14492DE88A97391D731E845CB86

Uniqueness

Uniqueness Score: -1.00%

Function 0045A5C0 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 156
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCursorPos.USER32(?), ref: 0045A5D3
GetCursorPos.USER32(?), ref: 0045A5D9
Sleep.KERNELBASE(000003E9,?,?,?,?,?,?,?,?,?,?,?,00453DEA), ref: 0045A688
GetCursorPos.USER32(?), ref: 0045A68E
Sleep.KERNELBASE(00000001,?,?,?,?,?,?,?,?,?,?,?,00453DEA), ref: 0045A73A

Strings

=E, xrefs: 0045A720, 0045A668

Memory Dump Source

Source File: 00000000.00000002.2007216495.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007216495.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007216495.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Cursor$Sleep
String ID: =E
API String ID: 1847515627-2289002813
Opcode ID: 87aaf06eb3feef4bfb938811ad3031e6b1e2923ec5a892cc3e26860d6edd803d
Instruction ID: 823f227e19ebc1f4262c84ee3b7a9e46c16cc5b48225767440be61142120e435
Opcode Fuzzy Hash: 87aaf06eb3feef4bfb938811ad3031e6b1e2923ec5a892cc3e26860d6edd803d
Instruction Fuzzy Hash: B151CC35A00215CFCB18CF58C4C4EAAB7B1FF49705F19429AD945AB312D739ED1ACB81

Uniqueness

Uniqueness Score: -1.00%

Function 004B36B0 Relevance: 10.4, APIs: 1, Strings: 4, Instructions: 1610COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?), ref: 004B384B

Part of subcall function 0041A800: ___std_exception_destroy.LIBVCRUNTIME ref: 0041A959

Strings

cannot use operator[] with a string argument with , xrefs: 004B5E3C
I, xrefs: 004B4A04
I, xrefs: 004B4BB9
I, xrefs: 004B40FA

Memory Dump Source

Source File: 00000000.00000002.2007216495.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007216495.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007216495.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: FolderPath___std_exception_destroy
String ID: cannot use operator[] with a string argument with $I$I$I
API String ID: 3548636424-122575368
Opcode ID: c6eec8c008951a87c4008fa0c80814e9d5c82aea64a0d09529715c28e4b507bf
Instruction ID: df9c875d8cc877c3b3a93ee254c84c4b376f22100dfb1a1e0afc37ba53127f04
Opcode Fuzzy Hash: c6eec8c008951a87c4008fa0c80814e9d5c82aea64a0d09529715c28e4b507bf
Instruction Fuzzy Hash: 2803F0B4D002689BDB29CF68D980BDDBBB5AF49304F1481DAE449BB341DB346E85CF64

Uniqueness

Uniqueness Score: -1.00%

Function 0040D468 Relevance: 9.4, APIs: 4, Strings: 1, Instructions: 697
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

0, xrefs: 0040DE68

Memory Dump Source

Source File: 00000000.00000002.2007216495.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007216495.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007216495.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: AttributesErrorFileLast
String ID: 0
API String ID: 1799206407-4108050209
Opcode ID: 20c5174ce98549ec0c6dd1ca7c0aa0ae184400a2f8ba70ec022d77deb839179e
Instruction ID: d3553316db2c8dc36a3c53aaf8957dde30e24de572f0d1dfc5b1ab8cdc92ac15
Opcode Fuzzy Hash: 20c5174ce98549ec0c6dd1ca7c0aa0ae184400a2f8ba70ec022d77deb839179e
Instruction Fuzzy Hash: 9F82D1B4D1526C9BDB25DFA9D881ADCFBB4BF58304F0081AAE819B7341DB346A84CF54

Uniqueness

Uniqueness Score: -1.00%

Function 0040D5B3 Relevance: 9.4, APIs: 4, Strings: 1, Instructions: 643
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004F2CD0: GetFileAttributesA.KERNELBASE(?,?,?,0055A5B3,000000FF), ref: 004F2D0C
Part of subcall function 004F2CD0: GetLastError.KERNEL32(?,?,0055A5B3,000000FF), ref: 004F2D17

CreateDirectoryA.KERNELBASE(00000000,00000000,?), ref: 0040DFB6

Part of subcall function 004D0620: FindFirstFileA.KERNELBASE(?,?,?,?,?,00000000,?,?), ref: 004D0771

CopyFileA.KERNEL32(00000000,00000000,00000000), ref: 0040D861
CreateDirectoryA.KERNEL32(00000000,00000000), ref: 0040DA53

Strings

0, xrefs: 0040DE68

Memory Dump Source

Source File: 00000000.00000002.2007216495.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007216495.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007216495.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: File$CreateDirectory$AttributesCopyErrorFindFirstLast
String ID: 0
API String ID: 1992414881-4108050209
Opcode ID: 3e68c3b3d457e3452e11eb820172a8cb170b5eb6bc13edacf9ab9f801514a970
Instruction ID: ec346d06faf5f83f79fa264e4de1f910cfb6169a76344738abf340e848d07b8c
Opcode Fuzzy Hash: 3e68c3b3d457e3452e11eb820172a8cb170b5eb6bc13edacf9ab9f801514a970
Instruction Fuzzy Hash: AD72D1B4D152689BDB25DFA9D881ADCFBB4BF58304F0081EAE819B7341DB346A84CF54

Uniqueness

Uniqueness Score: -1.00%

Function 0040CA55 Relevance: 9.3, APIs: 4, Strings: 1, Instructions: 509
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CopyFileA.KERNEL32(00000000,00000000,00000000), ref: 0040CC14
CreateDirectoryA.KERNELBASE(00000000,00000000), ref: 0040CD14
CopyFileA.KERNEL32(00000000,00000000,00000000), ref: 0040D1DD
CreateDirectoryA.KERNELBASE(00000000,00000000), ref: 0040D332

Strings

!, xrefs: 0040CC49

Memory Dump Source

Source File: 00000000.00000002.2007216495.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007216495.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007216495.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CopyCreateDirectoryFile
String ID: !
API String ID: 3761107634-2657877971
Opcode ID: 6e410194fcd50901128c0766d10c1e75220fdc67d70d05ee7b3424c3a4a01f65
Instruction ID: e66ea828580897357c3337ece30a7bcdfe6fa77db8e0ad74278681913a0db402
Opcode Fuzzy Hash: 6e410194fcd50901128c0766d10c1e75220fdc67d70d05ee7b3424c3a4a01f65
Instruction Fuzzy Hash: DF52E2B8D052689BDB24DF69D981ADCBBB0BF48314F1481EAE849B7341DB305E84CF55

Uniqueness

Uniqueness Score: -1.00%

Function 0040E58B Relevance: 7.5, APIs: 3, Strings: 1, Instructions: 531COMMON

Download Yara Rule

APIs

Part of subcall function 004F2CD0: GetFileAttributesA.KERNELBASE(?,?,?,0055A5B3,000000FF), ref: 004F2D0C
Part of subcall function 004F2CD0: GetLastError.KERNEL32(?,?,0055A5B3,000000FF), ref: 004F2D17

CreateDirectoryA.KERNELBASE(00000000,00000000), ref: 0040E794
CreateDirectoryA.KERNELBASE(00000000,00000000), ref: 0040EA49

Strings

B, xrefs: 0040E6C9

Memory Dump Source

Source File: 00000000.00000002.2007216495.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007216495.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007216495.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CreateDirectory$AttributesErrorFileLast
String ID: B
API String ID: 2267087916-1255198513
Opcode ID: 4675d498882eaab8bcb66d508d4128d8251963df79c65c724d9ca310621736ae
Instruction ID: 18f978b0f6646b41db9d4fa06ff2f241acb7d76137c4f260d1526695a4699fe5
Opcode Fuzzy Hash: 4675d498882eaab8bcb66d508d4128d8251963df79c65c724d9ca310621736ae
Instruction Fuzzy Hash: 385204B4D1526C9BDB25CFA9E981ADCFBB4BF48304F0081AAE919B7341D7341A84CF59

Uniqueness

Uniqueness Score: -1.00%

Function 0045A790 Relevance: 7.0, APIs: 4, Instructions: 978COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2007216495.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007216495.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007216495.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 490ef61a838fcbfa894a6fe40ce936e2c0c96c3f993b8de2707439853f73c299
Instruction ID: 9c4df05857bd84bc3601df45bbcef84d76791ef7a0d211089cd22e916cc2e826
Opcode Fuzzy Hash: 490ef61a838fcbfa894a6fe40ce936e2c0c96c3f993b8de2707439853f73c299
Instruction Fuzzy Hash: 63A23470C042689BDB25CF68CD84BEDBBB5AF59304F1082DAE849B7252DB345E89CF54

Uniqueness

Uniqueness Score: -1.00%

Function 004D0620 Relevance: 6.8, APIs: 4, Instructions: 813fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNELBASE(?,?,?,?,?,00000000,?,?), ref: 004D0771
FindNextFileA.KERNELBASE(0000000F,00000010), ref: 004D0A36
GetLastError.KERNEL32 ref: 004D0A44
FindClose.KERNEL32(0000000F), ref: 004D0A56

Memory Dump Source

Source File: 00000000.00000002.2007216495.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007216495.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007216495.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Find$File$CloseErrorFirstLastNext
String ID:
API String ID: 819619735-0
Opcode ID: 670de599fd2c045ba831aa5506c8298e033969c34e72791b2ef53cc8419cf420
Instruction ID: e03e187f96ff4dfc0117b7cb6e2bb59febb9782db7a0b13eee296deb0d69a62d
Opcode Fuzzy Hash: 670de599fd2c045ba831aa5506c8298e033969c34e72791b2ef53cc8419cf420
Instruction Fuzzy Hash: C7827BB0D002499FDB14CFA4C9917EEBBB1FF58304F14829AD8496B342D734AA85CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00454577 Relevance: 6.2, APIs: 4, Instructions: 179windowCOMMON

Download Yara Rule

APIs

MessageBoxA.USER32 ref: 00454582
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 004545B7
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00454623
GetProcessId.KERNELBASE(0000A9BE,00000000,00000000,00000003,00000000,00000000,00000000,00000003,00000000,00000000), ref: 00454685

Part of subcall function 004E2C80: IsDebuggerPresent.KERNEL32 ref: 004E2C93

Memory Dump Source

Source File: 00000000.00000002.2007216495.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007216495.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007216495.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@$DebuggerMessagePresentProcess
String ID:
API String ID: 4109920361-0
Opcode ID: a55321b5548f037b8ecd5a9ea3b9d8cefd08b925cd4ac8e08664165a2c44be84
Instruction ID: c12a46aea3045f5eb56cfd6aac46948695978722b9a007b8c1f4006fdd805c17
Opcode Fuzzy Hash: a55321b5548f037b8ecd5a9ea3b9d8cefd08b925cd4ac8e08664165a2c44be84
Instruction Fuzzy Hash: 0671BF756083818BC325CF18C84075ABBE1FFD9319F154A1FEC859B352DB349888CB8A

Uniqueness

Uniqueness Score: -1.00%

Function 004479BE Relevance: 5.7, APIs: 1, Strings: 2, Instructions: 408timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetTimeZoneInformation.KERNELBASE(00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,00447E03,00000000,00000000,00000000), ref: 00447CC2

Strings

W. Europe Summer Time, xrefs: 00447D6F
W. Europe Standard Time, xrefs: 00447D5B

Memory Dump Source

Source File: 00000000.00000002.2007216495.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007216495.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007216495.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: InformationTimeZone
String ID: W. Europe Standard Time$W. Europe Summer Time
API String ID: 565725191-690618308
Opcode ID: 45ed093c542864df7f6f6bfdd000931ff422ff8c2949e65a0c88095de6a35219
Instruction ID: ea3c3819e00c7610c2bdce84c30dacc5ed2750e9284a6662424918e6eb4f3f86
Opcode Fuzzy Hash: 45ed093c542864df7f6f6bfdd000931ff422ff8c2949e65a0c88095de6a35219
Instruction Fuzzy Hash: A2C13771D04115ABEB10BF65DC02ABF7BA9EF04758F64445BF900EB281EB389E42C798

Uniqueness

Uniqueness Score: -1.00%

Function 004D1240 Relevance: 4.6, APIs: 3, Instructions: 116encryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 004D1275
LocalFree.KERNEL32(?), ref: 004D12A4
LocalFree.KERNEL32(?,?), ref: 004D1365

Memory Dump Source

Source File: 00000000.00000002.2007216495.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007216495.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007216495.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: FreeLocal$CryptDataUnprotect
String ID:
API String ID: 2835072361-0
Opcode ID: f437a319516cb71d49f51f1e3b8985fecd22a3b95341de68aad5641ad33ff639
Instruction ID: edacca0892e7d6bf58cfe28d189f09218ecc2b188b76278acbc21aeb1f3e2cb0
Opcode Fuzzy Hash: f437a319516cb71d49f51f1e3b8985fecd22a3b95341de68aad5641ad33ff639
Instruction Fuzzy Hash: DD312631D001086BEB00ABA9DC857FEB779EF59314F00817BEC18B7351EB3959858BA5

Uniqueness

Uniqueness Score: -1.00%

Function 00551070 Relevance: 4.6, APIs: 3, Instructions: 71COMMON

Download Yara Rule

APIs

Part of subcall function 00551780: GetVersionExA.KERNEL32(?), ref: 005517A6

GetVersionExA.KERNEL32(?), ref: 005510AE
GetFileAttributesW.KERNELBASE(00000000), ref: 005510CD

Memory Dump Source

Source File: 00000000.00000002.2007216495.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007216495.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007216495.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Version$AttributesFile
String ID:
API String ID: 1468075466-0
Opcode ID: 1f021440039f82121490b15b1f236fdf0807d9e2ac99034605e0c2f6a5d68cd3
Instruction ID: 1b6ae3cb7f5bf0e907ef9fa77f2bed44bd693e69e760e1f883d9a1ea48be3fa6
Opcode Fuzzy Hash: 1f021440039f82121490b15b1f236fdf0807d9e2ac99034605e0c2f6a5d68cd3
Instruction Fuzzy Hash: 9A112736A006148BC720DF7DE988BAA7FE9FB59325F0001A7ED08D3250DA30DD48CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 0042C82B Relevance: 4.5, APIs: 3, Instructions: 35COMMON

Download Yara Rule

APIs

FindClose.KERNEL32(000000FF,?,004209DA,?), ref: 0042C837
FindFirstFileExW.KERNELBASE(000000FF,00000001,?,00000000,00000000,00000000,?,?,?,004209DA,?), ref: 0042C866
GetLastError.KERNEL32(?,004209DA,?), ref: 0042C878

Memory Dump Source

Source File: 00000000.00000002.2007216495.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007216495.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007216495.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Find$CloseErrorFileFirstLast
String ID:
API String ID: 4020440971-0
Opcode ID: 86c14a02093f16810e4dd88f91deff2d5f86e2f0abe4bed8fc1f86c1b24be754
Instruction ID: 8a27f9886f01e289c274a129579c59828a859e60d8a88321f661c1881ad45666
Opcode Fuzzy Hash: 86c14a02093f16810e4dd88f91deff2d5f86e2f0abe4bed8fc1f86c1b24be754
Instruction Fuzzy Hash: B4F0B431100518BFDB103F79EC488BE3B9CEF14371B508626F969D11B1D7718965D664

Uniqueness

Uniqueness Score: -1.00%

Function 0054B990 Relevance: 3.5, APIs: 2, Instructions: 484COMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0054BB45
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0054BE47

Memory Dump Source

Source File: 00000000.00000002.2007216495.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007216495.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007216495.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 885266447-0
Opcode ID: 8619c628930c15e3f64ee4185456f4c73d0beadc8a2f11204caef400f59f07bd
Instruction ID: a8910782226fa043b0ca02c89601bdb6306c66060be7ccd375e3029c486516c8
Opcode Fuzzy Hash: 8619c628930c15e3f64ee4185456f4c73d0beadc8a2f11204caef400f59f07bd
Instruction Fuzzy Hash: 0402A470604602AFEB14CF29C850BEABBE4FF88318F04866DE959C7650D774ED65CB92

Uniqueness

Uniqueness Score: -1.00%

Function 005041A0 Relevance: 1.9, Strings: 1, Instructions: 621COMMON

Download Yara Rule

Strings

~IP, xrefs: 00504326, 005048B9, 0050473E, 00504513, 005043EE, 00504367

Memory Dump Source

Source File: 00000000.00000002.2007216495.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007216495.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007216495.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID: ~IP
API String ID: 0-3959306736
Opcode ID: dbfb1a47ef4cf21015feb22a88fe898811b1a6b4d210efab5350a3fb83807d7f
Instruction ID: 0e36e89e1f9e1fd0a3757911ecfb7ec23bbf8a2227642b7cf3c9c86fbdf17ad5
Opcode Fuzzy Hash: dbfb1a47ef4cf21015feb22a88fe898811b1a6b4d210efab5350a3fb83807d7f
Instruction Fuzzy Hash: 4942CDB1A00649CBDB14CE78C8407ADFFA1FF46311F1886ADE5A5E7781D734994ACBA0

Uniqueness

Uniqueness Score: -1.00%

Function 0043A8BD Relevance: .3, Instructions: 318COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2007216495.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007216495.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007216495.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44be82ed036defe528c0ad6c951de0c396452293fa162e62365eb90ba0a48132
Instruction ID: 20f36868057f2dc5694f653adca667ab833700143c84c98609cf2c37f38438c9
Opcode Fuzzy Hash: 44be82ed036defe528c0ad6c951de0c396452293fa162e62365eb90ba0a48132
Instruction Fuzzy Hash: BEB1D37158060A8BCB28DE6885556BFB7A1AF0C304F142A1FD5D2A7381C73CAD65CB9B

Uniqueness

Uniqueness Score: -1.00%

Function 00506920 Relevance: .3, Instructions: 313COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2007216495.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007216495.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007216495.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 162f077abf4ece743e342fc7a8eb5a3408877318c4d8ee47aeae2a44dea6da9b
Instruction ID: 21ea325e3d8e9dd88ad6d2e4823945e325a7d4879c9c0f24fc1850b01c051b63
Opcode Fuzzy Hash: 162f077abf4ece743e342fc7a8eb5a3408877318c4d8ee47aeae2a44dea6da9b
Instruction Fuzzy Hash: 10D19F70600B41CBE724CF39C45079ABBE0FF45314F148A6DD4EA8B781EB74A489CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00506DD0 Relevance: .3, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2007216495.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007216495.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007216495.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae081eef026d20fb71c04ac6eddb48da90b3bd952cd5193e48f6a1899cdbfde1
Instruction ID: 7a6889ae545e6ec7e5da51a817b46c2a83bd4d4ff43436e387e76d31d11313cc
Opcode Fuzzy Hash: ae081eef026d20fb71c04ac6eddb48da90b3bd952cd5193e48f6a1899cdbfde1
Instruction Fuzzy Hash: 97B1B0756087019FC720CF68C840A6BBBE5FF88324F144B2DF8AAD3690D774EA558B52

Uniqueness

Uniqueness Score: -1.00%

Function 00453450 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2007216495.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007216495.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007216495.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6afd7cca9d3f29b836e8ff968d881141292596375e872e9d8850748854bd48ee
Instruction ID: 4760c8aac2775d88ce5afe2aa9a6c194579425224feb06dc2f39e30c9f8e2f3f
Opcode Fuzzy Hash: 6afd7cca9d3f29b836e8ff968d881141292596375e872e9d8850748854bd48ee
Instruction Fuzzy Hash: FB8100B0E00245AFDB118F69C9907BBBBA4EB1A346F4401AADC54A7343D7399A0DD7A4

Uniqueness

Uniqueness Score: -1.00%

Function 004E35A0 Relevance: 24.5, APIs: 16, Instructions: 493
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32 ref: 004E35C8
RmStartSession.RSTRTMGR(?,00000000,?), ref: 004E3620
RmRegisterResources.RSTRTMGR(?,00000001,?,00000000,00000000,00000000,00000000,?), ref: 004E3657
RmGetList.RSTRTMGR(?,00000000,?,?,?), ref: 004E367F
RmShutdown.RSTRTMGR(?,00000001,00000000), ref: 004E36A0
RmEndSession.RSTRTMGR(?), ref: 004E36F9
SetLastError.KERNEL32(00000000), ref: 004E3700
CopyFileA.KERNEL32(?,?,00000000), ref: 004E371F
GetLastError.KERNEL32(?,?,00000000), ref: 004E372A
CopyFileA.KERNEL32(?,?,00000000), ref: 004E3742
RmStartSession.RSTRTMGR(?,00000000,?,?,00000000), ref: 004E37B1
RmRegisterResources.RSTRTMGR(?,00000001,?,00000000,00000000,00000000,00000000,?,?,00000000), ref: 004E37E8
RmGetList.RSTRTMGR(?,?,?,?,?,?,00000000), ref: 004E3810
RmShutdown.RSTRTMGR(?,00000001,00000000,?,00000000), ref: 004E3830
RmEndSession.RSTRTMGR(?,?,00000000), ref: 004E387F
SetLastError.KERNEL32(00000000,?,00000000), ref: 004E3886

Memory Dump Source

Source File: 00000000.00000002.2007216495.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007216495.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007216495.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ErrorLastSession$CopyFileListRegisterResourcesShutdownStart
String ID:
API String ID: 1315383477-0
Opcode ID: 9f1c935bf69e85cb9b9760aee873f7302ef3c0541c401a44e83cc19aa013ab35
Instruction ID: 5bf62267ccc7f4fe4693b81ad114fb0840f9afa76d5c815397b18ace0e574e84
Opcode Fuzzy Hash: 9f1c935bf69e85cb9b9760aee873f7302ef3c0541c401a44e83cc19aa013ab35
Instruction Fuzzy Hash: AC02AD71D00259AFCB15DFA5D888BEEBBB8FF08315F14022AE815A7391D7389E44CB95

Uniqueness

Uniqueness Score: -1.00%

Function 0043D563 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 273
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0043D21C: CreateFileW.KERNELBASE(?,?,?,?,?,?,00000000), ref: 0043D239

GetLastError.KERNEL32 ref: 0043D677
__dosmaperr.LIBCMT ref: 0043D67E
GetFileType.KERNELBASE(00000000), ref: 0043D68A
GetLastError.KERNEL32 ref: 0043D694
__dosmaperr.LIBCMT ref: 0043D69D
CloseHandle.KERNEL32(00000000), ref: 0043D6BD
CloseHandle.KERNEL32(?), ref: 0043D80A
GetLastError.KERNEL32 ref: 0043D83C
__dosmaperr.LIBCMT ref: 0043D843

Strings

H, xrefs: 0043D7C8

Memory Dump Source

Source File: 00000000.00000002.2007216495.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007216495.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007216495.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
String ID: H
API String ID: 4237864984-2852464175
Opcode ID: 63c00d4ff725a68de22716b4a375591cf024028e2c9fd4940c7fbe6601f7ac47
Instruction ID: deea7823187220b22c69116efca66525af397024c1424d0dae53dd4a9d4c69af
Opcode Fuzzy Hash: 63c00d4ff725a68de22716b4a375591cf024028e2c9fd4940c7fbe6601f7ac47
Instruction Fuzzy Hash: 47A17C31E14114AFCF19AF68EC467AE3BB1EB0A324F14215EF811DB391DB388816DB55

Uniqueness

Uniqueness Score: -1.00%

Function 004D2190 Relevance: 16.9, APIs: 11, Instructions: 404
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

std::_Throw_Cpp_error.LIBCPMT ref: 004D2391
std::_Throw_Cpp_error.LIBCPMT ref: 004D23A2
setsockopt.WS2_32(00000338,0000FFFF,00001006,?,00000008), ref: 004D2466
recv.WS2_32(?,00000004,00000002), ref: 004D2481
WSAGetLastError.WS2_32 ref: 004D2485
recv.WS2_32(00000000,0000000C,00000002,0000000C), ref: 004D24EE
recv.WS2_32(00000000,0000000C,00000008), ref: 004D250F
setsockopt.WS2_32(0000FFFF,00001006,?,00000008,?), ref: 004D258B
recv.WS2_32(00000000,?,00000008), ref: 004D25AC

Memory Dump Source

Source File: 00000000.00000002.2007216495.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007216495.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007216495.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: recv$Cpp_errorThrow_setsockoptstd::_$ErrorLast
String ID:
API String ID: 4262120464-0
Opcode ID: d02ee23e8d58502d72fa09aa745b8378fa7757ac069d19a7d433680d37297696
Instruction ID: f7b17b8e68668ba49e7fca0522a5bdce23b6917c1ff1aba89fdf03a1c4391d3e
Opcode Fuzzy Hash: d02ee23e8d58502d72fa09aa745b8378fa7757ac069d19a7d433680d37297696
Instruction Fuzzy Hash: 8AF10070D00248DBDB14DFA8DD95BAEBBB1FF54314F10821AE804AB392DB786985DF94

Uniqueness

Uniqueness Score: -1.00%

Function 00421F3C Relevance: 16.4, APIs: 6, Strings: 3, Instructions: 635
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 00422757
___std_exception_destroy.LIBVCRUNTIME ref: 00422770
___std_exception_destroy.LIBVCRUNTIME ref: 004228EF
___std_exception_destroy.LIBVCRUNTIME ref: 00422908
___std_exception_destroy.LIBVCRUNTIME ref: 00422B51
___std_exception_destroy.LIBVCRUNTIME ref: 00422B6A

Strings

$, xrefs: 00422D59
array, xrefs: 0042254B
object, xrefs: 00422B9E

Memory Dump Source

Source File: 00000000.00000002.2007216495.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007216495.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007216495.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ___std_exception_destroy
String ID: $$array$object
API String ID: 4194217158-1261123851
Opcode ID: 8ad5d53e16a425efb3008508f62d81adc97be10aa7c72d6539d92b8b8dc31230
Instruction ID: 729c381a9a0c7f986160d18f999e66225a9d9459ed6648384f1f9576d23ff93e
Opcode Fuzzy Hash: 8ad5d53e16a425efb3008508f62d81adc97be10aa7c72d6539d92b8b8dc31230
Instruction Fuzzy Hash: 6642F370D0025DAFDB14DFA0D984BEEBBB4FF15304F50416EE405A7642EB78AA88CB95

Uniqueness

Uniqueness Score: -1.00%

Function 004431A0 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 292
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

, xrefs: 00443421, 00443424

Memory Dump Source

Source File: 00000000.00000002.2007216495.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007216495.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007216495.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3907804496
Opcode ID: b462a36e6bb30e1ebe37cca350b7bdb3d0fdcfd033a52d65a3f9a67cac222ce0
Instruction ID: e3239ec4e1ee32b8324d570a22e522ef24bddbe65fd960e714ad45a7b0e040b8
Opcode Fuzzy Hash: b462a36e6bb30e1ebe37cca350b7bdb3d0fdcfd033a52d65a3f9a67cac222ce0
Instruction Fuzzy Hash: 77B12670A04244AFEB01DF59C881BBE7BB1FF49715F14419AE90197382CB789E41CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 004D3150 Relevance: 12.1, APIs: 8, Instructions: 92
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSAStartup.WS2_32 ref: 004D317A
getaddrinfo.WS2_32(?,?,?,00588CC0), ref: 004D31FC
socket.WS2_32(?,?,?), ref: 004D321D
connect.WS2_32(00000000,0055F6D1,?), ref: 004D3231
closesocket.WS2_32(00000000), ref: 004D323D
freeaddrinfo.WS2_32(?,?,?,?,00588CC0,?,?), ref: 004D324A
WSACleanup.WS2_32 ref: 004D3250
freeaddrinfo.WS2_32(?,?,?,?,00588CC0,?,?), ref: 004D3265

Memory Dump Source

Source File: 00000000.00000002.2007216495.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007216495.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007216495.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: freeaddrinfo$CleanupStartupclosesocketconnectgetaddrinfosocket
String ID:
API String ID: 58224237-0
Opcode ID: 9e6883013388f64e9fa16a16f0073357cf9f7d6acb3b040fdaf446918f01256a
Instruction ID: 66b7f2af6e1e00109afe9fd9f1c3058fd8df4c895de65cf13c46908161227474
Opcode Fuzzy Hash: 9e6883013388f64e9fa16a16f0073357cf9f7d6acb3b040fdaf446918f01256a
Instruction Fuzzy Hash: 7731E631A047009BD7209F29DC4862BB7E5FF85735F104B5FF9A4933E0D37899489696

Uniqueness

Uniqueness Score: -1.00%

Function 0041A800 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 378
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 0041A959
___std_exception_destroy.LIBVCRUNTIME ref: 0041A972
___std_exception_destroy.LIBVCRUNTIME ref: 0041AB4E
___std_exception_destroy.LIBVCRUNTIME ref: 0041AB67

Strings

value, xrefs: 0041A8B3, 0041AAA2

Memory Dump Source

Source File: 00000000.00000002.2007216495.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007216495.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007216495.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ___std_exception_destroy
String ID: value
API String ID: 4194217158-494360628
Opcode ID: 7de34780600d4b1dabe19f14ffe17dc70708db038589e88eb6431569b9f7661d
Instruction ID: 9f034d729ebebe199f4f723a1c14bfd040db2caa5f80a11ca9a640f2ae4bdf80
Opcode Fuzzy Hash: 7de34780600d4b1dabe19f14ffe17dc70708db038589e88eb6431569b9f7661d
Instruction Fuzzy Hash: 8DF10370D002488FDB14DF65C844BEEBBB4BF15304F14829EE455A7782E7786A88CFA6

Uniqueness

Uniqueness Score: -1.00%

Function 0040A4B2 Relevance: 7.8, APIs: 5, Instructions: 319COMMON

Download Yara Rule

APIs

CreateDirectoryA.KERNELBASE(00000000,00000000,?), ref: 0040A601
CreateDirectoryA.KERNELBASE(00000000,00000000), ref: 0040A6D1
SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 0040A706

Part of subcall function 004F2CD0: GetFileAttributesA.KERNELBASE(?,?,?,0055A5B3,000000FF), ref: 004F2D0C
Part of subcall function 004F2CD0: GetLastError.KERNEL32(?,?,0055A5B3,000000FF), ref: 004F2D17

CreateDirectoryA.KERNELBASE(00000000,00000000), ref: 0040A911
SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 0040A940
CreateDirectoryA.KERNELBASE(00000000,00000000,?), ref: 0040ACD3
CreateDirectoryA.KERNELBASE(00000000,00000000), ref: 0040ADA3

Memory Dump Source

Source File: 00000000.00000002.2007216495.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007216495.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007216495.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CreateDirectory$FolderPath$AttributesErrorFileLast
String ID:
API String ID: 3066340180-0
Opcode ID: 19c4d3283afc54cd7afabba50036feaba4a00939002738fbcb30bee4d7362651
Instruction ID: 0dc40a6cb04ba276704b867a860c5201117d836184c1faeb6618881e0654ecfd
Opcode Fuzzy Hash: 19c4d3283afc54cd7afabba50036feaba4a00939002738fbcb30bee4d7362651
Instruction Fuzzy Hash: 84F1DCB8D042589ADB25DF98C981BDDBBF4AF58314F1410DAE809B7381DB316E84CF69

Uniqueness

Uniqueness Score: -1.00%

Function 00407D50 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 381libraryloadernetworkCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(Ws2_32.dll,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00408127
GetProcAddress.KERNEL32(00000000,?), ref: 00408132
WSASend.WS2_32(?,?,00000001,00000000,00000000,00000000,00000000), ref: 0040814B

Strings

Ws2_32.dll, xrefs: 0040811E

Memory Dump Source

Source File: 00000000.00000002.2007216495.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007216495.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007216495.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: AddressHandleModuleProcSend
String ID: Ws2_32.dll
API String ID: 2819740048-3093949381
Opcode ID: d1ce78f9ae48063a26ae24d189bcc4b00fbdf36e4b44d7184625d12e189acc5b
Instruction ID: 4cf5a73f60aaa9aa04889aa359a8f1718852bcf292be34ef81f356f0aae57edb
Opcode Fuzzy Hash: d1ce78f9ae48063a26ae24d189bcc4b00fbdf36e4b44d7184625d12e189acc5b
Instruction Fuzzy Hash: 1FF18D70E042468FCB25CF58C880A6EBBB1BF45314F24456EE5A5AB3D2D7356C42CBD6

Uniqueness

Uniqueness Score: -1.00%

Function 004081E0 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 332libraryloadernetworkCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(Ws2_32.dll,?,?,?,?,005588D8,00000000,00000000,-00589220), ref: 00408566
GetProcAddress.KERNEL32(00000000,?), ref: 00408574
WSASend.WS2_32(?,?,00000001,00000000,00000000,00000000,00000000,?,?,?,?,005588D8,00000000,00000000,-00589220), ref: 00408589

Strings

Ws2_32.dll, xrefs: 0040855A

Memory Dump Source

Source File: 00000000.00000002.2007216495.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007216495.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007216495.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: AddressHandleModuleProcSend
String ID: Ws2_32.dll
API String ID: 2819740048-3093949381
Opcode ID: 56d94f30f56239b9f6a30b9d4a5a515b5cb323a29f0ba089c1967f76d3ef3ef0
Instruction ID: b889a33a35ddf0adef0218ac58701f77bdbbaba15cb1320cc4c9efeef27d22b6
Opcode Fuzzy Hash: 56d94f30f56239b9f6a30b9d4a5a515b5cb323a29f0ba089c1967f76d3ef3ef0
Instruction Fuzzy Hash: 1BE1BC70D00258EFDF15CBA4DD917EDBBB0AF56704F14029EE8857B282DB34198ACB95

Uniqueness

Uniqueness Score: -1.00%

Function 00446260 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 17fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNELBASE(A{C,?,00437B41,?), ref: 00446268
GetLastError.KERNEL32(?,00437B41,?), ref: 00446272
__dosmaperr.LIBCMT ref: 00446279

Strings

A{C, xrefs: 00446265

Memory Dump Source

Source File: 00000000.00000002.2007216495.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007216495.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007216495.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: DeleteErrorFileLast__dosmaperr
String ID: A{C
API String ID: 1545401867-2902953714
Opcode ID: d06e79dd3ba0cf7262f3e9d2e22031695f25905068d46e1a3810f42683731183
Instruction ID: 82298aed12121fbb76aae4bd86d3a8824ef8c8c9545724addf748e8f9a95ec58
Opcode Fuzzy Hash: d06e79dd3ba0cf7262f3e9d2e22031695f25905068d46e1a3810f42683731183
Instruction Fuzzy Hash: E2D02232018A093B8B002BFAFC0C81B3F1CDAC23B4B112212F12CC21A0DF79C880E540

Uniqueness

Uniqueness Score: -1.00%

Function 004F2CD0 Relevance: 6.1, APIs: 4, Instructions: 66COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNELBASE(?,?,?,0055A5B3,000000FF), ref: 004F2D0C
GetLastError.KERNEL32(?,?,0055A5B3,000000FF), ref: 004F2D17
std::_Throw_Cpp_error.LIBCPMT ref: 004F2D4E
std::_Throw_Cpp_error.LIBCPMT ref: 004F2D5F

Memory Dump Source

Source File: 00000000.00000002.2007216495.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007216495.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007216495.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Cpp_errorThrow_std::_$AttributesErrorFileLast
String ID:
API String ID: 995686243-0
Opcode ID: dfba1b075285273309578ffbf089447c7c1ac741728f75895561d4347c87bb62
Instruction ID: 325128bde6972141eaafbb0e95bf719766b08d5b5670bbe0189b29004b96e682
Opcode Fuzzy Hash: dfba1b075285273309578ffbf089447c7c1ac741728f75895561d4347c87bb62
Instruction Fuzzy Hash: 3401C071641118129A342A35ED4907F370D8713328BA80F1BEE25973D5D9DFCC45875A

Uniqueness

Uniqueness Score: -1.00%

Function 00551E30 Relevance: 6.1, APIs: 4, Instructions: 66fileCOMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(?,?,?,00000000), ref: 00551E4F
GetLastError.KERNEL32 ref: 00551E5A
ReadFile.KERNELBASE(?,?,?,?,00000000), ref: 00551E82
GetLastError.KERNEL32 ref: 00551E8C

Memory Dump Source

Source File: 00000000.00000002.2007216495.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007216495.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007216495.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ErrorFileLast$PointerRead
String ID:
API String ID: 2170121939-0
Opcode ID: b49e815b288db118013f7b31ade0b5ee7bcb2275d16c9ff237f0887fb9d13391
Instruction ID: 1c07d7795fbcd358c5ccab0054a22981654648c43a30ee7f67c6bd12fb941fbd
Opcode Fuzzy Hash: b49e815b288db118013f7b31ade0b5ee7bcb2275d16c9ff237f0887fb9d13391
Instruction Fuzzy Hash: BE116D32600509ABDB108FA9EC06B9ABFACEB55371F104266FD1CC7690D771D8649BD0

Uniqueness

Uniqueness Score: -1.00%

Function 00405DE0 Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 308COMMON

Download Yara Rule

APIs

___std_fs_directory_iterator_advance@8.LIBCPMT ref: 00406029
___std_fs_directory_iterator_advance@8.LIBCPMT ref: 00406070

Strings

., xrefs: 00406042

Memory Dump Source

Source File: 00000000.00000002.2007216495.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007216495.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007216495.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ___std_fs_directory_iterator_advance@8
String ID: .
API String ID: 2610647541-248832578
Opcode ID: 24110669fa94efa93dbf60294f552bae376b896653ba069dd2a2053fc70e762d
Instruction ID: 096b34988356738832717cd8d53d0dabcf9a03e197ae697f4c60f7eb60d7375d
Opcode Fuzzy Hash: 24110669fa94efa93dbf60294f552bae376b896653ba069dd2a2053fc70e762d
Instruction Fuzzy Hash: EBB1ED31A00A269FCB24DF28C484AABB3A5FF44314F14467AE956AB7C0D739AD55CFC4

Uniqueness

Uniqueness Score: -1.00%

Function 0040BBAA Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 260COMMON

Download Yara Rule

APIs

CreateDirectoryA.KERNELBASE(00000000,00000000), ref: 0040BF0B

Strings

gO>, xrefs: 0040BF95
D5I, xrefs: 0040BCE7

Memory Dump Source

Source File: 00000000.00000002.2007216495.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007216495.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007216495.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CreateDirectory
String ID: D5I$gO>
API String ID: 4241100979-9669375
Opcode ID: a70bc843fb75804f0c6dcccdee84c4d7299bd1d366e2e2686d92fec8723b3657
Instruction ID: 1c99b7db082cbe4170b2a8c48b056c73716a310fc73452a91fe799afa8dbbf6b
Opcode Fuzzy Hash: a70bc843fb75804f0c6dcccdee84c4d7299bd1d366e2e2686d92fec8723b3657
Instruction Fuzzy Hash: 38E14AB4D052588FCB64CF98DA91ADCBBF1AB4C324F6451A9E449B7340DB315E81CF68

Uniqueness

Uniqueness Score: -1.00%

Function 0040AED5 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 225fileCOMMON

Download Yara Rule

APIs

CopyFileA.KERNEL32(00000000,00000000,00000000), ref: 0040B094
CreateDirectoryA.KERNELBASE(00000000,00000000), ref: 0040B194

Strings

d:P, xrefs: 0040B21E

Memory Dump Source

Source File: 00000000.00000002.2007216495.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007216495.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007216495.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CopyCreateDirectoryFile
String ID: d:P
API String ID: 3761107634-1316356323
Opcode ID: 9834d24a3142c173cffbc2ab538e9bcef5bf588c3bed871f4eefa6fbed3306b3
Instruction ID: b46fb8f498fe19e45c2de27f9ae2aa4bcfe055eec9d79a59652231d92f533978
Opcode Fuzzy Hash: 9834d24a3142c173cffbc2ab538e9bcef5bf588c3bed871f4eefa6fbed3306b3
Instruction Fuzzy Hash: C0D17BB8D052588BDB25CF98D991ADCBBF0AB4C314F2451DAE809B7340DB316E84CF69

Uniqueness

Uniqueness Score: -1.00%

Function 0040C5CC Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 224fileCOMMON

Download Yara Rule

APIs

CopyFileA.KERNEL32(00000000,00000000,00000000), ref: 0040C78B
CreateDirectoryA.KERNELBASE(00000000,00000000), ref: 0040C88B

Strings

, xrefs: 0040C692

Memory Dump Source

Source File: 00000000.00000002.2007216495.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007216495.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007216495.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CopyCreateDirectoryFile
String ID:
API String ID: 3761107634-3916222277
Opcode ID: 6230a3c5e97c4a67157d6a67fc00dc778ed06bd17ee8d2d2cab1e9c77b27c71c
Instruction ID: fea31fcc1739ab290db98ead6b4672fbdfba05a45897d1c47918ee6387bb05c2
Opcode Fuzzy Hash: 6230a3c5e97c4a67157d6a67fc00dc778ed06bd17ee8d2d2cab1e9c77b27c71c
Instruction Fuzzy Hash: D6D17AB8D052588BDB28CF98D991ADCBBF0AF58324F2411E9D809B7340DB315E84CF69

Uniqueness

Uniqueness Score: -1.00%

Function 0040BDCF Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 174fileCOMMON

Download Yara Rule

APIs

CopyFileA.KERNEL32(00000000,00000000,00000000), ref: 0040BDEF
CreateDirectoryA.KERNELBASE(00000000,00000000), ref: 0040BF0B

Strings

gO>, xrefs: 0040BF95

Memory Dump Source

Source File: 00000000.00000002.2007216495.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007216495.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007216495.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CopyCreateDirectoryFile
String ID: gO>
API String ID: 3761107634-815838113
Opcode ID: 79ca3bfd0f87e6d2c923574700e48bcd02e0336f1f128ec40a70bb761074c344
Instruction ID: 9418e816ee5ff452795ce5d94e31d7cf594980c5612f767f219b469b450b4b33
Opcode Fuzzy Hash: 79ca3bfd0f87e6d2c923574700e48bcd02e0336f1f128ec40a70bb761074c344
Instruction Fuzzy Hash: 9FA15AB4D052588BCB64CF98DA90ADCBBF1BB4C324F24519AE449B7340DB715E81CF68

Uniqueness

Uniqueness Score: -1.00%

Function 00447C50 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 156timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 004458AA: RtlFreeHeap.NTDLL(00000000,00000000,?,0044C3D9,?,00000000,?,?,0044C67A,?,00000007,?,?,0044CB6E,?,?), ref: 004458C0
Part of subcall function 004458AA: GetLastError.KERNEL32(?,?,0044C3D9,?,00000000,?,?,0044C67A,?,00000007,?,?,0044CB6E,?,?), ref: 004458CB

GetTimeZoneInformation.KERNELBASE(00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,00447E03,00000000,00000000,00000000), ref: 00447CC2

Strings

W. Europe Summer Time, xrefs: 00447D6F
W. Europe Standard Time, xrefs: 00447D5B

Memory Dump Source

Source File: 00000000.00000002.2007216495.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007216495.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007216495.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ErrorFreeHeapInformationLastTimeZone
String ID: W. Europe Standard Time$W. Europe Summer Time
API String ID: 3335090040-690618308
Opcode ID: 53cfa0c2b2e8e1c4497564ba13a148606d804052baa25eea3ebd75a2ff8e0b0f
Instruction ID: 95fec9e7b2ee5416ea09e91f5883e66808fc8b830f7b48389ead0be8655ac52d
Opcode Fuzzy Hash: 53cfa0c2b2e8e1c4497564ba13a148606d804052baa25eea3ebd75a2ff8e0b0f
Instruction Fuzzy Hash: 7641D471D04225ABEB10BF76DC0696E7FB8EF04358F60415BF814B7291EB389D069B98

Uniqueness

Uniqueness Score: -1.00%

Function 0040C37A Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 116fileCOMMON

Download Yara Rule

APIs

CopyFileA.KERNEL32(00000000,00000000,00000000), ref: 0040C39A
CreateDirectoryA.KERNELBASE(00000000,00000000), ref: 0040C49A

Strings

U5I, xrefs: 0040C4E4

Memory Dump Source

Source File: 00000000.00000002.2007216495.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007216495.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007216495.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CopyCreateDirectoryFile
String ID: U5I
API String ID: 3761107634-2587217555
Opcode ID: 66b2524eb8a07fd23d5aa4cb1cda167927eeeac49ec39440f90acb96c5dc2362
Instruction ID: e5f4e7ff2e2fcc63228e79b94ae8c256ee4266638f27ae636944e61a4eef9a7f
Opcode Fuzzy Hash: 66b2524eb8a07fd23d5aa4cb1cda167927eeeac49ec39440f90acb96c5dc2362
Instruction Fuzzy Hash: CC518CB4D052188BDB24DF98D995ADCBBF1AF48324F641199E809B7340DB356E84CF29

Uniqueness

Uniqueness Score: -1.00%

Function 004F8D20 Relevance: 4.8, APIs: 1, Strings: 2, Instructions: 250COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 004F8DF9

Strings

-1L, xrefs: 004F8EAA
-2L, xrefs: 004F8E0D

Memory Dump Source

Source File: 00000000.00000002.2007216495.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007216495.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007216495.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ErrorLast
String ID: -1L$-2L
API String ID: 1452528299-3975959154
Opcode ID: 7cbc2765ffe9876f453631ab618cea2cdf271d2230653e7288edc8667744d0af
Instruction ID: 8532e58cabc42239c9a206463210862c2cf1955d45b676afb1905f123e481057
Opcode Fuzzy Hash: 7cbc2765ffe9876f453631ab618cea2cdf271d2230653e7288edc8667744d0af
Instruction Fuzzy Hash: 8BA1A071E102489BDB18DBA4CC95BFEB771FF58304F14821EE905BB281EB746A85CB54

Uniqueness

Uniqueness Score: -1.00%

Function 0040AA6A Relevance: 4.7, APIs: 3, Instructions: 227fileCOMMON

Download Yara Rule

APIs

CopyFileA.KERNEL32(00000000,00000000,00000000), ref: 0040AB87
CreateDirectoryA.KERNELBASE(00000000,00000000,?), ref: 0040ACD3
CreateDirectoryA.KERNELBASE(00000000,00000000), ref: 0040ADA3

Memory Dump Source

Source File: 00000000.00000002.2007216495.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007216495.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007216495.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CreateDirectory$CopyFile
String ID:
API String ID: 379462554-0
Opcode ID: aa0bf1944e415d055ad1ba2bd394d683157b89170457a394d18422a3be082895
Instruction ID: fa5d3aefcb5318aac483c8dab34aecfa374d65c0e00a15c095fa280417b77c72
Opcode Fuzzy Hash: aa0bf1944e415d055ad1ba2bd394d683157b89170457a394d18422a3be082895
Instruction Fuzzy Hash: EEC1CEB8D042188ADB25DF98C991ADDBBF0AF5C324F1411E9D809B7380DB356E84CF69

Uniqueness

Uniqueness Score: -1.00%

Function 0043DE79 Relevance: 4.5, APIs: 3, Instructions: 15COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(75FF50CA,?,0043DE73,00000016,004332F3,?,75FF50CA,84D436BD,004332F3,75FF50CA), ref: 0043DE8A
TerminateProcess.KERNEL32(00000000,?,0043DE73,00000016,004332F3,?,75FF50CA,84D436BD,004332F3,75FF50CA), ref: 0043DE91
ExitProcess.KERNEL32 ref: 0043DEA3

Memory Dump Source

Source File: 00000000.00000002.2007216495.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007216495.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007216495.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 7d470379b508b403f4ab401723c09fedd286a175a0f2e09b2a992ce8b19c4fb8
Instruction ID: 5fe30eb41a0399f7e166aae356d18006ddc47655100d151fd05e604e3206ade8
Opcode Fuzzy Hash: 7d470379b508b403f4ab401723c09fedd286a175a0f2e09b2a992ce8b19c4fb8
Instruction Fuzzy Hash: 2CD05E31804A04ABCF003F65EC0E85A3F25AF24345F005015F9194B131CB798989EA84

Uniqueness

Uniqueness Score: -1.00%

Function 0043CFC6 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 221fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,?,?,?,?,?,00000000), ref: 0043D239

Strings

@, xrefs: 0043D08D

Memory Dump Source

Source File: 00000000.00000002.2007216495.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007216495.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007216495.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CreateFile
String ID: @
API String ID: 823142352-2766056989
Opcode ID: 15f19a1f7690f80218afbcd4fd66329c079a2cb147d96d8989a4609ec7928676
Instruction ID: dc00e106188675afe22aef0fe0e5de5fe1af6006a7ca4effd60217809a668f9c
Opcode Fuzzy Hash: 15f19a1f7690f80218afbcd4fd66329c079a2cb147d96d8989a4609ec7928676
Instruction Fuzzy Hash: 4361F671D00109ABEF294E68FC85BBF3B64EB1C318F286167F914D6391D23CCD829259

Uniqueness

Uniqueness Score: -1.00%

Function 0040B362 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 211fileCOMMON

Download Yara Rule

APIs

CopyFileA.KERNEL32(00000000,00000000,00000000), ref: 0040B5A7

Strings

bV#, xrefs: 0040B646

Memory Dump Source

Source File: 00000000.00000002.2007216495.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007216495.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007216495.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CopyFile
String ID: bV#
API String ID: 1304948518-2557208531
Opcode ID: 2e174e6643ddc55f21fd3496af49bc0eec1a3949b4a986039ec58223d0844ec1
Instruction ID: cae23ce53105954d6f992f15396b4822f88a54db382455c53f0dce72c0814f2e
Opcode Fuzzy Hash: 2e174e6643ddc55f21fd3496af49bc0eec1a3949b4a986039ec58223d0844ec1
Instruction Fuzzy Hash: 2BC18DB4D052598FCB25CF98DA916DCBBF1AB4C324F2451AAD809B7340DB356E81CF68

Uniqueness

Uniqueness Score: -1.00%

Function 0040C155 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 201COMMON

Download Yara Rule

APIs

CreateDirectoryA.KERNELBASE(00000000,00000000), ref: 0040C49A

Strings

U5I, xrefs: 0040C4E4

Memory Dump Source

Source File: 00000000.00000002.2007216495.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007216495.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007216495.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CreateDirectory
String ID: U5I
API String ID: 4241100979-2587217555
Opcode ID: c096f63529a2d04bfeae6dc2135d5aab1f1a4f86739ed3dadbb568acd2f4c664
Instruction ID: ac674b7b51f05a57ce70314e7f00a6b42712f57d929c2611c6f576c432607ed5
Opcode Fuzzy Hash: c096f63529a2d04bfeae6dc2135d5aab1f1a4f86739ed3dadbb568acd2f4c664
Instruction Fuzzy Hash: A4C16BB4D052188FDB24CF98DA91ADCBBF1AB4C324F645199E809B7340DB316E85CF69

Uniqueness

Uniqueness Score: -1.00%

Function 0040E250 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 167COMMON

Download Yara Rule

APIs

Part of subcall function 004F2CD0: GetFileAttributesA.KERNELBASE(?,?,?,0055A5B3,000000FF), ref: 004F2D0C
Part of subcall function 004F2CD0: GetLastError.KERNEL32(?,?,0055A5B3,000000FF), ref: 004F2D17

CreateDirectoryA.KERNELBASE(00000000,00000000), ref: 0040E459

Strings

=, xrefs: 0040E38E

Memory Dump Source

Source File: 00000000.00000002.2007216495.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007216495.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007216495.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: AttributesCreateDirectoryErrorFileLast
String ID: =
API String ID: 674977465-2322244508
Opcode ID: c01e006192443c623b1345774e7bd4ae881e867d2a563e42cd0be2be54deea90
Instruction ID: 4c31c2b4ab6c20c136918818f105c81bd143b56d6cc430cbfc3e2680d29ed538
Opcode Fuzzy Hash: c01e006192443c623b1345774e7bd4ae881e867d2a563e42cd0be2be54deea90
Instruction Fuzzy Hash: 2091F2B4D1526C9BDB25CFA9E981ADCFBB4BF48304F00819AE858B7341DB346A84CF55

Uniqueness

Uniqueness Score: -1.00%

Function 00410887 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 77COMMON

Download Yara Rule

APIs

CreateDirectoryA.KERNELBASE(00000000,00000000), ref: 004108A1

Strings

k, xrefs: 00410895

Memory Dump Source

Source File: 00000000.00000002.2007216495.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007216495.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007216495.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CreateDirectory
String ID: k
API String ID: 4241100979-140662621
Opcode ID: c404385334f48e69bc3d99d72a58cc6b4349818a5b857a9d5148564d291bfd69
Instruction ID: 1f0ba2e685299aad9cd7c917c7bb047ec0820a6efdb3c6e343f4a662026f26a4
Opcode Fuzzy Hash: c404385334f48e69bc3d99d72a58cc6b4349818a5b857a9d5148564d291bfd69
Instruction Fuzzy Hash: 68417BB4D05268DBCB28CF99E990ADCFBB1FB48304F4081AAE819B7350DB746941CF45

Uniqueness

Uniqueness Score: -1.00%

Function 004D2890 Relevance: 3.6, APIs: 2, Instructions: 560COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,6F2977B7,?,?,?,?,?,?,?,00000000,00000001,74D723A0,00000000), ref: 004D2D54

Part of subcall function 004DB380: VirtualAllocEx.KERNEL32(00000000,00000000,?,00003000,00000040,?,00000000), ref: 004DB3EA
Part of subcall function 004DB380: WriteProcessMemory.KERNEL32(00000000,00000000,t-M,?,00000000), ref: 004DB406
Part of subcall function 004DB380: WriteProcessMemory.KERNEL32(?,?,?,?,00000000), ref: 004DB43F
Part of subcall function 004DB380: VirtualAllocEx.KERNEL32(?,00000000,00001000,00003000,00000040), ref: 004DB469

Part of subcall function 0042D43A: ReleaseSRWLockExclusive.KERNEL32(004F2D39), ref: 0042D44E

Memory Dump Source

Source File: 00000000.00000002.2007216495.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007216495.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007216495.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Process$AllocMemoryVirtualWrite$CurrentExclusiveLockRelease
String ID:
API String ID: 666592346-0
Opcode ID: 36bdb181790bc6e9ce34960c3b1bcb2e23f1027d8802b3b0fa36cb7caa308c08
Instruction ID: 26b9c72b6ddc4c31c1f3b4b91af9721e671e16450a7e1798ce2a3c04c8b5f315
Opcode Fuzzy Hash: 36bdb181790bc6e9ce34960c3b1bcb2e23f1027d8802b3b0fa36cb7caa308c08
Instruction Fuzzy Hash: 7432DF70900208CBDB14DF68C9957EDBBB1FF58304F14419AE8096B392DB789E85CFA6

Uniqueness

Uniqueness Score: -1.00%

Function 0041FD60 Relevance: 3.3, APIs: 2, Instructions: 323COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 0041FF44
Concurrency::cancel_current_task.LIBCPMT ref: 0042013E

Part of subcall function 00403070: ___std_exception_copy.LIBVCRUNTIME ref: 004030AE

Memory Dump Source

Source File: 00000000.00000002.2007216495.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007216495.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007216495.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Concurrency::cancel_current_task$___std_exception_copy
String ID:
API String ID: 270002120-0
Opcode ID: 060430c55af8b6ea1c615aab261a260ab76fea60cbfa4c02fe2dacebd12a2d03
Instruction ID: 187ba38e436fa24eb54e9b6ebc159b9d6d0155e37d19f8bc819051910fa96c6e
Opcode Fuzzy Hash: 060430c55af8b6ea1c615aab261a260ab76fea60cbfa4c02fe2dacebd12a2d03
Instruction Fuzzy Hash: F8B13672B012108FC718DF2CED816BE77A5EB94304B95417BDC06AF369EA34ED898794

Uniqueness

Uniqueness Score: -1.00%

Function 00444019 Relevance: 3.2, APIs: 2, Instructions: 196fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0044372F: GetConsoleOutputCP.KERNEL32(84D436BD,00000000,00000000,00437957), ref: 00443792

WriteFile.KERNELBASE(?,00000000,?,?,00000000,00000000,00000000,?,004F2E1F,?,00437877,004F2E1F,?,00578900,00000010,00437957), ref: 0044419E
GetLastError.KERNEL32(?,00437877,004F2E1F,?,00578900,00000010,00437957,004F2E1F,?,00000000,?), ref: 004441A8

Memory Dump Source

Source File: 00000000.00000002.2007216495.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007216495.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007216495.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ConsoleErrorFileLastOutputWrite
String ID:
API String ID: 2915228174-0
Opcode ID: 66e0ddea0cb217b6ae80d1a32b3b59e934d250a7623237bbde176196d2ee28a3
Instruction ID: 0628d0172fcac0a10c399004d6184d52a202fa31f39ed19b8586a1ab0f8a80ff
Opcode Fuzzy Hash: 66e0ddea0cb217b6ae80d1a32b3b59e934d250a7623237bbde176196d2ee28a3
Instruction Fuzzy Hash: 2B61C471900119AFEF11CFA8DC84BEFBBB9BF99304F14014AE900A7202D779D955DB65

Uniqueness

Uniqueness Score: -1.00%

Function 004122A0 Relevance: 3.2, APIs: 2, Instructions: 185COMMON

Download Yara Rule

APIs

__fread_nolock.LIBCMT ref: 0041243B
__fread_nolock.LIBCMT ref: 0041245D

Memory Dump Source

Source File: 00000000.00000002.2007216495.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007216495.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007216495.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: __fread_nolock
String ID:
API String ID: 2638373210-0
Opcode ID: a6de1df37dfb96f7904da2523f795a48f12aff5b6393de5a7868983c18ffdd9b
Instruction ID: b5ec34bd29a15183def94e688a440539f4bf7795f8ca6c39a07d260135894a7b
Opcode Fuzzy Hash: a6de1df37dfb96f7904da2523f795a48f12aff5b6393de5a7868983c18ffdd9b
Instruction Fuzzy Hash: 82615B326042058FCB18CF2DD9809AA77E1EF88720F05866EFC58CB345E775DC698B99

Uniqueness

Uniqueness Score: -1.00%

Function 0044368F Relevance: 3.1, APIs: 2, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(00000000,00000000,CF830579,?,00443576,00000000,CF830579,00578C68,0000000C,00443632,0043790D,?), ref: 004436E5
GetLastError.KERNEL32(?,00443576,00000000,CF830579,00578C68,0000000C,00443632,0043790D,?), ref: 004436EF

Memory Dump Source

Source File: 00000000.00000002.2007216495.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007216495.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007216495.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ChangeCloseErrorFindLastNotification
String ID:
API String ID: 1687624791-0
Opcode ID: b78c23c39475fb946a6917cc79ada02ff23f82b2eae8cc914a7116fd1dd25ee2
Instruction ID: 5b9e54e71ebf2813978f3334a6ac8d2e590d94fd15b88a1802dc34040f0fcd9e
Opcode Fuzzy Hash: b78c23c39475fb946a6917cc79ada02ff23f82b2eae8cc914a7116fd1dd25ee2
Instruction Fuzzy Hash: 0B118C326041153AF6302A34AC4DB3F67898B82F39F26014FF908873C2DE6D8D409658

Uniqueness

Uniqueness Score: -1.00%

Function 0043CDAC Relevance: 3.1, APIs: 2, Instructions: 52COMMONLIBRARYCODE

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(00000000,00000000,00437957,00000000,00000002,00000000,00000000,00000000,00000000,?,0043CEE6,00000000,00000000,00437957,00000002,00000000), ref: 0043CDE8
GetLastError.KERNEL32(00000000,?,0043CEE6,00000000,00000000,00437957,00000002,00000000,?,004440BE,00000000,00000000,00000000,00000002,00437957,00000000), ref: 0043CDF5

Memory Dump Source

Source File: 00000000.00000002.2007216495.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007216495.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007216495.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 0af088d07c5e9b5a66b5e22e0931705f94c426e6b0292fcf303bea830e5f1f74
Instruction ID: 056746620e1e5b2230fb06e89194d4bad5ac0bf9516e57b03a2b19a767fcc837
Opcode Fuzzy Hash: 0af088d07c5e9b5a66b5e22e0931705f94c426e6b0292fcf303bea830e5f1f74
Instruction Fuzzy Hash: 62012632614119AFCF058F59CC49D9E3F2AEF89320F24020AF811AB2D0EA75ED41DBD4

Uniqueness

Uniqueness Score: -1.00%

Function 00405D90 Relevance: 3.0, APIs: 2, Instructions: 30COMMON

Download Yara Rule

APIs

___std_fs_directory_iterator_advance@8.LIBCPMT ref: 00405D9E

Part of subcall function 0042C80A: FindNextFileW.KERNELBASE(?,?,?,00405DA3,?,?), ref: 0042C813

___std_fs_directory_iterator_advance@8.LIBCPMT ref: 00405DB7

Part of subcall function 0042C80A: GetLastError.KERNEL32(?,00405DA3,?,?), ref: 0042C821

Memory Dump Source

Source File: 00000000.00000002.2007216495.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007216495.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007216495.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ___std_fs_directory_iterator_advance@8$ErrorFileFindLastNext
String ID:
API String ID: 1771861590-0
Opcode ID: eb254d40bdae5997d1b915ee938d47a4925237b4d84c79f510e65dea7e6ef008
Instruction ID: 0108473d78f0f304d06e31c26ecc01ded597c2f8cb716c03f48c3c202a603d91
Opcode Fuzzy Hash: eb254d40bdae5997d1b915ee938d47a4925237b4d84c79f510e65dea7e6ef008
Instruction Fuzzy Hash: 02E09232200A212299503513AD055EFAB5EEE913A4740403BFA05A7781EB38EC1285E9

Uniqueness

Uniqueness Score: -1.00%

Function 004458AA Relevance: 3.0, APIs: 2, Instructions: 22memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(00000000,00000000,?,0044C3D9,?,00000000,?,?,0044C67A,?,00000007,?,?,0044CB6E,?,?), ref: 004458C0
GetLastError.KERNEL32(?,?,0044C3D9,?,00000000,?,?,0044C67A,?,00000007,?,?,0044CB6E,?,?), ref: 004458CB

Memory Dump Source

Source File: 00000000.00000002.2007216495.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007216495.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007216495.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: faeb12ccb0e26dc965f9d80f3c1b711b705900c11bc95a42bd6c0ce8c2310291
Instruction ID: 23237336ed7649a93a226213d1d5fd37ccb1674bfa2126fe5f49bd5de7ec7b5d
Opcode Fuzzy Hash: faeb12ccb0e26dc965f9d80f3c1b711b705900c11bc95a42bd6c0ce8c2310291
Instruction Fuzzy Hash: 75E086315006146BDB113FB9EC0DBAA3BA8EB44355F519026F709D7161CF788854D7C8

Uniqueness

Uniqueness Score: -1.00%

Function 004D1860 Relevance: 2.0, APIs: 1, Instructions: 549fileCOMMON

Download Yara Rule

APIs

DeleteFileA.KERNELBASE(?), ref: 004D1911

Memory Dump Source

Source File: 00000000.00000002.2007216495.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007216495.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007216495.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: a4067626d450e140927f30566bcb3f5f13dc5ee24b7ebb62ed89108156141035
Instruction ID: 595fb68b70b26d2d20b0dfc54c8cde64091a38ddc6938181b846cdeea2eef5ff
Opcode Fuzzy Hash: a4067626d450e140927f30566bcb3f5f13dc5ee24b7ebb62ed89108156141035
Instruction Fuzzy Hash: 3C22C1B0D002099FCB14DFA8D995BAEBBB1FF48304F14825EE805AB352D734AA45CF95

Uniqueness

Uniqueness Score: -1.00%

Function 00425390 Relevance: 1.8, APIs: 1, Instructions: 268COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 004254A7

Memory Dump Source

Source File: 00000000.00000002.2007216495.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007216495.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007216495.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 0135a771d94612305155d4bedf15d44cb2e9a3041a2a59555f0273477d00dd07
Instruction ID: c4b725e649f7e58322d65e55cd69c4218f7731d497adffb4160b667c7d72a65a
Opcode Fuzzy Hash: 0135a771d94612305155d4bedf15d44cb2e9a3041a2a59555f0273477d00dd07
Instruction Fuzzy Hash: D7810372700515AFC708EF38E98597EB7A9EF443207A4832EE819C7385EA34EE55C794

Uniqueness

Uniqueness Score: -1.00%

Function 004F3550 Relevance: 1.7, APIs: 1, Instructions: 170COMMON

Download Yara Rule

APIs

__fread_nolock.LIBCMT ref: 004F36E5

Memory Dump Source

Source File: 00000000.00000002.2007216495.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007216495.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007216495.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: __fread_nolock
String ID:
API String ID: 2638373210-0
Opcode ID: ac2fe1fdd1d305da311f708790251e2dbeebfcc096343714379e97417a5c921e
Instruction ID: 32bcb13d06159bcbf1e711c284ff9f9cb594162b32a10293023583a718d1283d
Opcode Fuzzy Hash: ac2fe1fdd1d305da311f708790251e2dbeebfcc096343714379e97417a5c921e
Instruction Fuzzy Hash: 8C51A1B0D002099FDB14DF59D981BAEFBB0FF49704F14825EE8046B342D7799A41CB95

Uniqueness

Uniqueness Score: -1.00%

Function 004F3350 Relevance: 1.7, APIs: 1, Instructions: 163COMMON

Download Yara Rule

APIs

__fread_nolock.LIBCMT ref: 004F34EF

Memory Dump Source

Source File: 00000000.00000002.2007216495.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007216495.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007216495.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: __fread_nolock
String ID:
API String ID: 2638373210-0
Opcode ID: ef3477f15171163ca3a83896ce0a7433280ff029a887a87f02df4f291d8d58ed
Instruction ID: 6ce4f48939319f72f3aec6a6d9b50e6fff9bcb1e6f6dae555552d8831335830b
Opcode Fuzzy Hash: ef3477f15171163ca3a83896ce0a7433280ff029a887a87f02df4f291d8d58ed
Instruction Fuzzy Hash: 2551A0B0D002099FDB14DF59D981BAEFBB0FF49704F14825EE8146B341E779AA41CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 00433692 Relevance: 1.7, APIs: 1, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2007216495.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007216495.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007216495.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eede66d756e0c1a0b5e07baf9b01a7231fde42cae16d6e993eff2dc43bb1a5b1
Instruction ID: 8d691b3f4dbeef2f936747217c2848be1b4780fc272094865f28ed7dea4c0760
Opcode Fuzzy Hash: eede66d756e0c1a0b5e07baf9b01a7231fde42cae16d6e993eff2dc43bb1a5b1
Instruction Fuzzy Hash: 7B51E3B4A00104AFDB14DF59CC85AAABBF1EF4D324F24915AF8099B352D379EE41CB94

Uniqueness

Uniqueness Score: -1.00%

Function 004F3750 Relevance: 1.6, APIs: 1, Instructions: 141COMMON

Download Yara Rule

APIs

__fread_nolock.LIBCMT ref: 004F38B5

Memory Dump Source

Source File: 00000000.00000002.2007216495.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007216495.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007216495.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: __fread_nolock
String ID:
API String ID: 2638373210-0
Opcode ID: 1c393b77a678177202ae0a4b35ab124da8259f0f62cb0e23b0d2acb6517c6524
Instruction ID: cd4a1da141f317168313a104556b472c5763c058f69814c45053fc560e84e052
Opcode Fuzzy Hash: 1c393b77a678177202ae0a4b35ab124da8259f0f62cb0e23b0d2acb6517c6524
Instruction Fuzzy Hash: 6A5180B0D002099BDB24DF59D982BAEFBF0FF44714F14061EE5416B341D779AA44CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 004035B0 Relevance: 1.6, APIs: 1, Instructions: 125COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 004036E7

Memory Dump Source

Source File: 00000000.00000002.2007216495.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007216495.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007216495.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 900155ca0dd1314eead5f8e5303eee4f11c8eb786659eda044bee85053514b91
Instruction ID: b9d4245d5dcab57e39e5a3b07e56f9f2a2320c6166ca48ee61a96fda454eaaa4
Opcode Fuzzy Hash: 900155ca0dd1314eead5f8e5303eee4f11c8eb786659eda044bee85053514b91
Instruction Fuzzy Hash: EA414872B00000AFC718DE3DC98586EBBADEF85314714867EE815DB385EA35EE058765

Uniqueness

Uniqueness Score: -1.00%

Function 00405AD0 Relevance: 1.6, APIs: 1, Instructions: 117COMMON

Download Yara Rule

APIs

___std_fs_directory_iterator_open@12.LIBCPMT ref: 00405BB1

Memory Dump Source

Source File: 00000000.00000002.2007216495.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007216495.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007216495.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ___std_fs_directory_iterator_open@12
String ID:
API String ID: 29801545-0
Opcode ID: f696d6151f309be9193cc7c85e873ba70de42943ce5765209a9c4d3a5a8c60fc
Instruction ID: d5a1cf4f232f5c6ac5430c54351a6ee74597bd081f23ad9fa31e924e3bde2b96
Opcode Fuzzy Hash: f696d6151f309be9193cc7c85e873ba70de42943ce5765209a9c4d3a5a8c60fc
Instruction Fuzzy Hash: 8741CF72E146049BDB18DF49D8817AEB7B4FB84320F14466AEC11637C1EB397D50CA95

Uniqueness

Uniqueness Score: -1.00%

Function 004254C0 Relevance: 1.6, APIs: 1, Instructions: 113COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 004255BB

Memory Dump Source

Source File: 00000000.00000002.2007216495.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007216495.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007216495.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 662d4eb6b92c4b89937c882f51579e2c24e781042207b5e4d8dfa5cecce3f860
Instruction ID: b55e259dbeb527f6be1e3a55ae8afcab0a3919011b56be8b9cf3d81180561e7d
Opcode Fuzzy Hash: 662d4eb6b92c4b89937c882f51579e2c24e781042207b5e4d8dfa5cecce3f860
Instruction Fuzzy Hash: 79316B72B00024AFC704DE3DD98587E7BBADF84350794427AF818CB349EA38DE4583A5

Uniqueness

Uniqueness Score: -1.00%

Function 00408980 Relevance: 1.6, APIs: 1, Instructions: 108libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(?,00000000), ref: 00408A31

Memory Dump Source

Source File: 00000000.00000002.2007216495.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007216495.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007216495.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: e778ac258585310e7fe4938e31092008cd6e18a3a51d75130e0cc209c0f13ca7
Instruction ID: d2c8f323ac81831e6b5d26602da7a52bd27c9e45b28783f3ac091e4753249403
Opcode Fuzzy Hash: e778ac258585310e7fe4938e31092008cd6e18a3a51d75130e0cc209c0f13ca7
Instruction Fuzzy Hash: DD514AB8D05218EBDB14CF98DA90ADDFBB1BB48350F2081AAD849B7340DB306B84DF55

Uniqueness

Uniqueness Score: -1.00%

Function 0044550F Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

__wsopen_s.LIBCMT ref: 00445549

Memory Dump Source

Source File: 00000000.00000002.2007216495.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007216495.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007216495.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: __wsopen_s
String ID:
API String ID: 3347428461-0
Opcode ID: 74b1a02970c39c47b45041c200990e685aac7fc35223ed5dd6a5c291d0407c3c
Instruction ID: e92d0ab7a98c68cd7689e4ea664d55cb742e11440dbe97f573872f5ababe4450
Opcode Fuzzy Hash: 74b1a02970c39c47b45041c200990e685aac7fc35223ed5dd6a5c291d0407c3c
Instruction Fuzzy Hash: D6112A71A0410AAFDF05DF58E94199F7BF5EF48304F14405AF805EB352D670DA15CB69

Uniqueness

Uniqueness Score: -1.00%

Function 004036F0 Relevance: 1.5, APIs: 1, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 0040373F

Memory Dump Source

Source File: 00000000.00000002.2007216495.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007216495.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007216495.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: e5a001d352be6fc784b676a6f4ac94111781e1afefaa75c774d19f4d874569f3
Instruction ID: 1f83190ccb7284a945d627c352a8af0deec80e54417847a9b28e6d6de5687d5d
Opcode Fuzzy Hash: e5a001d352be6fc784b676a6f4ac94111781e1afefaa75c774d19f4d874569f3
Instruction Fuzzy Hash: F6F024F26000009BCB14AF61E4429FAB7ECDE243A7750447FF989D7282E73EDA448788

Uniqueness

Uniqueness Score: -1.00%

Function 00444EEA Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,0042C58A,00417EFF,?,00444870,00000001,00000364,00417EFF,00000008,000000FF,?,0042F3CF,00417EFD,00417EFB,?,?), ref: 00444F2B

Memory Dump Source

Source File: 00000000.00000002.2007216495.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007216495.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007216495.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: a67815bf3a869f96681a983d491eb3b40caf69aff6fa6519728d0dfc96a736c8
Instruction ID: 086544c5e523b8e02c2757f3417cf7e9bd7439c420b709eac9e7cfb6d4d974b4
Opcode Fuzzy Hash: a67815bf3a869f96681a983d491eb3b40caf69aff6fa6519728d0dfc96a736c8
Instruction Fuzzy Hash: CEF0B4316155246BBB215E629C05B7B7788ABD17A1F158417FD04E7280CE38D80886E9

Uniqueness

Uniqueness Score: -1.00%

Function 004F1F00 Relevance: 1.5, APIs: 1, Instructions: 35COMMON

Download Yara Rule

APIs

SetupDiGetClassDevsA.SETUPAPI(00562560,00000000,00000000,00000012), ref: 004F1F17

Memory Dump Source

Source File: 00000000.00000002.2007216495.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007216495.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007216495.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ClassDevsSetup
String ID:
API String ID: 2330331845-0
Opcode ID: bdd51cae4c084c57fcc4901e949a17f5d6d576fa70ecaa2978942f43ecf13d9a
Instruction ID: bee270daeaff66964e48d3d321f2ef6a0a83fe545a7604eea2b81030ab9a0a7d
Opcode Fuzzy Hash: bdd51cae4c084c57fcc4901e949a17f5d6d576fa70ecaa2978942f43ecf13d9a
Instruction Fuzzy Hash: E4F0E970B1071857D3309F28AC05357BBE49B51B14F10075EF5458B3C1E7F5699853D6

Uniqueness

Uniqueness Score: -1.00%

Function 00445924 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,00417EFF,00417EFB,?,0042F3CF,00417EFD,00417EFB,?,?,?,0040390D,0042C58A,00417EFF,00417EFB,0042C58A), ref: 00445956

Memory Dump Source

Source File: 00000000.00000002.2007216495.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007216495.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007216495.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: f2b14cbab143d06f1f7f7dbb6931a5cb890e65deebc000058d543e0d14a0fef9
Instruction ID: 47241cb67a9c7b30d4e0b830f1b418076ccf533a730137c1b779a77b3e9f7ccf
Opcode Fuzzy Hash: f2b14cbab143d06f1f7f7dbb6931a5cb890e65deebc000058d543e0d14a0fef9
Instruction Fuzzy Hash: 1CE0E571202A20EBFE252F265C0576B3648DB413B0F080113FD05F6292DB68CC0482ED

Uniqueness

Uniqueness Score: -1.00%

Function 00405AA0 Relevance: 1.5, APIs: 1, Instructions: 21COMMON

Download Yara Rule

APIs

___std_fs_directory_iterator_advance@8.LIBCPMT ref: 00405AB3

Part of subcall function 0042C80A: FindNextFileW.KERNELBASE(?,?,?,00405DA3,?,?), ref: 0042C813

Memory Dump Source

Source File: 00000000.00000002.2007216495.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007216495.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007216495.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: FileFindNext___std_fs_directory_iterator_advance@8
String ID:
API String ID: 3878998205-0
Opcode ID: 81b8d4adac4151a37c88ea3531144291c0ed1dde65bf57112f3d275560818ac6
Instruction ID: f6ea285aba16a13ea3ec76640246895ff5761922bd5c6c82d3b00af4906e1a90
Opcode Fuzzy Hash: 81b8d4adac4151a37c88ea3531144291c0ed1dde65bf57112f3d275560818ac6
Instruction Fuzzy Hash: BED0A721300930115E65712738405FF4A5ACED2778B04017FB904F33C2EA2C4C038CED

Uniqueness

Uniqueness Score: -1.00%

Function 00440F65 Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00440F6C

Memory Dump Source

Source File: 00000000.00000002.2007216495.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007216495.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007216495.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: H_prolog3
String ID:
API String ID: 431132790-0
Opcode ID: 6a1e62305c3acb8e5222b1c12e093a7fef9c21457bd0ab900d0622aaa7e19f4a
Instruction ID: aff0934107e9bc2afc1ed01947bee51e3b082187fcc3c1abf97fb91d30d5be1b
Opcode Fuzzy Hash: 6a1e62305c3acb8e5222b1c12e093a7fef9c21457bd0ab900d0622aaa7e19f4a
Instruction Fuzzy Hash: 95E09A72D0020D9ADB00DFD5D456BEFBBB8AB08314F50416BA605E7181EB785748CBE5

Uniqueness

Uniqueness Score: -1.00%

Function 0043D21C Relevance: 1.5, APIs: 1, Instructions: 15fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,?,?,?,?,?,00000000), ref: 0043D239

Memory Dump Source

Source File: 00000000.00000002.2007216495.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007216495.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007216495.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: a91d23867b62d5b96c41623edd2e8bd3ad87182c46de236b94739b51406d3068
Instruction ID: 7ae74b51c889a2cb05e6a06522f477e8d6926b4a8c7f3733491aa3a38d366a2c
Opcode Fuzzy Hash: a91d23867b62d5b96c41623edd2e8bd3ad87182c46de236b94739b51406d3068
Instruction Fuzzy Hash: 92D06C3200010DBBDF028F84DC06EDA3BAAFB4C714F014040FA1866120C772E822EB90

Uniqueness

Uniqueness Score: -1.00%

Function 00408FE0 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

FreeLibrary.KERNELBASE(6C590000), ref: 00408FF3

Memory Dump Source

Source File: 00000000.00000002.2007216495.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007216495.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007216495.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: 308e6b39f116d145aea3c2b24b2b05ac875d59807b2ada3de83e787a582b006c
Instruction ID: c70e8580a0d1111b0a5d225c9a9e9d8cc6a6b0ca9556e84d53e49695d3c6a0de
Opcode Fuzzy Hash: 308e6b39f116d145aea3c2b24b2b05ac875d59807b2ada3de83e787a582b006c
Instruction Fuzzy Hash: 2FC0027450414156D7159738DC487623B54A761758FC810769841B2AE2CE789448EB55

Uniqueness

Uniqueness Score: -1.00%

Function 00408FE1 Relevance: 1.5, APIs: 1, Instructions: 8COMMON

Download Yara Rule

APIs

FreeLibrary.KERNELBASE(6C590000), ref: 00408FF3

Memory Dump Source

Source File: 00000000.00000002.2007216495.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007216495.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007216495.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: e1b8b5312981e26a60b0176e6b126c99adc267963dcf4990b13cab83b377898a
Instruction ID: 490db17b99ce191f58a9b4e04f03cf5ce589e7a007bfd414fe16c1c7cc511007
Opcode Fuzzy Hash: e1b8b5312981e26a60b0176e6b126c99adc267963dcf4990b13cab83b377898a
Instruction Fuzzy Hash: 23C012680082C29BCB0693358848365AE00AF23218F8804AE8880A66D3CDA94008DB15

Uniqueness

Uniqueness Score: -1.00%

Function 004D2040 Relevance: 1.3, APIs: 1, Instructions: 33sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000065,?,?,?,?,?,?,?,?,?,?,?,00458D52), ref: 004D2093

Memory Dump Source

Source File: 00000000.00000002.2007216495.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007216495.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007216495.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 83f2b2eca9ec0b48552a48ca10ae59a4487ce3495c761ca9039c3b03c55a5e39
Instruction ID: 5725677e75a6ac36c440eb726a8cd5388f75a9debdf55df4042df7e65aebbe00
Opcode Fuzzy Hash: 83f2b2eca9ec0b48552a48ca10ae59a4487ce3495c761ca9039c3b03c55a5e39
Instruction Fuzzy Hash: 20F0E221A0025016EA22B2792D0673A3F85A7A6724F48018BEF423B7D2DAD82D0983D6

Uniqueness

Uniqueness Score: -1.00%

Function 004D20B0 Relevance: 1.3, APIs: 1, Instructions: 33sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00000065), ref: 004D2103

Memory Dump Source

Source File: 00000000.00000002.2007216495.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007216495.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007216495.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 35fb44faf0a8fc100d841d81db4c77c8e28ab7600db3ad407436fbe4614108cb
Instruction ID: 16727208b5f08e4bea599353fbf53a6d413f31fbfb73884cdf8f34aab55cbcc4
Opcode Fuzzy Hash: 35fb44faf0a8fc100d841d81db4c77c8e28ab7600db3ad407436fbe4614108cb
Instruction Fuzzy Hash: B8F0A731B0025416EA26736D7E06B3B3F8997A5765F48009FEE403BBD2DDD9280987D6

Uniqueness

Uniqueness Score: -1.00%

Function 004D2120 Relevance: 1.3, APIs: 1, Instructions: 33sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00000065,?,?,?,?,?,?,?,?,?,?,?,00458D4D), ref: 004D2173

Memory Dump Source

Source File: 00000000.00000002.2007216495.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007216495.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007216495.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: cb4445f8f23e35d184d7bbbb276354b3f66d002ad20050ef745446d9cc5894b3
Instruction ID: 90a6c49b21b0fd82ae87a0f264113b7d17b526517561dc18198510732a1b952e
Opcode Fuzzy Hash: cb4445f8f23e35d184d7bbbb276354b3f66d002ad20050ef745446d9cc5894b3
Instruction Fuzzy Hash: 53F0E225A0024016EA21B26D2D07B3B3FA587E5724F48008BEE403B7E2E998690D93D6

Uniqueness

Uniqueness Score: -1.00%

Function 004D1F60 Relevance: 1.3, APIs: 1, Instructions: 33sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00000065), ref: 004D1FB3

Memory Dump Source

Source File: 00000000.00000002.2007216495.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007216495.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007216495.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 8cc8233da0b4eadc4345afef26914da44cd989e3a36f9e64d21921473576aba7
Instruction ID: 96813e4978320da69047605bdc5ebc2db0ede144c46c0996891fef61e0d73129
Opcode Fuzzy Hash: 8cc8233da0b4eadc4345afef26914da44cd989e3a36f9e64d21921473576aba7
Instruction Fuzzy Hash: F1F02731B0425026EA25736D7D06B3A3F858795724F48018FED002BBE3DE99280987D7

Uniqueness

Uniqueness Score: -1.00%

Function 004D1FD0 Relevance: 1.3, APIs: 1, Instructions: 33sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000065,?,?,?,?,?,?,?,?,?,?,?,00458D57), ref: 004D2023

Memory Dump Source

Source File: 00000000.00000002.2007216495.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007216495.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007216495.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 023d8daf2c2feeef625063db40c37107e19a346fd89d2fc77cc72de507247420
Instruction ID: 649beb9cb224a865d551f479db4d9118ca68f30c140776fc94dbe4ded046f890
Opcode Fuzzy Hash: 023d8daf2c2feeef625063db40c37107e19a346fd89d2fc77cc72de507247420
Instruction Fuzzy Hash: 76F0E921A4224016DA2272693D067363F8587A5764F04104FEF00377D2D9D42809C7D6

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 004F2150 Relevance: 31.7, APIs: 17, Strings: 1, Instructions: 154windowfileCOMMON

Download Yara Rule

APIs

GdiplusStartup.GDIPLUS(?,0045A92C,00000000,7FFFFFFF,?), ref: 004F2189
GetSystemMetrics.USER32(00000001), ref: 004F219F
GetSystemMetrics.USER32(00000000), ref: 004F21A5
GetDC.USER32(00000000), ref: 004F21AB
CreateCompatibleDC.GDI32(00000000), ref: 004F21BF
CreateCompatibleBitmap.GDI32(00000000,00000000,00000000), ref: 004F21D3
SelectObject.GDI32(?,00000000), ref: 004F21E8
BitBlt.GDI32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00CC0020), ref: 004F2201
GdipCreateBitmapFromHBITMAP.GDIPLUS(00584418,00000000,00000000), ref: 004F2217
GdipGetImageEncodersSize.GDIPLUS(00000000,?), ref: 004F2233
GdipGetImageEncoders.GDIPLUS(00000000,00000000,00000000), ref: 004F225A
GdipSaveImageToFile.GDIPLUS(00000000,6F2977B7,?,?), ref: 004F22FD
DeleteObject.GDI32(00584418), ref: 004F2306
GdipDisposeImage.GDIPLUS(00000000), ref: 004F230D
DeleteObject.GDI32(?), ref: 004F2316
ReleaseDC.USER32(00000000,00000000), ref: 004F231F
GdiplusShutdown.GDIPLUS(?), ref: 004F2328

Strings

image/png, xrefs: 004F2272

Memory Dump Source

Source File: 00000000.00000002.2007216495.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007216495.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007216495.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Gdip$Image$CreateObject$BitmapCompatibleDeleteEncodersGdiplusMetricsSystem$DisposeFileFromReleaseSaveSelectShutdownSizeStartup
String ID: image/png
API String ID: 258367123-2966254431
Opcode ID: fb1bbdcbdec57114dd12a1ee1549e3a4fa01625a0ff2eb2c6bcf6a3c4bb0fd9d
Instruction ID: db5a99caf6ac0e95f343f652cfce475829ccb6d2aa326760d5af157a7b9552c8
Opcode Fuzzy Hash: fb1bbdcbdec57114dd12a1ee1549e3a4fa01625a0ff2eb2c6bcf6a3c4bb0fd9d
Instruction Fuzzy Hash: C8516D71D00209AFDF109FA4DD49BEEBBB8FF18314F100065EA05B72A1D7B99948DB64

Uniqueness

Uniqueness Score: -1.00%

Function 0052A080 Relevance: 23.5, Strings: 18, Instructions: 970COMMON

Download Yara Rule

Strings

index, xrefs: 0052A198
sqlite_, xrefs: 0052A22A
sqlite_autoindex_%s_%d, xrefs: 0052A3ED
conflicting ON CONFLICT clauses specified, xrefs: 0052A85A
name='%q', xrefs: 0052AAAC
table %s may not be indexed, xrefs: 0052A269
CREATE%s INDEX %.*s, xrefs: 0052AA0E
there is already a table named %s, xrefs: 0052A36A
UNIQUE, xrefs: 0052A9FA
hU, xrefs: 0052ABB2
%s %T cannot reference objects in database %s, xrefs: 0052A19D
virtual tables may not be indexed, xrefs: 0052A285
sqlite_master, xrefs: 0052AA37
table %s has no column named %s, xrefs: 0052A720
pkU, xrefs: 0052ABBC
INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);, xrefs: 0052AA3F
index %s already exists, xrefs: 0052A3D0
altertab_, xrefs: 0052A24E

Memory Dump Source

Source File: 00000000.00000002.2007216495.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007216495.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007216495.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID: UNIQUE$%s %T cannot reference objects in database %s$CREATE%s INDEX %.*s$INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);$altertab_$conflicting ON CONFLICT clauses specified$index$index %s already exists$name='%q'$pkU$sqlite_$sqlite_autoindex_%s_%d$sqlite_master$table %s has no column named %s$table %s may not be indexed$there is already a table named %s$virtual tables may not be indexed$hU
API String ID: 0-4232462188
Opcode ID: 8d8e348df3eb0c30f3b8e1ec99145f6a2f48bff374bc3e7a667263807fad0248
Instruction ID: e93dd321a033fea174b589206a083260ae5da8e2c1557436a8bfc2c3ffc6432b
Opcode Fuzzy Hash: 8d8e348df3eb0c30f3b8e1ec99145f6a2f48bff374bc3e7a667263807fad0248
Instruction Fuzzy Hash: 8D82A274A002669FDB14CF68D494BAEBFB1BF46304F188569EC05AB382D735ED41CB92

Uniqueness

Uniqueness Score: -1.00%

Function 004DB380 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 287injectionmemorysynchronizationCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNEL32(00000000,00000000,?,00003000,00000040,?,00000000), ref: 004DB3EA
WriteProcessMemory.KERNEL32(00000000,00000000,t-M,?,00000000), ref: 004DB406
WriteProcessMemory.KERNEL32(?,?,?,?,00000000), ref: 004DB43F
VirtualAllocEx.KERNEL32(?,00000000,00001000,00003000,00000040), ref: 004DB469
WriteProcessMemory.KERNEL32(?,?,?,00000218,00000000,00588C74,00000000,?,?), ref: 004DB667
WriteProcessMemory.KERNEL32(?,?,004DB750,-00000010,00000000), ref: 004DB687
CreateRemoteThread.KERNEL32(?,00000000,00000000,?,?,00000000,00000000), ref: 004DB69A
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 004DB6A3

Strings

t-M, xrefs: 004DB3C0, 004DB3C7, 004DB3CC, 004DB3D0, 004DB3F4, 004DB3FC, 004DB6F3, 004DB424, 004DB429, 004DB400, 004DB712
%s|%s, xrefs: 004DB646

Memory Dump Source

Source File: 00000000.00000002.2007216495.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007216495.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007216495.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: MemoryProcessWrite$AllocVirtual$CreateObjectRemoteSingleThreadWait
String ID: %s|%s$t-M
API String ID: 2137838514-2592370387
Opcode ID: 502cd35e78cc367812a42df3840befbd2d79fc952882e913ae0aa7bcc4483364
Instruction ID: 6aa050c662bd13d499a16f11a1e563ae193b69cbb3db5d026509a3591e8fd703
Opcode Fuzzy Hash: 502cd35e78cc367812a42df3840befbd2d79fc952882e913ae0aa7bcc4483364
Instruction Fuzzy Hash: 6AC1AD719002089FDB14CFA8DC95BAEBBB5FF48300F10815AE905BB391DB74A984DFA5

Uniqueness

Uniqueness Score: -1.00%

Function 004EC100 Relevance: 11.0, APIs: 7, Instructions: 534fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(00000000,?,?,?,0040EE72,?,?,?,74DF3100,00000000), ref: 004EC2D1
CreateDirectoryA.KERNEL32(00000000,00000000,0000002E,0000002F,?,?,?,?,0056AD5C,00000001,0000002E,0000002F,?,?), ref: 004EC51B
CopyFileA.KERNEL32(00000000,00000000,00000000), ref: 004EC686
FindNextFileA.KERNEL32(00000000,?), ref: 004EC69C
FindClose.KERNEL32(00000000), ref: 004EC6AC
GetLastError.KERNEL32 ref: 004EC6B2
GetLastError.KERNEL32 ref: 004EC6D0

Memory Dump Source

Source File: 00000000.00000002.2007216495.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007216495.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007216495.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: FileFind$ErrorLast$CloseCopyCreateDirectoryFirstNext
String ID:
API String ID: 1590598969-0
Opcode ID: c59fc84a10852f54f29d60a547431813f4d760406089d517f69196a3d814b764
Instruction ID: 747cd6a67703dac2eb993d4e5b6231773c294ce311ce67402da0ef740dec2945
Opcode Fuzzy Hash: c59fc84a10852f54f29d60a547431813f4d760406089d517f69196a3d814b764
Instruction Fuzzy Hash: E622E070C00248CFDB14DF68C8847EEBBB5BF19305F14429EE859AB292D7389A85CB95

Uniqueness

Uniqueness Score: -1.00%

Function 0044F050 Relevance: 10.2, APIs: 1, Strings: 4, Instructions: 1473COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 0044F267

Strings

1#QNAN, xrefs: 0044F163
1#SNAN, xrefs: 0044F15C
1#IND, xrefs: 0044F155
1#INF, xrefs: 0044F186

Memory Dump Source

Source File: 00000000.00000002.2007216495.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007216495.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007216495.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: da9375122c7f38aef1b98b42bf48e098612be30453a2df058743415e8865b902
Instruction ID: 19b2b9832e91dc5334225f28d461ebb5f9cd7fa0aaab348ffad5a30d2ce72a94
Opcode Fuzzy Hash: da9375122c7f38aef1b98b42bf48e098612be30453a2df058743415e8865b902
Instruction Fuzzy Hash: 0FD23971E086288FDB64CE28DD447EAB7B5EB45305F1401EBD80DE7241EB78AE898F45

Uniqueness

Uniqueness Score: -1.00%

Function 005233F0 Relevance: 10.1, Strings: 7, Instructions: 1371COMMON

Download Yara Rule

Strings

rows inserted, xrefs: 005245B5
table %S has %d columns but %d values were supplied, xrefs: 00523A39
ROWID, xrefs: 00523BC2
_ROWID_, xrefs: 00523BAD
OID, xrefs: 00523BD2
%d values for %d columns, xrefs: 00523B03
table %S has no column named %s, xrefs: 00523C0F

Memory Dump Source

Source File: 00000000.00000002.2007216495.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007216495.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007216495.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID: %d values for %d columns$OID$ROWID$_ROWID_$rows inserted$table %S has %d columns but %d values were supplied$table %S has no column named %s
API String ID: 0-557196483
Opcode ID: 12b426f7bdbe98775aa7440f51adb549263eb548123024e11ef7e24f224fe659
Instruction ID: e16d57ff769c01e613f081803d3a99e8b2fa06a3413bbdfdeb6f383a167cc5c4
Opcode Fuzzy Hash: 12b426f7bdbe98775aa7440f51adb549263eb548123024e11ef7e24f224fe659
Instruction Fuzzy Hash: 84D269706047528FD724DF28D444B2ABBE1FF86304F15895DE88A8B392E779E945CF82

Uniqueness

Uniqueness Score: -1.00%

Function 00513320 Relevance: 7.4, Strings: 5, Instructions: 1164COMMON

Download Yara Rule

Strings

ROWID, xrefs: 00513608
no such column: %s, xrefs: 00513697
_ROWID_, xrefs: 005135F4
OID, xrefs: 00513618
rows updated, xrefs: 00514245

Memory Dump Source

Source File: 00000000.00000002.2007216495.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007216495.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007216495.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID: OID$ROWID$_ROWID_$no such column: %s$rows updated
API String ID: 0-3385237395
Opcode ID: c0c585efeabff36969f7bd72527d717e6c386a5e7ca283b51e524193af94d216
Instruction ID: 54983cf935286fed85f1d38aca188a08520a17ed0d3d8c2e75c97e0ee3f6277e
Opcode Fuzzy Hash: c0c585efeabff36969f7bd72527d717e6c386a5e7ca283b51e524193af94d216
Instruction Fuzzy Hash: B6C278706047428FE724DF18C0A4B6ABBF1FF88304F16895DE9968B352D775E985CB82

Uniqueness

Uniqueness Score: -1.00%

Function 0044D3EB Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 254COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 004446D2: GetLastError.KERNEL32(00000000,00417EFB,0044A0B9), ref: 004446D6
Part of subcall function 004446D2: SetLastError.KERNEL32(00000000,00000000,00417EFF,00000008,000000FF), ref: 00444778

GetACP.KERNEL32(?,?,?,?,?,?,00441B90,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 0044D4AA
IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,00441B90,?,?,?,00000055,?,-00000050,?,?), ref: 0044D4E1
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,-00000050,00000000,000000D0), ref: 0044D644

Strings

utf8, xrefs: 0044D5B3

Memory Dump Source

Source File: 00000000.00000002.2007216495.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007216495.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007216495.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ErrorLast$CodeInfoLocalePageValid
String ID: utf8
API String ID: 607553120-905460609
Opcode ID: c45a0186f4581b71202d969cc458f697c66e26bf91fa0bd1cdd2ae7615315ff2
Instruction ID: 2cfea991c2b2acc9964e98fc6b5fb71baa63820d9a3b6a37bb74a83d3ed0bc3b
Opcode Fuzzy Hash: c45a0186f4581b71202d969cc458f697c66e26bf91fa0bd1cdd2ae7615315ff2
Instruction Fuzzy Hash: F771D671A00605AAFB24AB75CC86BBB73A8EF05748F14442BF905D7281EF7CE944C769

Uniqueness

Uniqueness Score: -1.00%

Function 004371F0 Relevance: 6.5, APIs: 4, Instructions: 455COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2007216495.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007216495.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007216495.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df95842549be15c8087ce8587c1e81bb78068c8bde995323ffdbbd237b0ae3a7
Instruction ID: 7de7f519c8b512efe808fbc5ffa62cc3ef6a6e83b70a7c434dda002dc4e381e9
Opcode Fuzzy Hash: df95842549be15c8087ce8587c1e81bb78068c8bde995323ffdbbd237b0ae3a7
Instruction Fuzzy Hash: 47026FB1E042199BDF24CFA9C9806AEFBF1FF48324F24826AD955E7341D735A901CB94

Uniqueness

Uniqueness Score: -1.00%

Function 004E2080 Relevance: 4.7, APIs: 3, Instructions: 219COMMON

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 004E20A0
IsProcessorFeaturePresent.KERNEL32(00000015), ref: 004E20AC
GetVolumeInformationA.KERNEL32(?,?,00000105,?,?,?,?,00000105), ref: 004E215F

Memory Dump Source

Source File: 00000000.00000002.2007216495.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007216495.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007216495.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Present$DebuggerFeatureInformationProcessorVolume
String ID:
API String ID: 3535182753-0
Opcode ID: 623aa9994b68ff213dbe910c545f283b358e46525878ba29fffe8422486bf1ad
Instruction ID: afbfdc60606ab1e9c61f519775a33832b97aa9882633c04701562a7ea04b081c
Opcode Fuzzy Hash: 623aa9994b68ff213dbe910c545f283b358e46525878ba29fffe8422486bf1ad
Instruction Fuzzy Hash: C0B103B8D0424CEBCB25CFA5DA81AEDBBB5BF19304F2441DAD885AB341EB315A44DF44

Uniqueness

Uniqueness Score: -1.00%

Function 004332F4 Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,00417EFF), ref: 004333EC
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,00417EFF), ref: 004333F6
UnhandledExceptionFilter.KERNEL32(00417BD5,?,?,?,?,?,00417EFF), ref: 00433403

Memory Dump Source

Source File: 00000000.00000002.2007216495.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007216495.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007216495.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 9f1139638b3df056369de36d10a25bd443a0870b0bf33701996310552448855e
Instruction ID: 827401fa7b85709c6d67aee7b5506a22afc2dd98f9d62e6690368e1bc4fb37e0
Opcode Fuzzy Hash: 9f1139638b3df056369de36d10a25bd443a0870b0bf33701996310552448855e
Instruction Fuzzy Hash: 5731C2749012289BCB21DF69D9897CDBBB8BF18314F5051EAE41CA7250EB749F858F48

Uniqueness

Uniqueness Score: -1.00%

Function 00541180 Relevance: 4.5, Strings: 3, Instructions: 710COMMON

Download Yara Rule

Strings

pkU, xrefs: 00541366, 005415DF, 00541718
hU, xrefs: 0054135C, 005415D3, 0054170C
%s-mj%08X, xrefs: 005413D8

Memory Dump Source

Source File: 00000000.00000002.2007216495.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007216495.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007216495.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID: %s-mj%08X$pkU$hU
API String ID: 0-341565662
Opcode ID: 621282d0f7e86b59c73d889168a479367e4e4b45a0f6af4de372c4ca78fdb6c3
Instruction ID: 5ca5c39a8de68291b6d3e4cc79652f43b2b7ddcad8b7fc2209c3f4d9f5c1e8c2
Opcode Fuzzy Hash: 621282d0f7e86b59c73d889168a479367e4e4b45a0f6af4de372c4ca78fdb6c3
Instruction Fuzzy Hash: 1E427E74A006069FDB14CFA9D884BEEBBF1FF58308F188069D81AA7311D775A985CB58

Uniqueness

Uniqueness Score: -1.00%

Function 00553170 Relevance: 3.5, APIs: 2, Instructions: 465COMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00553513
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00553571

Memory Dump Source

Source File: 00000000.00000002.2007216495.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007216495.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007216495.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 885266447-0
Opcode ID: d6ef0b778412603ae4375fe8f4b2b868cc24e55a123d3fdd18dfd41b4726deb8
Instruction ID: 3fbf31a8c3cdee1091fcfc22b4047fc9f3449861c1a85ea422063c13361c5e55
Opcode Fuzzy Hash: d6ef0b778412603ae4375fe8f4b2b868cc24e55a123d3fdd18dfd41b4726deb8
Instruction Fuzzy Hash: 7802F571E006598BCF19CF6DD8A42BDFFB1BF85351F1982ABE859AB281DB704A44C740

Uniqueness

Uniqueness Score: -1.00%

Function 004D3280 Relevance: 3.4, Strings: 2, Instructions: 927COMMON

Download Yara Rule

Strings

Content-Type: application/x-www-form-urlencoded, xrefs: 004D33A7
Content-Type: application/x-www-form-urlencoded, xrefs: 004D3E29

Memory Dump Source

Source File: 00000000.00000002.2007216495.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007216495.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007216495.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID: Content-Type: application/x-www-form-urlencoded$Content-Type: application/x-www-form-urlencoded
API String ID: 0-1609673914
Opcode ID: 15fddcd78b82633c546b501252666b69c8ae382b07e44ee9f8b04fb236ec00c1
Instruction ID: 33a632d0a306c15a1de1fb4794a992465f2ff5513e11846780c43e6219a31879
Opcode Fuzzy Hash: 15fddcd78b82633c546b501252666b69c8ae382b07e44ee9f8b04fb236ec00c1
Instruction Fuzzy Hash: BCB201B4D042589BCB25DFA8D991BECBBB1BF48314F14819AE84977341DB342E84CF69

Uniqueness

Uniqueness Score: -1.00%

Function 004FA050 Relevance: 3.2, APIs: 2, Instructions: 220networkCOMMON

Download Yara Rule

APIs

InternetCloseHandle.WININET(?), ref: 004FA262
InternetCloseHandle.WININET(?), ref: 004FA271

Memory Dump Source

Source File: 00000000.00000002.2007216495.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007216495.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007216495.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CloseHandleInternet
String ID:
API String ID: 1081599783-0
Opcode ID: fd654fbc9e612cb654ed9e4d8faceb9001d45f40f054eec1f6580af07df3ed4c
Instruction ID: f9047d7434dced4cf20933e84560d58d69618fbb45727c1a51f3fb53e9aaca21
Opcode Fuzzy Hash: fd654fbc9e612cb654ed9e4d8faceb9001d45f40f054eec1f6580af07df3ed4c
Instruction Fuzzy Hash: 1B814DB5E042099BDF18CF99DD81ABEBBB5FF88310F14812AE905B7340DB359911CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 0043C1FB Relevance: 3.0, APIs: 2, Instructions: 44timeCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(?), ref: 0043C210
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0043C22F

Memory Dump Source

Source File: 00000000.00000002.2007216495.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007216495.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007216495.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Time$FileSystemUnothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 1518329722-0
Opcode ID: 954a7c4d5890fab9a4c96a24ff15e7c185c2cda78a089061de3c48e681f8a955
Instruction ID: ec6cd9ee3c427c05d13ca8e13f4ecd96f164f970f8f353a80a24a946ea283c5e
Opcode Fuzzy Hash: 954a7c4d5890fab9a4c96a24ff15e7c185c2cda78a089061de3c48e681f8a955
Instruction Fuzzy Hash: 9CF0F4B1E00214BB8724CFADC88499FBEEAEAC9370B35429AF809E3340E574DD01C794

Uniqueness

Uniqueness Score: -1.00%

Function 00448314 Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,0044830F,?,?,00000008,?,?,0045277F,00000000), ref: 00448541

Memory Dump Source

Source File: 00000000.00000002.2007216495.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007216495.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007216495.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: a522b569da1b4251fc9465fad5f5be812267484b24e4dcd58fb934ad629dd70c
Instruction ID: 77f85e0033942a6f02aeb2ce0c4b177648a4ad42039305f86338891f230134e9
Opcode Fuzzy Hash: a522b569da1b4251fc9465fad5f5be812267484b24e4dcd58fb934ad629dd70c
Instruction Fuzzy Hash: 15B14B31610609DFE715CF28C48AB697BE0FF45364F25865DE899CF2A1CB39E982CB44

Uniqueness

Uniqueness Score: -1.00%

Function 0054E340 Relevance: 1.7, APIs: 1, Instructions: 167COMMON

Download Yara Rule

APIs

__allrem.LIBCMT ref: 0054E3BD

Memory Dump Source

Source File: 00000000.00000002.2007216495.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007216495.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007216495.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: __allrem
String ID:
API String ID: 2933888876-0
Opcode ID: a9d30a74fc4e9ed61f6c396232b0d774953ff2e67443f99245b097325991053d
Instruction ID: 6a3e6f16453dbbf5a8bbe516ce83afefbcf635a20edd48ca6a6075a7bef4e538
Opcode Fuzzy Hash: a9d30a74fc4e9ed61f6c396232b0d774953ff2e67443f99245b097325991053d
Instruction Fuzzy Hash: A9619D31610744CFCB19CF6DC880A5AFBF1BF95304B048AAEE886DB752C630E955CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00547260 Relevance: 1.5, Strings: 1, Instructions: 284COMMON

Download Yara Rule

Strings

d, xrefs: 00547491

Memory Dump Source

Source File: 00000000.00000002.2007216495.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007216495.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007216495.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID: d
API String ID: 0-2564639436
Opcode ID: 4a3f3b486a1d720154e68768baa6182dcaba36147a24c6d9c66db439763e9426
Instruction ID: 3fb9d88d0b5f755fd0e6344615324f693740c7374d349f51c13debef489c49ab
Opcode Fuzzy Hash: 4a3f3b486a1d720154e68768baa6182dcaba36147a24c6d9c66db439763e9426
Instruction Fuzzy Hash: A9B181706087468FD714CF29C4905AABFE1BFD9308F1885ADE8958F342D775E906CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00552230 Relevance: 1.5, Strings: 1, Instructions: 284COMMON

Download Yara Rule

Strings

pkU, xrefs: 005523B2

Memory Dump Source

Source File: 00000000.00000002.2007216495.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007216495.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007216495.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID: pkU
API String ID: 0-918070869
Opcode ID: 3c47866646e7ad2c2809d177c87e6350d37e97b3c62a267fc2a681407d841881
Instruction ID: cf1624fd1a6dc0b57627c03be5c97227f8004610d698b89aec3193db8da64621
Opcode Fuzzy Hash: 3c47866646e7ad2c2809d177c87e6350d37e97b3c62a267fc2a681407d841881
Instruction Fuzzy Hash: FFA157B4A016169FDB14CF69C49066AFBE1FF8A315F28C66ADC18DB311E731E915CB80

Uniqueness

Uniqueness Score: -1.00%

Function 004FB0A0 Relevance: .8, Instructions: 763COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2007216495.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007216495.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007216495.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e66eafb21ff0ac23a1e243a383367402beece03311f5ec548545498dddb0c253
Instruction ID: f66ee135833696fdc7097fc137d742b9d11648fb3e57faaf4428e0af157d3001
Opcode Fuzzy Hash: e66eafb21ff0ac23a1e243a383367402beece03311f5ec548545498dddb0c253
Instruction Fuzzy Hash: 653274B3F5161447DF1CCA6ECC922EDB2E36FD821871E813DE80AE3345EA79E9454684

Uniqueness

Uniqueness Score: -1.00%

Function 004F7290 Relevance: .7, Instructions: 709COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2007216495.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007216495.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007216495.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ___std_fs_get_full_path_name@12
String ID:
API String ID: 319883303-0
Opcode ID: be8bbe3333b6d57c4f46257efe2734d2df09f0409c9ab000548af82b6a882924
Instruction ID: c11c03a4ba85e1a93428e849fa2557597bc0e8ae3287c831331b45fae00d0dd8
Opcode Fuzzy Hash: be8bbe3333b6d57c4f46257efe2734d2df09f0409c9ab000548af82b6a882924
Instruction Fuzzy Hash: 51627071D04218CBCF24DF64C9846FEB7B1BF58308F25419AD949AB241EB38AE85CF95

Uniqueness

Uniqueness Score: -1.00%

Function 00510140 Relevance: .7, Instructions: 660COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2007216495.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007216495.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007216495.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3decf17f88fb5ac76b29777a26226d46cd3689a36327aa0461450516a9efa79
Instruction ID: 7734e3287553b3d74106f6f7eb9ccba05eed1c215cdc5eb9b880f13b62f88aab
Opcode Fuzzy Hash: e3decf17f88fb5ac76b29777a26226d46cd3689a36327aa0461450516a9efa79
Instruction Fuzzy Hash: 65428D75A043418FE714CF28C480B5ABBE1BFC8314F149A6DE9999B395D7B1E8C5CB82

Uniqueness

Uniqueness Score: -1.00%

Function 00506210 Relevance: .4, Instructions: 436COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2007216495.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007216495.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007216495.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef81d08433bf8d8d61e6c1161020cb8fffbde7e1d3568ab1fbacf3de246997fd
Instruction ID: ba967dd3ff9d9106477157ee49b7d729a4060b443a8a457c01192f13d4eca8ea
Opcode Fuzzy Hash: ef81d08433bf8d8d61e6c1161020cb8fffbde7e1d3568ab1fbacf3de246997fd
Instruction Fuzzy Hash: DA02B3326106968FC724CF29C88107BBBF1EF89311769886ED9D6DB781C634F612CB60

Uniqueness

Uniqueness Score: -1.00%

Function 0042A040 Relevance: .4, Instructions: 394COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2007216495.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007216495.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007216495.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fbfdc33d2fdc3bee5cddbea4ce36b5624ba5c86133e9e197b308071150bd34ce
Instruction ID: e176e8c39fa0001ffa0331148fc1a1e597aad8ea40cb8f55bb963474ee5d0d66
Opcode Fuzzy Hash: fbfdc33d2fdc3bee5cddbea4ce36b5624ba5c86133e9e197b308071150bd34ce
Instruction Fuzzy Hash: BEE1F372F1022A8FCB05CFA8D8816ADFBF1AF88324F5941AAD815B7340D774A955CB94

Uniqueness

Uniqueness Score: -1.00%

Function 004FC0A0 Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2007216495.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007216495.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007216495.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 142b9e497edc779feb926e324d820a004adefa17f44103fd404662cc1c40eab9
Instruction ID: 38e074bbf3e805e58539ca8d739cae2271b6a1961dda6b795eee354daaa2981f
Opcode Fuzzy Hash: 142b9e497edc779feb926e324d820a004adefa17f44103fd404662cc1c40eab9
Instruction Fuzzy Hash: 2361DA316201A84FE748DF5EFCC0476B361E3AE301789461AEA81CB395C675F56AE7E0

Uniqueness

Uniqueness Score: -1.00%

Function 004351B8 Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2007216495.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007216495.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007216495.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46680d0314554fd398ed7fd020ff60bee8df1d437ae882661bd78aeb1168d151
Instruction ID: 96e57ead98d41e04fe68f30f62ea81bdeba23ce11bdd67b69aec938acc7c3f29
Opcode Fuzzy Hash: 46680d0314554fd398ed7fd020ff60bee8df1d437ae882661bd78aeb1168d151
Instruction Fuzzy Hash: 8F516072D00119AFDF04CF99C841AEFBBB6FF88304F598499E915AB301D7789A41DB94

Uniqueness

Uniqueness Score: -1.00%

Function 005040A0 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2007216495.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007216495.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007216495.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1584348cf9e3f3be4a9b24cc4e2ffe07feb8b558a8eaef0232f41b95094aa3e0
Instruction ID: 7211d50b4de8a7ebd746b1f7ef274bdd41a532539b5b6ed0c87081a493a79e19
Opcode Fuzzy Hash: 1584348cf9e3f3be4a9b24cc4e2ffe07feb8b558a8eaef0232f41b95094aa3e0
Instruction Fuzzy Hash: 19312972B80708AEDB209E69CC40BCDBF96EF45211F04C559FD9C9B750C271E259C7A0

Uniqueness

Uniqueness Score: -1.00%

Function 00452273 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 147COMMONLIBRARYCODE

Download Yara Rule

APIs

DecodePointer.KERNEL32(?,?,?,?,?,?,?,?,?,00451BDF), ref: 0045228C

Strings

acos, xrefs: 004523C2
pow, xrefs: 0045232A, 004523D4, 00452421
log, xrefs: 004522E9, 004522F8
sqrt, xrefs: 004523CB
exp, xrefs: 0045230B, 00452370
asin, xrefs: 004523B9
log10, xrefs: 004522CE, 004522DD

Memory Dump Source

Source File: 00000000.00000002.2007216495.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007216495.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007216495.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: DecodePointer
String ID: acos$asin$exp$log$log10$pow$sqrt
API String ID: 3527080286-3064271455
Opcode ID: 78e946a8a646183d16df3de3d23e88c0ab9a8f5197b1dee8433a7cf1ad31b41b
Instruction ID: bc8b7c0c72404b0f1092b03344519f1b29bd64598f75d1cbe0b332ea915a13b4
Opcode Fuzzy Hash: 78e946a8a646183d16df3de3d23e88c0ab9a8f5197b1dee8433a7cf1ad31b41b
Instruction Fuzzy Hash: 40513B70A0050ADBCF148F69DA481AE7FB4FB46306F144147EC81A7266C7FC8A6EDB59

Uniqueness

Uniqueness Score: -1.00%

Function 00551130 Relevance: 13.6, APIs: 9, Instructions: 88sleepfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00551780: GetVersionExA.KERNEL32(?), ref: 005517A6

GetVersionExA.KERNEL32(?), ref: 00551173
DeleteFileW.KERNEL32(00000000), ref: 00551192
GetFileAttributesW.KERNEL32(00000000), ref: 00551199
GetLastError.KERNEL32 ref: 005511A6
Sleep.KERNEL32(00000064), ref: 005511BC
DeleteFileA.KERNEL32(00000000), ref: 005511C5
GetFileAttributesA.KERNEL32(00000000), ref: 005511CC
GetLastError.KERNEL32 ref: 005511D9
Sleep.KERNEL32(00000064), ref: 005511EF

Memory Dump Source

Source File: 00000000.00000002.2007216495.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007216495.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007216495.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: File$AttributesDeleteErrorLastSleepVersion
String ID:
API String ID: 1421123951-0
Opcode ID: a32e8ebdc0ee50ea10910d3abb4bcf5407c24b4234d9610179a2b3841acf5433
Instruction ID: 2cf516fa490645c339834e1360d609708cb136430ee32b1ceb257c2769835cc0
Opcode Fuzzy Hash: a32e8ebdc0ee50ea10910d3abb4bcf5407c24b4234d9610179a2b3841acf5433
Instruction Fuzzy Hash: 5F21F635900E149BCB20AB78AC9C2AD7EB4FB6A336F100197EE1AD3280DA704849D751

Uniqueness

Uniqueness Score: -1.00%

Function 004220F3 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 379COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 00422A7B
___std_exception_destroy.LIBVCRUNTIME ref: 00422A94
___std_exception_destroy.LIBVCRUNTIME ref: 00422B51
___std_exception_destroy.LIBVCRUNTIME ref: 00422B6A

Strings

number overflow parsing ', xrefs: 0042295E
, xrefs: 004225C6
array, xrefs: 0042254B

Memory Dump Source

Source File: 00000000.00000002.2007216495.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007216495.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007216495.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ___std_exception_destroy
String ID: $array$number overflow parsing '
API String ID: 4194217158-1444002993
Opcode ID: e64a46b01eb755b3409b002ddb586fc40505f2fec82a29546d02b01d75528791
Instruction ID: b9be30596a158e5ed89902264b7fe79a610ddcfe29da18a95ce0fa7f3111436e
Opcode Fuzzy Hash: e64a46b01eb755b3409b002ddb586fc40505f2fec82a29546d02b01d75528791
Instruction Fuzzy Hash: 5EF11070D002599FCB14CFA0D984BEEFBB4BF15304F54829EE44977242DB78AA89CB65

Uniqueness

Uniqueness Score: -1.00%

Function 00432056 Relevance: 12.6, APIs: 3, Strings: 4, Instructions: 303COMMONLIBRARYCODE

Download Yara Rule

APIs

___TypeMatch.LIBVCRUNTIME ref: 00432283
_UnwindNestedFrames.LIBCMT ref: 004323D5
CallUnexpected.LIBVCRUNTIME ref: 004323F0

Strings

L;V, xrefs: 0043216C
csm, xrefs: 00432093
csm, xrefs: 004321AC
csm, xrefs: 00432100

Memory Dump Source

Source File: 00000000.00000002.2007216495.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007216495.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007216495.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CallFramesMatchNestedTypeUnexpectedUnwind
String ID: L;V$csm$csm$csm
API String ID: 3456342781-3339109018
Opcode ID: f219870799de8bf8d93d667d8b8260d42bea9e02fac3f36c4a5e93c416ed644d
Instruction ID: 1a3b2e3aada59ff5ba11aad393d6dbbfac41e5171332123353ed96db4a75ae81
Opcode Fuzzy Hash: f219870799de8bf8d93d667d8b8260d42bea9e02fac3f36c4a5e93c416ed644d
Instruction Fuzzy Hash: 81B19971800219EFCF18DFA5CA819AFBBB5FF08314F14605BE9106B252D7B8DA51CB99

Uniqueness

Uniqueness Score: -1.00%

Function 004FA2D0 Relevance: 12.2, APIs: 8, Instructions: 165networkCOMMON

Download Yara Rule

APIs

InternetSetOptionA.WININET(00000000,00000006,?,00000004), ref: 004FA320
GetLastError.KERNEL32 ref: 004FA415
InternetQueryOptionA.WININET(00000000,0000001F,80000000,?), ref: 004FA440

Memory Dump Source

Source File: 00000000.00000002.2007216495.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007216495.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007216495.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: InternetOption$ErrorLastQuery
String ID:
API String ID: 3980908186-0
Opcode ID: 13505afe8bee8b3cefde12bb8587481c6416af93cd2c35f6481ac9ff60e3cb98
Instruction ID: f01b2b404452f55ee339e3d54677c8633c7154c7c4ff77dbfa4ec76481364019
Opcode Fuzzy Hash: 13505afe8bee8b3cefde12bb8587481c6416af93cd2c35f6481ac9ff60e3cb98
Instruction Fuzzy Hash: B7515EB5D40318ABEB20CF94DC85BFEBBB4EB48711F10411AEE14B7380D7B46A059BA5

Uniqueness

Uniqueness Score: -1.00%

Function 004463F6 Relevance: 10.8, APIs: 7, Instructions: 329COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 0044647C

Memory Dump Source

Source File: 00000000.00000002.2007216495.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007216495.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007216495.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 60d2c484e512d77ccd1e1b5e9e2f0544a37519f154a529b1ce1fcd72a47a8763
Instruction ID: 2b99461290635fdf7c51841e77c4c0c2a1f842bf94a4ab4c5a5740794f6651be
Opcode Fuzzy Hash: 60d2c484e512d77ccd1e1b5e9e2f0544a37519f154a529b1ce1fcd72a47a8763
Instruction Fuzzy Hash: F7B16A72900255AFFB118F24CC81BAF7BA5EF17354F16415BE804AB382D67CD901CBAA

Uniqueness

Uniqueness Score: -1.00%

Function 0041A2A0 Relevance: 9.1, APIs: 6, Instructions: 141COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0041A2CA
std::_Lockit::_Lockit.LIBCPMT ref: 0041A2EC
std::_Lockit::~_Lockit.LIBCPMT ref: 0041A30C
__Getcoll.LIBCPMT ref: 0041A3AF
std::_Facet_Register.LIBCPMT ref: 0041A413
std::_Lockit::~_Lockit.LIBCPMT ref: 0041A42B

Memory Dump Source

Source File: 00000000.00000002.2007216495.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007216495.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007216495.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_GetcollRegister
String ID:
API String ID: 1184649410-0
Opcode ID: bc8a44ca9ebd298cb82613ebc5c8b83f9d4ddd7e469ca24846ff3e2ce5bd3c98
Instruction ID: 4dfe593e994f1a936f3b51d0b47bc881a4e76fe992b8c8e0f1a10b66f2d188dc
Opcode Fuzzy Hash: bc8a44ca9ebd298cb82613ebc5c8b83f9d4ddd7e469ca24846ff3e2ce5bd3c98
Instruction Fuzzy Hash: C751F0B0901218DFCB11DF59E9857EEBBB0EF04314F14411EE806AB381D738AE85CB96

Uniqueness

Uniqueness Score: -1.00%

Function 00422227 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 169COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 00422B51
___std_exception_destroy.LIBVCRUNTIME ref: 00422B6A

Strings

, xrefs: 004225C6
array, xrefs: 0042254B

Memory Dump Source

Source File: 00000000.00000002.2007216495.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007216495.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007216495.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ___std_exception_destroy
String ID: $array
API String ID: 4194217158-2848110696
Opcode ID: 7dd7339a464972968c223f23dd340353b2c505788786f322ae0db6fbe7a5e979
Instruction ID: d024f3a104c0dc07aacb27d102b690a5239fee27944077c2c049d25c7474f40d
Opcode Fuzzy Hash: 7dd7339a464972968c223f23dd340353b2c505788786f322ae0db6fbe7a5e979
Instruction Fuzzy Hash: CA81AB70D04299EFCB24CF64C990BEEFBB0BF15304F54809AD44967342D778AA88DBA5

Uniqueness

Uniqueness Score: -1.00%

Function 0042235B Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 162COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 00422B51
___std_exception_destroy.LIBVCRUNTIME ref: 00422B6A

Strings

, xrefs: 004225C6
array, xrefs: 0042254B

Memory Dump Source

Source File: 00000000.00000002.2007216495.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007216495.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007216495.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ___std_exception_destroy
String ID: $array
API String ID: 4194217158-2848110696
Opcode ID: bba8431f8b77e45d762f42b11501790ba793eab0415894d780c2da835d4d8dea
Instruction ID: 45989d7a15e601232ec8ccab9c1f66b91965c1dcd8dee12bc5f4bcdefb9ababa
Opcode Fuzzy Hash: bba8431f8b77e45d762f42b11501790ba793eab0415894d780c2da835d4d8dea
Instruction Fuzzy Hash: DF71AB70D04259EFCB14CFA0D980ADEFBB4BF55300F54829AD8456B352DBB8AA84CF90

Uniqueness

Uniqueness Score: -1.00%

Function 00422032 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 161COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 00422B51
___std_exception_destroy.LIBVCRUNTIME ref: 00422B6A

Strings

, xrefs: 004225C6
array, xrefs: 0042254B

Memory Dump Source

Source File: 00000000.00000002.2007216495.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007216495.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007216495.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ___std_exception_destroy
String ID: $array
API String ID: 4194217158-2848110696
Opcode ID: 3d6bbb5eeb9172bfa257f394eb500065afff9989a7f434fa6634e6c51bf1637d
Instruction ID: 609c5a3700c6786cab836529116566ed5d02bc52a958d6c1bc70f00cba6690f6
Opcode Fuzzy Hash: 3d6bbb5eeb9172bfa257f394eb500065afff9989a7f434fa6634e6c51bf1637d
Instruction Fuzzy Hash: 7961B370E00259EFCB14DFA4D990BEEBBB4FF15304F50416ED406A7241EB78AA89CB55

Uniqueness

Uniqueness Score: -1.00%

Function 00407270 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 160COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 004073FD

Strings

0f@, xrefs: 004073DD
ror, xrefs: 0040729F
0f@, xrefs: 0040740F

Memory Dump Source

Source File: 00000000.00000002.2007216495.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007216495.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007216495.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ___std_exception_copy
String ID: 0f@$0f@$ror
API String ID: 2659868963-919343903
Opcode ID: 112028d32abe800debf56b8705820299684bad471da3b80bad008eb432948aad
Instruction ID: bd30e4dd5d428fa32f229aa3174ea2d6325f7a69c46b693e369223945965a2aa
Opcode Fuzzy Hash: 112028d32abe800debf56b8705820299684bad471da3b80bad008eb432948aad
Instruction Fuzzy Hash: 31511170C042449BDB18CFA4DC847ADBBB0BF49304F10832EE8556B382E7B8A984DB95

Uniqueness

Uniqueness Score: -1.00%

Function 00407080 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 159COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 004071FE

Strings

0f@, xrefs: 004071E2
ange, xrefs: 004070AF
0f@, xrefs: 00407210

Memory Dump Source

Source File: 00000000.00000002.2007216495.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007216495.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007216495.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ___std_exception_copy
String ID: 0f@$0f@$ange
API String ID: 2659868963-373280750
Opcode ID: ffe6436ea23728eaf55144815bccbff6b30d1088563154c710925e0334a587d5
Instruction ID: 288f119f4ccb4c7cf0b8972ea0ca9e4329cc491e57a4aee3b53e0c7375ef9e73
Opcode Fuzzy Hash: ffe6436ea23728eaf55144815bccbff6b30d1088563154c710925e0334a587d5
Instruction Fuzzy Hash: 3E51F371D002449BDB18CFA8DC847ADBBB0FF85304F24836EE4157B391E7B8A9848B55

Uniqueness

Uniqueness Score: -1.00%

Function 00422211 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 103COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 00422B51
___std_exception_destroy.LIBVCRUNTIME ref: 00422B6A

Strings

, xrefs: 004225C6
array, xrefs: 0042254B

Memory Dump Source

Source File: 00000000.00000002.2007216495.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007216495.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007216495.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ___std_exception_destroy
String ID: $array
API String ID: 4194217158-2848110696
Opcode ID: f591f61a8bc9937c86b3b8cfa7c27d91391b3c026308f04ef0385eca8551722c
Instruction ID: 2285c33957b6ee627a456b70cb7f63cd7f6884c01e9440285345d1a276e1a14b
Opcode Fuzzy Hash: f591f61a8bc9937c86b3b8cfa7c27d91391b3c026308f04ef0385eca8551722c
Instruction Fuzzy Hash: B841D470D0425CEADB14DFA0D954BEEBBB4FF15304F50419AD801A7242DBB86A88DB95

Uniqueness

Uniqueness Score: -1.00%

Function 00422345 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 103COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 00422B51
___std_exception_destroy.LIBVCRUNTIME ref: 00422B6A

Strings

, xrefs: 004225C6
array, xrefs: 0042254B

Memory Dump Source

Source File: 00000000.00000002.2007216495.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007216495.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007216495.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ___std_exception_destroy
String ID: $array
API String ID: 4194217158-2848110696
Opcode ID: cc20cc9b5357f5ede4b5d0c9139b99d4590d407fc1dcee02b8a87b0eff6239a2
Instruction ID: ad7a444c4cd574cfba9072b1c6d0c7cb7517e8d82aaae36da20541665898fc96
Opcode Fuzzy Hash: cc20cc9b5357f5ede4b5d0c9139b99d4590d407fc1dcee02b8a87b0eff6239a2
Instruction Fuzzy Hash: BC41D470D0425CEADB14DFA0D954BEEBBB4FF15304F50419AD801A7242DBB86A88DB95

Uniqueness

Uniqueness Score: -1.00%

Function 00414160 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 33COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 0041417F
___std_exception_copy.LIBVCRUNTIME ref: 004141A6

Strings

0f@, xrefs: 004141B5
0f@, xrefs: 00414184

Memory Dump Source

Source File: 00000000.00000002.2007216495.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007216495.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007216495.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ___std_exception_copy
String ID: 0f@$0f@
API String ID: 2659868963-4245790314
Opcode ID: a0ec767d29c154d107e2924c90945eb70bd3bcc0216d37c8e4efd4af5cc58e06
Instruction ID: a7d6c344e60e7f18edcee1d7e68ac694af1bcf80748ebca3b88f48a52b3fdaf1
Opcode Fuzzy Hash: a0ec767d29c154d107e2924c90945eb70bd3bcc0216d37c8e4efd4af5cc58e06
Instruction Fuzzy Hash: 53F0FFB6910B16AB8751DFA6D440882FBFCFE55310750872BA51597A00F7B4F5588BA0

Uniqueness

Uniqueness Score: -1.00%

Function 00414230 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 33COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 0041424F
___std_exception_copy.LIBVCRUNTIME ref: 00414276

Strings

0f@, xrefs: 00414254
0f@, xrefs: 00414285

Memory Dump Source

Source File: 00000000.00000002.2007216495.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007216495.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007216495.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ___std_exception_copy
String ID: 0f@$0f@
API String ID: 2659868963-4245790314
Opcode ID: 7df463b482ac48a62a19cdfd521df996d263433cd12c62f8aacd95f3aeb874f2
Instruction ID: c81a8536ff326cbba859ccac6298cb5db3856efc80ffb62d725151cad3de68e9
Opcode Fuzzy Hash: 7df463b482ac48a62a19cdfd521df996d263433cd12c62f8aacd95f3aeb874f2
Instruction Fuzzy Hash: D8F0FFB6910B16AB8751DF65D440882FBFCFE55324350872BA5159BA00F7B4F6588BA0

Uniqueness

Uniqueness Score: -1.00%

Function 0043E299 Relevance: 6.1, APIs: 4, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2007216495.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007216495.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007216495.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7511f47f2b8d2fe514c419f7a8a5e884613d924f38ebbfd2c945a9fddd631bd9
Instruction ID: 2126f9bf5856ab37efc9431dc69293eb0664d4eadafdfeefbb5e8820937b8c22
Opcode Fuzzy Hash: 7511f47f2b8d2fe514c419f7a8a5e884613d924f38ebbfd2c945a9fddd631bd9
Instruction Fuzzy Hash: 0D41D572A00204AFD7259F3ACC42B6BBBA9EB8C714F10552FF951DB3C1D2B9A9408784

Uniqueness

Uniqueness Score: -1.00%

Function 0044A27A Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 004494E3: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,004450F2,?,00000000,-00000008), ref: 00449544

GetLastError.KERNEL32 ref: 0044A2DE
__dosmaperr.LIBCMT ref: 0044A2E5
GetLastError.KERNEL32(?,?,?,?), ref: 0044A31F
__dosmaperr.LIBCMT ref: 0044A326

Memory Dump Source

Source File: 00000000.00000002.2007216495.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007216495.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007216495.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: 4aeb7d56512abd99a56e580aa898e1e8254ab7db8b2fd6091a031305fb940926
Instruction ID: e808a53d57fca8bd1b61f112aec170daf55b4bc7c6cded0a037d44453b824fae
Opcode Fuzzy Hash: 4aeb7d56512abd99a56e580aa898e1e8254ab7db8b2fd6091a031305fb940926
Instruction Fuzzy Hash: E8210A31644205AFEB20AF62CC8096B77A8FF44368700841FFD19C3340EB79EC619B96

Uniqueness

Uniqueness Score: -1.00%

Function 0044B21E Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 0044B226

Part of subcall function 004494E3: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,004450F2,?,00000000,-00000008), ref: 00449544

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 0044B25E
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 0044B27E

Memory Dump Source

Source File: 00000000.00000002.2007216495.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007216495.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007216495.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: b5ad36f02a6e1778b055e7e4852a0352916c0be62e54d86e8360cf9b77266669
Instruction ID: e8caac45197e5b900f97a91f35687491d1a7555c8db139f57b1f8df2d9843390
Opcode Fuzzy Hash: b5ad36f02a6e1778b055e7e4852a0352916c0be62e54d86e8360cf9b77266669
Instruction Fuzzy Hash: 9311A1B56099157F7A1127769C8EC7F696CFE95398710006AF905D2101EFACCD0192B9

Uniqueness

Uniqueness Score: -1.00%

Function 00490040 Relevance: 6.0, APIs: 4, Instructions: 20synchronizationthreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00490044
GetCurrentProcessId.KERNEL32 ref: 0049004C
SetEvent.KERNEL32 ref: 00490069
WaitForSingleObject.KERNEL32(000000FF), ref: 00490077

Memory Dump Source

Source File: 00000000.00000002.2007216495.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007216495.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007216495.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Current$EventObjectProcessSingleThreadWait
String ID:
API String ID: 977356572-0
Opcode ID: 07ad26c9a8193a9c403b999b7260b6d74736513c4a61b8b242bc8500957e93da
Instruction ID: 68696a4330ff011d049e89e8b4814e5f18df6cd1e962ac77584aedc126b31ea8
Opcode Fuzzy Hash: 07ad26c9a8193a9c403b999b7260b6d74736513c4a61b8b242bc8500957e93da
Instruction Fuzzy Hash: CCE0467104A615EFCB049F68EC0C865BFA5FB297717408222FC09977B0DB708888EF80

Uniqueness

Uniqueness Score: -1.00%

Function 00406140 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 142COMMON

Download Yara Rule

APIs

___std_fs_get_full_path_name@12.LIBCPMT ref: 004061F2

Strings

absolute, xrefs: 00406274
h<W, xrefs: 004061B7, 00406242

Memory Dump Source

Source File: 00000000.00000002.2007216495.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007216495.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007216495.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ___std_fs_get_full_path_name@12
String ID: absolute$h<W
API String ID: 319883303-1227054036
Opcode ID: fc19779bb5a5af7582c79339770b481127d2738d3652d52236bc829e3857b7da
Instruction ID: a39a9e8cd5e7c649dec9d62c81c2f08022a5113abdb27f993b439c29f203247c
Opcode Fuzzy Hash: fc19779bb5a5af7582c79339770b481127d2738d3652d52236bc829e3857b7da
Instruction Fuzzy Hash: C651AEB0E00315ABDB14DF58C9047AABBF4FF48314F10466EE815A7380D775A950CBE5

Uniqueness

Uniqueness Score: -1.00%

Function 004323FB Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?), ref: 00432420

Strings

MOC, xrefs: 00432432
RCC, xrefs: 0043243A

Memory Dump Source

Source File: 00000000.00000002.2007216495.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007216495.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007216495.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: f67c2448fbd4d3d6a98c50ef117b853eaea3722c114d8127ada5358994747d23
Instruction ID: 22add53dc89d87d2e38264a8044db98528aac9f98faf4db0de58bac51eca42d4
Opcode Fuzzy Hash: f67c2448fbd4d3d6a98c50ef117b853eaea3722c114d8127ada5358994747d23
Instruction Fuzzy Hash: 18418931900209AFCF16DF98CE81AEEBBB5FF4C304F14909AF91467261E379AA50DB54

Uniqueness

Uniqueness Score: -1.00%

Function 005570D0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 104COMMON

Download Yara Rule

APIs

_strftime.LIBCMT ref: 0055715A

Strings

iU, xrefs: 0055712D, 0055716D
hU, xrefs: 0055713B

Memory Dump Source

Source File: 00000000.00000002.2007216495.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007216495.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007216495.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: _strftime
String ID: iU$hU
API String ID: 1867682108-3535440888
Opcode ID: 3e82ce7eaf0a750d56ac549a5c47be44fbc430a93a38f56f5105eb84a44044b0
Instruction ID: 889a8faaaf0a668cfe27d6da16c65c2248ffb3b5e24f2afd4498098204cdabd8
Opcode Fuzzy Hash: 3e82ce7eaf0a750d56ac549a5c47be44fbc430a93a38f56f5105eb84a44044b0
Instruction Fuzzy Hash: A431F4B15046099BD700DF29FC55A567BE8BF8834AF040526FC09E7262E721D95DCBE2

Uniqueness

Uniqueness Score: -1.00%

Function 004F2340 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 85COMMON

Download Yara Rule

APIs

GdipGetImageEncodersSize.GDIPLUS(?,?), ref: 004F2360
GdipGetImageEncoders.GDIPLUS(00000000,00000000,00000000), ref: 004F238D

Strings

image/png, xrefs: 004F23A2

Memory Dump Source

Source File: 00000000.00000002.2007216495.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007216495.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007216495.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: EncodersGdipImage$Size
String ID: image/png
API String ID: 864223233-2966254431
Opcode ID: dc3d2ab8f5b7a29725d35e20f3f09ec94da215eab8252b15de56753eb006a252
Instruction ID: 99d255883ba5ce217efe5dd06ccd874c50b7054dcb2a8d5064865148aeb1c457
Opcode Fuzzy Hash: dc3d2ab8f5b7a29725d35e20f3f09ec94da215eab8252b15de56753eb006a252
Instruction Fuzzy Hash: E7213BB2E0011CABDB109BB4DD816BEB7A8EF25314F1001B6ED08E7311E7799A44C655

Uniqueness

Uniqueness Score: -1.00%

Function 00404120 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00404141
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00404190

Strings

bad locale name, xrefs: 004041AB

Memory Dump Source

Source File: 00000000.00000002.2007216495.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007216495.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007216495.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: std::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 3988782225-1405518554
Opcode ID: 2d018156623b56751fe73bdace615048a592e1be14230173648bc4ea361b1185
Instruction ID: 95f085b47d10799f27f930042da3a8dc43f911f11589ebef340e3e8cf28b8f7c
Opcode Fuzzy Hash: 2d018156623b56751fe73bdace615048a592e1be14230173648bc4ea361b1185
Instruction Fuzzy Hash: 19118B70504B90AED320CF69D805B1BBBE4EF19714F008A5EE48A87B81D7B9A508CBD6

Uniqueness

Uniqueness Score: -1.00%

Function 00552100 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 48COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,00000000,00000001,00000000,?,0055200A), ref: 0055211A
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000000, U,00000000,00000000,0055200A), ref: 0055214A

Strings

U, xrefs: 0055213C

Memory Dump Source

Source File: 00000000.00000002.2007216495.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007216495.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007216495.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ByteCharMultiWide
String ID: U
API String ID: 626452242-2085870877
Opcode ID: 9dcc1b4a9b11b4808d0db67178ecd5f9a1652e19ab6f5dbea0e26157730d80d0
Instruction ID: 0b132648f7774e7442f2f0b6957801b08d55499a66d80b09d0b1d43035632599
Opcode Fuzzy Hash: 9dcc1b4a9b11b4808d0db67178ecd5f9a1652e19ab6f5dbea0e26157730d80d0
Instruction Fuzzy Hash: 38F09632B8522436E63066AA5C0BF577A5CDB47F71F20036AFF18AA1D0D9E1681092DA

Uniqueness

Uniqueness Score: -1.00%

Function 004141D0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 32COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 004141EF
___std_exception_copy.LIBVCRUNTIME ref: 00414216

Strings

0f@, xrefs: 004141F4

Memory Dump Source

Source File: 00000000.00000002.2007216495.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2007216495.0000000000590000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2007216495.0000000000593000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ___std_exception_copy
String ID: 0f@
API String ID: 2659868963-2656153907
Opcode ID: ba255ed8c3bc32c490ad3c9a6150c2f47abf7cac3b88d1f1c6bb2e2459164e61
Instruction ID: 79755fa87b84676f4e4474023142464d524d45420b01c2d18704369f933ac59c
Opcode Fuzzy Hash: ba255ed8c3bc32c490ad3c9a6150c2f47abf7cac3b88d1f1c6bb2e2459164e61
Instruction Fuzzy Hash: 1CF012B6910B16AB8751DF65D440882F7FCFE55310350872BA51597A00F7B4F5588BA0

Uniqueness

Uniqueness Score: -1.00%

Source: Traffic	Snort IDS: 2049060 ET TROJAN RisePro TCP Heartbeat Packet 192.168.2.4:49730 -> 147.45.47.93:58709
Source: Traffic	Snort IDS: 2046266 ET TROJAN [ANY.RUN] RisePro TCP (Token) 147.45.47.93:58709 -> 192.168.2.4:49730
Source: Traffic	Snort IDS: 2046267 ET TROJAN [ANY.RUN] RisePro TCP (External IP) 147.45.47.93:58709 -> 192.168.2.4:49730
Source: Traffic	Snort IDS: 2046269 ET TROJAN [ANY.RUN] RisePro TCP (Activity) 192.168.2.4:49730 -> 147.45.47.93:58709

Source: Joe Sandbox View	IP Address: 34.117.186.192 34.117.186.192
Source: Joe Sandbox View	IP Address: 34.117.186.192 34.117.186.192
Source: Joe Sandbox View	IP Address: 147.45.47.93 147.45.47.93
Source: Joe Sandbox View	IP Address: 172.67.75.166 172.67.75.166

Source: global traffic	HTTP traffic detected: GET /widget/demo/81.181.57.52 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=81.181.57.52 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com

Source: global traffic	HTTP traffic detected: GET /widget/demo/81.181.57.52 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=81.181.57.52 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com

Source: file.exe, 00000000.00000002.2008702665.0000000004206000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://.102:57amadka.
Source: file.exe, 00000000.00000002.2008702665.0000000004206000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.47.102:57893/hera/amadka.exe
Source: file.exe, 00000000.00000002.2008702665.0000000004206000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.47.102:57893/hera/amadka.exe-
Source: file.exe, 00000000.00000002.2008702665.0000000004206000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.167/cost/go.exe
Source: file.exe, 00000000.00000002.2008702665.0000000004206000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.167/cost/go.exe.1
Source: file.exe, 00000000.00000002.2008702665.0000000004206000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.167/cost/lenin.exe
Source: Amcache.hve.3.dr	String found in binary or memory: http://upx.sf.net
Source: file.exe, 00000000.00000002.2009091900.000000000459F000.00000040.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.winimage.com/zLibD
Source: file.exe, 00000000.00000003.1636879616.0000000006070000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.winimage.com/zLibDll
Source: file.exe, 00000000.00000003.1769245344.0000000008D1C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1767408508.0000000008D05000.00000004.00000020.00020000.00000000.sdmp, kpoRIew0KmbRWeb Data.0.dr, 6xWctsbrfVe0Web Data.0.dr, v9sfzApO2m4MWeb Data.0.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: file.exe, 00000000.00000003.1769245344.0000000008D1C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1767408508.0000000008D05000.00000004.00000020.00020000.00000000.sdmp, kpoRIew0KmbRWeb Data.0.dr, 6xWctsbrfVe0Web Data.0.dr, v9sfzApO2m4MWeb Data.0.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000000.00000003.1769245344.0000000008D1C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1767408508.0000000008D05000.00000004.00000020.00020000.00000000.sdmp, kpoRIew0KmbRWeb Data.0.dr, 6xWctsbrfVe0Web Data.0.dr, v9sfzApO2m4MWeb Data.0.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000003.1769245344.0000000008D1C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1767408508.0000000008D05000.00000004.00000020.00020000.00000000.sdmp, kpoRIew0KmbRWeb Data.0.dr, 6xWctsbrfVe0Web Data.0.dr, v9sfzApO2m4MWeb Data.0.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: file.exe, 00000000.00000002.2008702665.0000000004206000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com/
Source: file.exe, 00000000.00000002.2008702665.0000000004206000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com/demo/home.php?s=81.181.57.52
Source: file.exe, 00000000.00000002.2008702665.0000000004206000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com/demo/home.php?s=81.181.57.524
Source: file.exe, 00000000.00000002.2008702665.00000000041EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com/demo/home.php?s=81.181.57.52q.
Source: file.exe, 00000000.00000002.2008702665.0000000004206000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com:443/demo/home.php?s=81.181.57.52?9d1
Source: file.exe, 00000000.00000003.1769245344.0000000008D1C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1767408508.0000000008D05000.00000004.00000020.00020000.00000000.sdmp, kpoRIew0KmbRWeb Data.0.dr, 6xWctsbrfVe0Web Data.0.dr, v9sfzApO2m4MWeb Data.0.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: file.exe, 00000000.00000003.1769245344.0000000008D1C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1767408508.0000000008D05000.00000004.00000020.00020000.00000000.sdmp, kpoRIew0KmbRWeb Data.0.dr, 6xWctsbrfVe0Web Data.0.dr, v9sfzApO2m4MWeb Data.0.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000000.00000003.1769245344.0000000008D1C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1767408508.0000000008D05000.00000004.00000020.00020000.00000000.sdmp, kpoRIew0KmbRWeb Data.0.dr, 6xWctsbrfVe0Web Data.0.dr, v9sfzApO2m4MWeb Data.0.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: file.exe, 00000000.00000002.2008702665.0000000004206000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/
Source: file.exe, 00000000.00000002.2008702665.00000000041C3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/1D
Source: file.exe, 00000000.00000002.2008702665.00000000041BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/B
Source: file.exe, 00000000.00000002.2007216495.0000000000400000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2009188631.0000000005ED0000.00000040.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000003.1636879616.0000000006070000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/Content-Type:
Source: file.exe, 00000000.00000002.2008702665.0000000004206000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/Mozilla/5.0
Source: file.exe, 00000000.00000002.2008702665.0000000004206000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2008702665.00000000041DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/widget/demo/81.181.57.52
Source: file.exe, 00000000.00000002.2008702665.0000000004206000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io:443/widget/demo/81.181.57.520%
Source: D87fZN3R3jFeplaces.sqlite.0.dr	String found in binary or memory: https://support.mozilla.org
Source: D87fZN3R3jFeplaces.sqlite.0.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: D87fZN3R3jFeplaces.sqlite.0.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
Source: file.exe, 00000000.00000003.1768920337.0000000008CFB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1766930296.0000000008CE3000.00000004.00000020.00020000.00000000.sdmp, Cma6mvK3hWvIHistory.0.dr, ZP9OgwnUTBtwHistory.0.dr	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: Cma6mvK3hWvIHistory.0.dr, ZP9OgwnUTBtwHistory.0.dr	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: file.exe, 00000000.00000003.1768920337.0000000008CFB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1766930296.0000000008CE3000.00000004.00000020.00020000.00000000.sdmp, Cma6mvK3hWvIHistory.0.dr, ZP9OgwnUTBtwHistory.0.dr	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: Cma6mvK3hWvIHistory.0.dr, ZP9OgwnUTBtwHistory.0.dr	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: file.exe, 00000000.00000002.2008702665.000000000418E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2009564997.0000000008CB9000.00000004.00000020.00020000.00000000.sdmp, W9yZG_t61Z_J7GfmBn540XA.zip.0.dr	String found in binary or memory: https://t.me/RiseProSUPPORT
Source: file.exe, 00000000.00000002.2008702665.0000000004206000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1880373194.0000000008CFF000.00000004.00000020.00020000.00000000.sdmp, passwords.txt.0.dr	String found in binary or memory: https://t.me/risepro_bot
Source: file.exe, 00000000.00000003.1769245344.0000000008D1C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1767408508.0000000008D05000.00000004.00000020.00020000.00000000.sdmp, kpoRIew0KmbRWeb Data.0.dr, 6xWctsbrfVe0Web Data.0.dr, v9sfzApO2m4MWeb Data.0.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: file.exe, 00000000.00000003.1769245344.0000000008D1C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1767408508.0000000008D05000.00000004.00000020.00020000.00000000.sdmp, kpoRIew0KmbRWeb Data.0.dr, 6xWctsbrfVe0Web Data.0.dr, v9sfzApO2m4MWeb Data.0.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: file.exe, file.exe, 00000000.00000002.2007216495.0000000000400000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2009188631.0000000005ED0000.00000040.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000003.1636879616.0000000006070000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.maxmind.com/en/locate-my-ip-address
Source: D87fZN3R3jFeplaces.sqlite.0.dr	String found in binary or memory: https://www.mozilla.org
Source: D87fZN3R3jFeplaces.sqlite.0.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: D87fZN3R3jFeplaces.sqlite.0.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: file.exe, 00000000.00000003.1769746318.000000000427B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1769220187.000000000427B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1768851664.000000000427B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1767799918.0000000004274000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1770260013.000000000427B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1770968109.000000000427B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2008702665.0000000004267000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1769565531.000000000427B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1768153753.0000000004274000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1771499986.000000000427B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: file.exe, 00000000.00000002.2009564997.0000000008CB9000.00000004.00000020.00020000.00000000.sdmp, 3b6N2Xdh3CYwplaces.sqlite.0.dr, D87fZN3R3jFeplaces.sqlite.0.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: D87fZN3R3jFeplaces.sqlite.0.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: file.exe, 00000000.00000003.1769746318.000000000427B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1769220187.000000000427B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1768851664.000000000427B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1767799918.0000000004274000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1770260013.000000000427B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1770968109.000000000427B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2008702665.0000000004267000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1769565531.000000000427B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1768153753.0000000004274000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1771499986.000000000427B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: file.exe, 00000000.00000002.2009564997.0000000008CB9000.00000004.00000020.00020000.00000000.sdmp, 3b6N2Xdh3CYwplaces.sqlite.0.dr, D87fZN3R3jFeplaces.sqlite.0.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: file.exe, 00000000.00000002.2008702665.0000000004267000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/r

Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.75.166:443 -> 192.168.2.4:49732 version: TLS 1.2

Source: unknown	DNS query: name: ipinfo.io
Source: unknown	DNS query: name: ipinfo.io

Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.93
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Dropped Files

Memory Dumps

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_file.exe_4d3f288dd4798765eb91273da4b76d6bea17316_52238708_10335d55-7344-4798-868a-642b323fdb2a\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_file.exe_4d3f288dd4798765eb91273da4b76d6bea17316_52238708_15d3ae8c-14d8-47b4-889c-158b8969f6cd\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_file.exe_4d3f288dd4798765eb91273da4b76d6bea17316_52238708_407a37f6-a980-4391-8494-bf9bcb7a1c8d\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_file.exe_4d3f288dd4798765eb91273da4b76d6bea17316_52238708_681b8baa-75ab-45c4-b7b0-ae76b7b2d453\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_file.exe_4d3f288dd4798765eb91273da4b76d6bea17316_52238708_688cbf8b-67c3-4b5a-8f65-1c3ad19de2a6\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_file.exe_4d3f288dd4798765eb91273da4b76d6bea17316_52238708_83ca9a92-fbbd-4d11-a1a6-fbba96d67552\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_file.exe_4d3f288dd4798765eb91273da4b76d6bea17316_52238708_84b6f306-bf5a-493e-9e98-3770969605f7\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_file.exe_4d3f288dd4798765eb91273da4b76d6bea17316_52238708_85a5fc3c-0a1c-48df-b75b-a51156fea0d7\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_file.exe_4d3f288dd4798765eb91273da4b76d6bea17316_52238708_9042f83a-504d-4950-abc0-e4e4679bb0f8\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_file.exe_4d3f288dd4798765eb91273da4b76d6bea17316_52238708_b4ee208a-c92f-4f51-be05-eaa535ab5445\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_file.exe_4d3f288dd4798765eb91273da4b76d6bea17316_52238708_b621ded2-faf3-4fb3-a976-16024740780d\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_file.exe_4d3f288dd4798765eb91273da4b76d6bea17316_52238708_f6dc93c5-cb1c-438e-a34b-3e15d7234d4b\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_file.exe_bf3ace7eccf87db32bccac6338e1d4b03dc99b8f_52238708_302080a6-229b-410a-bd76-88077ad387bc\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_file.exe_bf3ace7eccf87db32bccac6338e1d4b03dc99b8f_52238708_73a5c60f-cccd-4bb6-87ec-0e77435d9d45\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_file.exe_bf3ace7eccf87db32bccac6338e1d4b03dc99b8f_52238708_bfe9909b-817e-4821-a15d-d84abb4d0703\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_file.exe_bf3ace7eccf87db32bccac6338e1d4b03dc99b8f_52238708_d1f1775b-34ae-4862-b958-5a7fbc722829\Report.wer

Windows Analysis Report
file.exe

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre