Edit tour

Windows Analysis Report
badata_x64.dll.dll

Overview

General Information

Sample name:	badata_x64.dll.dll (renamed file extension from exe to dll)
Original sample name:	badata_x64.dll.exe
Analysis ID:	1436345
MD5:	63799db91ff4c343eb071cfe3b67321d
SHA1:	d368ced88e0cab4fd211c45e66e8dfa6985714b3
SHA256:	8c432e84946ab677d87d3fa9f263597f30d31adf8611df25744eeeb85dd4faaf
Tags:	exe
Infos:

Detection

Score:	4
Range:	0 - 100
Whitelisted:	false
Confidence:	40%

Signatures

AV process strings found (often used to terminate AV products)

Checks if the current process is being debugged

Creates a process in suspended mode (likely to inject code)

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

One or more processes crash

PE file contains an invalid checksum

Sample execution stops while process was sleeping (likely an evasion)

Uses code obfuscation techniques (call, push, ret)

Classification

Analysis Advice

Sample searches for specific file, try point organization specific fake files to the analysis machine

Sample tries to load a library which is not present or installed on the analysis machine, adding the library might reveal more behavior

Sample crashes during execution, try analyze it on another analysis machine

Process Tree

System is w10x64

loaddll64.exe (PID: 6244 cmdline: loaddll64.exe "C:\Users\user\Desktop\badata_x64.dll.dll" MD5: 763455F9DCB24DFEECC2B9D9F8D46D52)

conhost.exe (PID: 6168 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 6524 cmdline: cmd.exe /C rundll32.exe "C:\Users\user\Desktop\badata_x64.dll.dll",#1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

rundll32.exe (PID: 6600 cmdline: rundll32.exe "C:\Users\user\Desktop\badata_x64.dll.dll",#1 MD5: EF3179D498793BF4234F708D3BE28633)

WerFault.exe (PID: 5004 cmdline: C:\Windows\system32\WerFault.exe -u -p 6600 -s 536 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)

WerFault.exe (PID: 7504 cmdline: C:\Windows\system32\WerFault.exe -u -p 6600 -s 384 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)

rundll32.exe (PID: 6504 cmdline: rundll32.exe C:\Users\user\Desktop\badata_x64.dll.dll,Abort MD5: EF3179D498793BF4234F708D3BE28633)

WerFault.exe (PID: 4956 cmdline: C:\Windows\system32\WerFault.exe -u -p 6504 -s 528 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)

WerFault.exe (PID: 8100 cmdline: C:\Windows\system32\WerFault.exe -u -p 6504 -s 600 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)

rundll32.exe (PID: 5572 cmdline: rundll32.exe C:\Users\user\Desktop\badata_x64.dll.dll,AddBurnDevice MD5: EF3179D498793BF4234F708D3BE28633)

WerFault.exe (PID: 6860 cmdline: C:\Windows\system32\WerFault.exe -u -p 5572 -s 528 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)

WerFault.exe (PID: 5816 cmdline: C:\Windows\system32\WerFault.exe -u -p 5572 -s 604 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)

rundll32.exe (PID: 7512 cmdline: rundll32.exe C:\Users\user\Desktop\badata_x64.dll.dll,AddDir MD5: EF3179D498793BF4234F708D3BE28633)

WerFault.exe (PID: 7828 cmdline: C:\Windows\system32\WerFault.exe -u -p 7512 -s 528 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)

WerFault.exe (PID: 8044 cmdline: C:\Windows\system32\WerFault.exe -u -p 7512 -s 656 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)

WerFault.exe (PID: 8128 cmdline: C:\Windows\system32\WerFault.exe -u -p 6244 -s 588 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)

chrome.exe (PID: 2076 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://%3cfnc1%3e(79)/ MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 7320 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2336 --field-trial-handle=2036,i,18134803902397787512,7146960864463359065,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

HTTP traffic detected: POST /RST2.srf HTTP/1.0Connection: Keep-AliveContent-Type: application/soap+xmlAccept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68})Content-Length: 3592Host: login.live.com

Source: Amcache.hve.8.dr

String found in binary or memory: http://upx.sf.net

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49672
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 23.32.230.129:443 -> 192.168.2.4:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.151.132:443 -> 192.168.2.4:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.32.230.129:443 -> 192.168.2.4:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.127.169.103:443 -> 192.168.2.4:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.127.169.103:443 -> 192.168.2.4:49755 version: TLS 1.2

Source: C:\Windows\System32\rundll32.exe

Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 6504 -s 528

Source: classification engine

Classification label: clean4.winDLL@40/37@4/3

Source: C:\Windows\System32\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6244
Source: C:\Windows\System32\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess5572
Source: C:\Windows\System32\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7512
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6168:120:WilError_03
Source: C:\Windows\System32\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6600
Source: C:\Windows\System32\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6504

Source: C:\Windows\System32\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\3b7e12b8-7638-47a3-a213-927c72a41a9f

Jump to behavior

Source: badata_x64.dll.dll

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\loaddll64.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Windows\System32\loaddll64.exe

Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\badata_x64.dll.dll,Abort

Source: unknown	Process created: C:\Windows\System32\loaddll64.exe loaddll64.exe "C:\Users\user\Desktop\badata_x64.dll.dll"
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\badata_x64.dll.dll",#1
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\badata_x64.dll.dll,Abort
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\badata_x64.dll.dll",#1
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 6504 -s 528
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 6600 -s 536
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\badata_x64.dll.dll,AddBurnDevice
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 5572 -s 528
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://%3cfnc1%3e(79)/
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2336 --field-trial-handle=2036,i,18134803902397787512,7146960864463359065,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\badata_x64.dll.dll,AddDir
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 7512 -s 528
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 6244 -s 588
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 6600 -s 384
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 7512 -s 656
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 6504 -s 600
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 5572 -s 604
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\badata_x64.dll.dll",#1	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\badata_x64.dll.dll,Abort	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\badata_x64.dll.dll,AddBurnDevice	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\badata_x64.dll.dll,AddDir	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\badata_x64.dll.dll",#1	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2336 --field-trial-handle=2036,i,18134803902397787512,7146960864463359065,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\loaddll64.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Section loaded: wldp.dll	Jump to behavior

Source: C:\Windows\System32\rundll32.exe	Automated click: OK
Source: C:\Windows\System32\rundll32.exe	Automated click: OK
Source: C:\Windows\System32\rundll32.exe	Automated click: OK
Source: C:\Windows\System32\rundll32.exe	Automated click: OK
Source: C:\Windows\System32\rundll32.exe	Automated click: OK

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: badata_x64.dll.dll

Static PE information: More than 231 > 100 exports found

Source: badata_x64.dll.dll

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: badata_x64.dll.dll

Static PE information: Image base 0x180000000 > 0x60000000

Source: badata_x64.dll.dll

Static file information: File size 4201984 > 1048576

Source: badata_x64.dll.dll

Static PE information: Raw size of .text is bigger than: 0x100000 < 0x2c2000

Source: badata_x64.dll.dll

Static PE information: More than 200 imports for USER32.dll

Source: badata_x64.dll.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: badata_x64.dll.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: badata_x64.dll.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: badata_x64.dll.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: badata_x64.dll.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: badata_x64.dll.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: badata_x64.dll.dll

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT

Source: badata_x64.dll.dll

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: badata_x64.dll.dll

Static PE information: real checksum: 0x403d30 should be: 0x40e81d

Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00000286C5337200 push esi; retf	4_2_00000286C5337201
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00000286C5337B80 push esi; retf	4_2_00000286C5337B81
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00000286C5338500 push esi; retf	4_2_00000286C5338501
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00000286C5330CEB push eax; ret	4_2_00000286C5330E79
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00000286C5337460 push esi; retf	4_2_00000286C5337461
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00000286C53376C0 push esi; retf	4_2_00000286C53376C1
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00000286C5338630 push esi; retf	4_2_00000286C5338631
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00000286C5337920 push esi; retf	4_2_00000286C5337921
Source: C:\Windows\System32\rundll32.exe	Code function: 10_2_000001762C7A82FA pushad ; iretd	10_2_000001762C7A82FB
Source: C:\Windows\System32\rundll32.exe	Code function: 10_2_000001762C7A81CA push edi; iretd	10_2_000001762C7A81CB
Source: C:\Windows\System32\rundll32.exe	Code function: 10_2_000001762C79EE60 push eax; retf	10_2_000001762C79EE61

Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Windows\System32\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\WER\ReportQueue\	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_bad_20b35f4e9e7e4ee7dfdaf2f7e2bfa18e82db71be_2631c2b9_7d75c075-c21f-4abb-b272-410a49a270ad\	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\WER\	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_loaddll64.exe_33699c824f9c2edcea33082e96eb61413f0e629_606702e6_93a04a0f-f5a5-4238-8707-8e68348ea6b1\	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\WER\ReportQueue	Jump to behavior

Source: Amcache.hve.8.dr	Binary or memory string: VMware
Source: Amcache.hve.8.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.8.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.8.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.8.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.8.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.8.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.8.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.8.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.8.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.8.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.8.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.8.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.8.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.8.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.8.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.8.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.8.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.8.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.8.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.8.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.8.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.8.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.8.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.8.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.8.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.8.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.8.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.8.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Windows\System32\loaddll64.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\badata_x64.dll.dll",#1

Jump to behavior

Source: Amcache.hve.8.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.8.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.8.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.8.dr	Binary or memory string: MsMpEng.exe

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	11 Process Injection	1 Virtualization/Sandbox Evasion	OS Credential Dumping	21 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Rundll32	LSASS Memory	1 Virtualization/Sandbox Evasion	Remote Desktop Protocol	Data from Removable Media	3 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	1 System Information Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Obfuscated Files or Information	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
badata_x64.dll.dll	0%	ReversingLabs
badata_x64.dll.dll	0%	Virustotal		Browse

Name	IP	Active	Malicious	Antivirus Detection	Reputation
google.com	142.250.189.14	true	false		high
www.google.com	142.250.217.132	true	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://upx.sf.net	Amcache.hve.8.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
142.250.217.132	www.google.com	United States		15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved		unknown	unknown	false

Private

IP
192.168.2.4

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1436345
Start date and time:	2024-05-04 13:52:17 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 1s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	34
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	badata_x64.dll.dll (renamed file extension from exe to dll)
Original Sample Name:	badata_x64.dll.exe
Detection:	CLEAN
Classification:	clean4.winDLL@40/37@4/3
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.189.3, 142.250.68.14, 142.251.2.84, 34.104.35.123, 199.232.210.172, 192.229.211.108, 52.168.117.173, 13.89.179.12, 172.217.14.67, 20.42.73.29, 142.250.217.142, 52.182.143.212
Excluded domains from analysis (whitelisted): clients1.google.com, onedsblobprdeus16.eastus.cloudapp.azure.com, fs.microsoft.com, accounts.google.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, clientservices.googleapis.com, onedsblobprdcus17.centralus.cloudapp.azure.com, fe3cr.delivery.mp.microsoft.com, clients2.google.com, ocsp.digicert.com, edgedl.me.gvt1.com, onedsblobprdcus15.centralus.cloudapp.azure.com, login.live.com, blobcollector.events.data.trafficmanager.net, onedsblobprdeus15.eastus.cloudapp.azure.com, update.googleapis.com, umwatson.events.data.microsoft.com, clients.l.google.com
Execution Graph export aborted for target loaddll64.exe, PID 6244 because there are no executed function
Execution Graph export aborted for target rundll32.exe, PID 5572 because there are no executed function
Execution Graph export aborted for target rundll32.exe, PID 6504 because there are no executed function
Execution Graph export aborted for target rundll32.exe, PID 6600 because there are no executed function
Execution Graph export aborted for target rundll32.exe, PID 7512 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.

Simulations

Behavior and APIs

Time	Type	Description
13:53:44	API Interceptor	4x Sleep call for process: WerFault.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
239.255.255.250	SecuriteInfo.com.Trojan.TR.Crypt.XPACK.Gen.18101.30858.exe	Get hash	malicious	Unknown	Browse
	mBW2MzlcHN.exe	Get hash	malicious	LockBit ransomware, PureLog Stealer	Browse
	0e46.scr.exe	Get hash	malicious	AgentTesla	Browse
	Aviso de cuenta vencida de DHL - 1606622076_865764325678976645423546567678967564423567890008765.exe	Get hash	malicious	AgentTesla	Browse
	Dekont.pdf.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	#U00d6deme tavsiyesi.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	E7236252-receipt.vbs	Get hash	malicious	XWorm	Browse
	4365078236450.LnK.lnk	Get hash	malicious	Unknown	Browse
	Pedido-Faturado-398731.msi	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Win32.Dropper-CHS.435.30054.exe	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
google.com	Zahlungsbeleg 202405029058.vbs	Get hash	malicious	FormBook, GuLoader	Browse	142.250.72.174
	Arrival Notice.pdf.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	142.250.217.129
	invoice PDF -2024.gz.vbs	Get hash	malicious	Unknown	Browse	142.250.217.129

ASNs

⊘No context

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	SecuriteInfo.com.Trojan.TR.Crypt.XPACK.Gen.18101.30858.exe	Get hash	malicious	Unknown	Browse	40.127.169.103 20.190.151.132 23.32.230.129
	mBW2MzlcHN.exe	Get hash	malicious	LockBit ransomware, PureLog Stealer	Browse	40.127.169.103 20.190.151.132 23.32.230.129
	eiQXaKJ75nCjEWn.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	40.127.169.103 20.190.151.132 23.32.230.129
	0e46.scr.exe	Get hash	malicious	AgentTesla	Browse	40.127.169.103 20.190.151.132 23.32.230.129
	Aviso de cuenta vencida de DHL - 1606622076_865764325678976645423546567678967564423567890008765.exe	Get hash	malicious	AgentTesla	Browse	40.127.169.103 20.190.151.132 23.32.230.129
	Dekont.pdf.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	40.127.169.103 20.190.151.132 23.32.230.129
	#U00d6deme tavsiyesi.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	40.127.169.103 20.190.151.132 23.32.230.129
	E7236252-receipt.vbs	Get hash	malicious	XWorm	Browse	40.127.169.103 20.190.151.132 23.32.230.129
	4365078236450.LnK.lnk	Get hash	malicious	Unknown	Browse	40.127.169.103 20.190.151.132 23.32.230.129
	Pedido-Faturado-398731.msi	Get hash	malicious	Unknown	Browse	40.127.169.103 20.190.151.132 23.32.230.129

Dropped Files

⊘No context

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_loaddll64.exe_33699c824f9c2edcea33082e96eb61413f0e629_606702e6_93a04a0f-f5a5-4238-8707-8e68348ea6b1\Report.wer

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8587058753255724
Encrypted:	false
SSDEEP:	192:Avwd66YV0WVwYjg2ZFAlzuiFOZ24lO81:AvwdxY2WVwYjmzuiFOY4lO81
MD5:	D561AC5BA3ED6A7C7922DD6C8443F830
SHA1:	A5C9B37BA35818440566AAA25DD7B544C3960302
SHA-256:	3FC91B3F65949C435BA9AA2882573F14FDFEA2F6DE1A506BD8F9FFA969DC0C6B
SHA-512:	13C1CEF228A32FBB0190E0D24173B538B4307549727726680BB5450CA4AE550B1AA61B4454E515D5C3F7B6A23EAF4371C5F8DEBF6FDE8F0B06D8BA5B187A7A45
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.9.2.9.7.1.9.4.0.6.7.3.9.5.3.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.9.3.a.0.4.a.0.f.-.f.5.a.5.-.4.2.3.8.-.8.7.0.7.-.8.e.6.8.3.4.8.e.a.6.b.1.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.0.1.3.e.9.b.4.7.-.8.2.3.4.-.4.b.e.b.-.9.1.5.c.-.f.c.5.5.d.c.0.9.8.a.7.5.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....N.s.A.p.p.N.a.m.e.=.l.o.a.d.d.l.l.6.4...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.8.6.4.-.0.0.0.1.-.0.0.1.4.-.7.b.8.d.-.4.0.9.f.1.9.9.e.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.5.f.e.1.f.7.3.2.2.5.e.8.c.2.3.3.1.b.8.d.3.7.3.d.3.f.9.1.a.c.4.2.0.0.0.0.f.f.f.f.!.0.0.0.0.f.2.3.2.e.0.d.e.c.d.5.4.8.8.5.2.f.a.6.0.8.9.e.1.9.5.4.3.1.b.7.3.e.9.4.e.d.0.b.d.!.l.o.a.d.d.l.l.6.4...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.3././.0.9././.1.5.:.0.8.:.2.3.:.4.0.!.0.!.l.o.a.d.d.l.l.6.4...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.9.6.7.2.9.5.....T.a.r.g.e.t.A.s.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_bad_20b35f4e9e7e4ee7dfdaf2f7e2bfa18e82db71be_2631c2b9_7d75c075-c21f-4abb-b272-410a49a270ad\Report.wer

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8707327632668097
Encrypted:	false
SSDEEP:	192:A1Qip7yBd0knI+3jL5mZFUzuiFOZ24lO8J:A1Qip+BekI+3j1zuiFOY4lO8J
MD5:	4DC9268C82E11A923A541BA2B985123E
SHA1:	6670DE9FE81BCE746703CE252AA637EC4C9D1550
SHA-256:	BACE39098E35F5B384DDB158FD913480B4C0F267B8C9249634C58BAB42CFA03F
SHA-512:	6BE760DD85C7AAECCC19D987AC6A41344F0D3113FEE75CD4328B7CB7BFA89AA4B54C1CCD73C9E91BCE075059AB1977A36435E7A1AF14743F0FE80D69FBFE2975
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.9.2.9.7.1.9.1.3.8.0.7.8.2.6.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.7.d.7.5.c.0.7.5.-.c.2.1.f.-.4.a.b.b.-.b.2.7.2.-.4.1.0.a.4.9.a.2.7.0.a.d.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.f.2.3.4.8.2.b.a.-.1.8.f.a.-.4.c.e.7.-.9.b.2.6.-.c.3.d.0.e.8.8.a.d.8.e.9.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....N.s.A.p.p.N.a.m.e.=.r.u.n.d.l.l.3.2...e.x.e._.b.a.d.a.t.a._.x.6.4...d.l.l...d.l.l.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.R.U.N.D.L.L.3.2...E.X.E.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.d.5.8.-.0.0.0.1.-.0.0.1.4.-.8.b.c.9.-.f.c.a.2.1.9.9.e.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.d.d.3.9.9.a.e.4.6.3.0.3.3.4.3.f.9.f.0.d.a.1.8.9.a.e.e.1.1.c.6.7.b.d.8.6.8.2.2.2.!.r.u.n.d.l.l.3.2...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.1.0.3././.0.8././.0.7.:.2.2.:.5.3.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_bad_20b35f4e9e7e4ee7dfdaf2f7e2bfa18e82db71be_2631c2b9_89437b38-9572-46da-9fa9-bdab69a1f727\Report.wer

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8710454804008346
Encrypted:	false
SSDEEP:	192:AYxiAly3d0knI+3jL5mZFUzuiFOZ24lO8J:AYxiAg3ekI+3j1zuiFOY4lO8J
MD5:	1E9B6AE0FCEEF85ECBE2F43A4D54EF6B
SHA1:	820E5F4E35A89675EBEA8A456A88A98792EF14E3
SHA-256:	B81007A8A53F0DCEEE415689151A341E10FDBBADBC08E504E7A457B72569F380
SHA-512:	A0862D93106A42FD72F8557AB796BBB70204F85E0C02FE0D78219D812164964AE1AD5A142586F6F479B9BB25936E39105DD83AAD76627DB07EAB52B2B9A926CA
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.9.2.9.7.1.8.4.9.5.1.1.9.8.5.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.8.9.4.3.7.b.3.8.-.9.5.7.2.-.4.6.d.a.-.9.f.a.9.-.b.d.a.b.6.9.a.1.f.7.2.7.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.f.c.2.1.3.c.f.a.-.b.d.6.f.-.4.6.0.2.-.a.6.0.9.-.9.5.2.c.5.8.b.0.2.1.9.d.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....N.s.A.p.p.N.a.m.e.=.r.u.n.d.l.l.3.2...e.x.e._.b.a.d.a.t.a._.x.6.4...d.l.l...d.l.l.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.R.U.N.D.L.L.3.2...E.X.E.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.9.6.8.-.0.0.0.1.-.0.0.1.4.-.5.6.d.a.-.5.3.9.f.1.9.9.e.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.d.d.3.9.9.a.e.4.6.3.0.3.3.4.3.f.9.f.0.d.a.1.8.9.a.e.e.1.1.c.6.7.b.d.8.6.8.2.2.2.!.r.u.n.d.l.l.3.2...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.1.0.3././.0.8././.0.7.:.2.2.:.5.3.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_bad_20b35f4e9e7e4ee7dfdaf2f7e2bfa18e82db71be_2631c2b9_95596a0f-33ed-48ac-9d1b-a100d67c7c53\Report.wer

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8708803570516137
Encrypted:	false
SSDEEP:	192:Alihykd0knI+3jL5mZFUzuiFOZ24lO8J:AliEkekI+3j1zuiFOY4lO8J
MD5:	E2A7A95414642D099F9CB727BFED8C93
SHA1:	E31B613BBF34C1FF2C0D5E729E50342E51760719
SHA-256:	790C26DB99AFD92EB0E8F0E3DDC237D8C387A8203C81B6524079797085B34D5C
SHA-512:	0F77C6C48B97453C00D4843BB454BC85B30C07419533AF3B91FE99194DC8955E4050F70918A3154D84F3F75B149B1E3E7DBB41DB62058B5FAFFE976EDD6A1CCB
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.9.2.9.7.1.8.4.9.4.7.7.5.9.6.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.9.5.5.9.6.a.0.f.-.3.3.e.d.-.4.8.a.c.-.9.d.1.b.-.a.1.0.0.d.6.7.c.7.c.5.3.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.d.9.b.c.3.6.6.0.-.1.0.5.8.-.4.8.9.2.-.a.c.a.6.-.d.0.6.e.2.b.d.b.0.c.c.b.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....N.s.A.p.p.N.a.m.e.=.r.u.n.d.l.l.3.2...e.x.e._.b.a.d.a.t.a._.x.6.4...d.l.l...d.l.l.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.R.U.N.D.L.L.3.2...E.X.E.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.9.c.8.-.0.0.0.1.-.0.0.1.4.-.2.9.7.2.-.5.5.9.f.1.9.9.e.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.d.d.3.9.9.a.e.4.6.3.0.3.3.4.3.f.9.f.0.d.a.1.8.9.a.e.e.1.1.c.6.7.b.d.8.6.8.2.2.2.!.r.u.n.d.l.l.3.2...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.1.0.3././.0.8././.0.7.:.2.2.:.5.3.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_bad_20b35f4e9e7e4ee7dfdaf2f7e2bfa18e82db71be_2631c2b9_fb8576ae-1f92-4593-b2a8-4ec6080766d6\Report.wer

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8706302020055443
Encrypted:	false
SSDEEP:	192:Ajiiy/d0knI+3jL5mZFUzuiFOZ24lO8Jl:Aji//ekI+3j1zuiFOY4lO8Jl
MD5:	19081DE99D2AA9DEBE48074A3AA35C86
SHA1:	FBFC7D15D8F446605F840CB16B987211553A3826
SHA-256:	4886A391248E104488CB6C0083B7CEC68CEA4C48A8AEE0A3315F26B24CBB2D7D
SHA-512:	ECEFD163C1CE709597DF8A08127DA93F4EC554C684609F3E8AE4F117D26A973FFD04E63879DC5E37A203648A73D2630BCCCF3737369B6081257A65F737FF3EC2
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.9.2.9.7.1.8.7.9.0.2.5.1.1.4.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.f.b.8.5.7.6.a.e.-.1.f.9.2.-.4.5.9.3.-.b.2.a.8.-.4.e.c.6.0.8.0.7.6.6.d.6.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.3.0.0.3.6.5.f.2.-.a.e.3.5.-.4.f.6.7.-.9.e.c.6.-.7.f.0.a.7.b.9.8.b.f.c.9.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....N.s.A.p.p.N.a.m.e.=.r.u.n.d.l.l.3.2...e.x.e._.b.a.d.a.t.a._.x.6.4...d.l.l...d.l.l.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.R.U.N.D.L.L.3.2...E.X.E.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.5.c.4.-.0.0.0.1.-.0.0.1.4.-.6.d.2.0.-.2.0.a.1.1.9.9.e.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.d.d.3.9.9.a.e.4.6.3.0.3.3.4.3.f.9.f.0.d.a.1.8.9.a.e.e.1.1.c.6.7.b.d.8.6.8.2.2.2.!.r.u.n.d.l.l.3.2...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.1.0.3././.0.8././.0.7.:.2.2.:.5.3.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_bad_31793adb08f1679e480d49537b44d5657e0eb9d_2631c2b9_53cea94a-5e5d-4b98-9d19-9416f69297f1\Report.wer

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8469839783148989
Encrypted:	false
SSDEEP:	96:/P7F4o0liplxyKyzsjM4Rv1yHpSsQXIDcQwc6FcEycw3ykXaXz+HbHgSQgJjw8hT:/TF47ip7yz60eBYTjjrzuiFzZ24lO8+
MD5:	E2850CDB9A4CCD18C94FFC7882655D7A
SHA1:	7E372923F98EE78A2C8A9F188800C6D5F582C380
SHA-256:	839654B0654E962C88C7615E7F9A9F0C4852990B98582ECEBF37FC6DDD3842D0
SHA-512:	A16B702CDF70639602ECB5C6331C6AD85D9E9A101E76F36AB10A4C900E8F65AFC6C087C2ECDF5AA32C6CB87515BBC6DB575A99A02B5E2916E8F21601F4ADD0DF
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.6.4.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.9.2.9.7.2.0.3.7.3.7.2.6.8.4.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.5.9.2.9.7.2.0.4.1.4.6.9.0.9.7.....R.e.p.o.r.t.S.t.a.t.u.s.=.6.5.5.4.5.6.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.5.3.c.e.a.9.4.a.-.5.e.5.d.-.4.b.9.8.-.9.d.1.9.-.9.4.1.6.f.6.9.2.9.7.f.1.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.7.b.b.b.4.8.e.7.-.0.b.2.7.-.4.9.c.1.-.b.1.a.b.-.c.6.3.b.e.e.c.b.e.c.1.0.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....N.s.A.p.p.N.a.m.e.=.r.u.n.d.l.l.3.2...e.x.e._.b.a.d.a.t.a._.x.6.4...d.l.l...d.l.l.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.R.U.N.D.L.L.3.2...E.X.E.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.d.5.8.-.0.0.0.1.-.0.0.1.4.-.8.b.c.9.-.f.c.a.2.1.9.9.e.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.d.d.3.9.9.a.e.4.6.3.0.3.3.4.3.f.9.f.0.d.a.1.8.9.a.e.e.1.1.c.6.7.b.d.8.6.8.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_bad_31793adb08f1679e480d49537b44d5657e0eb9d_2631c2b9_95798867-7b70-41f8-99c5-d59a644d3dc3\Report.wer

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8469372939264773
Encrypted:	false
SSDEEP:	96:/C7seK5yliCxyKyNsjM4Rv1yHpSsQXIDcQwc6FcEycw3ykXaXz+HbHgSQgJjw8hl:/+sb2iiyN60eBYTjjDzuiFzZ24lO8+
MD5:	CF4FC8E78F9E23F11B547F48759ABAB5
SHA1:	5C4FB7150CC8BF8011FB44D7A3EDDD249C83ACAF
SHA-256:	47E3EF9D5FE3EA8C7000C682FC1805F6A6851507EC2B0831AA4E2498A12C99D9
SHA-512:	535FEBA25DB5BBBAAA3FFBDF2AA0CC199286820B3A25A023ABA5C17FECD348F1412BB3F7BED86A1DD7E97BAC692A6D0E8BDB8F992262E76CFCFEE1FC664999A5
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.6.4.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.9.2.9.7.2.1.0.4.9.7.9.9.5.3.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.5.9.2.9.7.2.1.0.8.5.7.3.6.4.1.....R.e.p.o.r.t.S.t.a.t.u.s.=.6.5.5.4.5.6.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.9.5.7.9.8.8.6.7.-.7.b.7.0.-.4.1.f.8.-.9.9.c.5.-.d.5.9.a.6.4.4.d.3.d.c.3.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.0.6.c.0.a.3.a.d.-.7.d.9.d.-.4.1.3.4.-.a.1.6.8.-.6.a.f.f.e.b.4.2.a.4.4.0.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....N.s.A.p.p.N.a.m.e.=.r.u.n.d.l.l.3.2...e.x.e._.b.a.d.a.t.a._.x.6.4...d.l.l...d.l.l.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.R.U.N.D.L.L.3.2...E.X.E.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.5.c.4.-.0.0.0.1.-.0.0.1.4.-.6.d.2.0.-.2.0.a.1.1.9.9.e.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.d.d.3.9.9.a.e.4.6.3.0.3.3.4.3.f.9.f.0.d.a.1.8.9.a.e.e.1.1.c.6.7.b.d.8.6.8.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_bad_31793adb08f1679e480d49537b44d5657e0eb9d_2631c2b9_ea3eaa38-4707-4dc2-90ab-b2db92566c5c\Report.wer

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8468340687543389
Encrypted:	false
SSDEEP:	96://7NuBgliArxyKyFsjM4Rv1yHpSsQXIDcQwc6FcEycw3ykXaXz+HbHgSQgJjw8hl:/jN3iAlyF60eBYTjjDzuiFzZ24lO8+
MD5:	A4C8E1915BE7D5C9A03E979C6CE37F1E
SHA1:	A0D77550E1505D5EFF8BA7C95E61DC37984306E2
SHA-256:	605C545E1177AF089867E8F6119BBC702529FE3AB589754A906B9FB89AA47671
SHA-512:	69ED3B3C0A760D29E6368EB79DA11121244BE346E709371A6076C8617DE9B7D718C83AEFCDF48950C2263F3354E3FBA55CE34B40B5EC228D24CF0217F5713EC7
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.6.4.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.9.2.9.7.2.0.6.7.1.2.8.1.1.2.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.5.9.2.9.7.2.0.7.0.7.2.1.6.6.3.....R.e.p.o.r.t.S.t.a.t.u.s.=.6.5.5.4.5.6.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.e.a.3.e.a.a.3.8.-.4.7.0.7.-.4.d.c.2.-.9.0.a.b.-.b.2.d.b.9.2.5.6.6.c.5.c.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.f.3.f.a.b.d.a.9.-.2.d.1.d.-.4.b.7.1.-.b.6.d.0.-.8.8.a.7.7.d.c.c.7.e.b.e.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....N.s.A.p.p.N.a.m.e.=.r.u.n.d.l.l.3.2...e.x.e._.b.a.d.a.t.a._.x.6.4...d.l.l...d.l.l.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.R.U.N.D.L.L.3.2...E.X.E.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.9.6.8.-.0.0.0.1.-.0.0.1.4.-.5.6.d.a.-.5.3.9.f.1.9.9.e.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.d.d.3.9.9.a.e.4.6.3.0.3.3.4.3.f.9.f.0.d.a.1.8.9.a.e.e.1.1.c.6.7.b.d.8.6.8.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_bad_31793adb08f1679e480d49537b44d5657e0eb9d_2631c2b9_ebf9c3e4-6606-465a-a0ee-a6f73001d978\Report.wer

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8470012312911169
Encrypted:	false
SSDEEP:	96:/57I/0/liXxyKy2sjM4Rv1yHpSsQXIDcQwc6FcEycw3ykXaXz+HbHgSQgJjw8h8M:/lIM9ihy260eBYTjjTzuiFzZ24lO8+
MD5:	0DF8368F45CEEBDB1B72A6DCF600D927
SHA1:	D9EACA4C8DCE95C490F3CCC122C4773A51004153
SHA-256:	0187398AF47289F67F0202C4FB7933EFF2850C26B728005D42F325CB993AD03E
SHA-512:	0305C2F44E0A4E8CA8A000F6838CF52206138F3F4F086A338C82ABC466873B0F160F77E33E7200C21A95BDDF1056B8C3D445357F4122B6AC69B48E3DA5F55BA1
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.6.4.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.9.2.9.7.1.9.5.4.6.2.9.8.3.3.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.5.9.2.9.7.1.9.7.5.7.6.8.0.1.7.....R.e.p.o.r.t.S.t.a.t.u.s.=.6.5.5.4.5.6.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.e.b.f.9.c.3.e.4.-.6.6.0.6.-.4.6.5.a.-.a.0.e.e.-.a.6.f.7.3.0.0.1.d.9.7.8.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.4.6.5.3.d.4.7.1.-.0.c.e.f.-.4.2.9.6.-.a.b.c.d.-.d.e.1.7.7.b.4.1.9.e.3.4.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....N.s.A.p.p.N.a.m.e.=.r.u.n.d.l.l.3.2...e.x.e._.b.a.d.a.t.a._.x.6.4...d.l.l...d.l.l.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.R.U.N.D.L.L.3.2...E.X.E.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.9.c.8.-.0.0.0.1.-.0.0.1.4.-.2.9.7.2.-.5.5.9.f.1.9.9.e.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.d.d.3.9.9.a.e.4.6.3.0.3.3.4.3.f.9.f.0.d.a.1.8.9.a.e.e.1.1.c.6.7.b.d.8.6.8.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9AF9.tmp.dmp

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Sat May 4 11:53:05 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	64130
Entropy (8bit):	1.8472382758561652
Encrypted:	false
SSDEEP:	384:mUlQLhhusXli3TYkLBOmIA1RmUUd3hdbqxa96bxdgG4:mUlxSqfPQixfmG4
MD5:	25D8850D11E8C073D605D5558036CA38
SHA1:	135D90655A72DA833726833B8A065A6DDDF0C7DF
SHA-256:	550225D4005ACD94D80AE022CA7281FD52AE07513FD9C4D73B948B9B1EAC5349
SHA-512:	9634F41DCCC7607853A48E00457540AD58DB8723C83A4A9B557B3E1554D0ADCBBC01BA609C0591F5956CFBDACCFEA5A497B9FA4533F69960E08136ECB73D2F82
Malicious:	false
Preview:	MDMP..a..... ........!6f....................................D....0..........T.......8...........T...........x...............d...........P...............................................................................eJ..............Lw......................T............!6f.............................0..................W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9B09.tmp.dmp

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Sat May 4 11:53:05 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	63942
Entropy (8bit):	1.8611625650799375
Encrypted:	false
SSDEEP:	192:YasDEOpXqkOM8jph4Zf/9MIw7CdpCgdbk2JcBihVSjjPdUGI3j4:M3srlPsf/9MbcQySHanz4
MD5:	51DCD01555755DEB382C8AE7B7AEBE17
SHA1:	41B864A6355E44B165C7FD3431E9CCBBD89C407C
SHA-256:	97D72C5E6250F37C5EEFF32889C8ECF890678E8F01ED8774A67D8B87F6446997
SHA-512:	43ED4F06C221056CD09D23CBFD8F0D1E3E72A595A10913A5182289C582F740D4DD4040D9C4B6CDF92DD830EE68CF06D4F92F7838BB24980D89CE4631809FF235
Malicious:	false
Preview:	MDMP..a..... ........!6f....................................D....0..........T.......8...........T...........(...............d...........P...............................................................................eJ..............Lw......................T.......h....!6f.............................0..................W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9C04.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8534
Entropy (8bit):	3.6933269890583182
Encrypted:	false
SSDEEP:	192:R6l7wVeJtYuNu6Ye680gmfwwGApBO89bUuzoff8m:R6lXJrE6YTXgmfww3UqofR
MD5:	B439C12359A3C6FE17ADA13F4371BA2E
SHA1:	58DF784766B57DBFD93976DBE1AE2BCD837D1814
SHA-256:	A2B84B3346787CBDFD3C5E0591D56EC401EE7AC8C8EB05700CA01C0F0A769C61
SHA-512:	E07A22066D928F0A578BB8386C6C889AB3C01BE1AEC2CCF26AAFA1B4C833BEDD9C99ECF3DC528930404EA74C63CB0E570C380DD8BFF308F1DE554D0B0D9D41E8
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.6.0.0.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9C24.tmp.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4773
Entropy (8bit):	4.47549578445893
Encrypted:	false
SSDEEP:	48:cvIwWl8zsoJg771I9UHWpW8VYgYm8M4JCpCBiFLyq85mQpptSTSy6d:uIjfuI7L27V4JOapoOy6d
MD5:	C89F2AAAEE1EF33AB0662D71626BC9AB
SHA1:	5CDD0A1F04BB0BCECCF5CC125ED410AF75BC2DCA
SHA-256:	B26EAAD579EA1F01451B5A9B597A13A0216368734E7DAE927F0335B993C11931
SHA-512:	47AC87D7ED69C95C1FE0EFF059674A2F6E8996D066703A89D9453A74A822260F2AC44F644C970B992D4F113A26BD5F789C6CC71806D16B2467E201402763D5A1
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="308335" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9C82.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8528
Entropy (8bit):	3.6934642630950965
Encrypted:	false
SSDEEP:	192:R6l7wVeJJMJjN6Y1s8gmfwwGApB3q89bUizofC8m:R6lXJ4N6Ye8gmfwwTU2of4
MD5:	2C0A447F1FA2E12598424B9424332C3A
SHA1:	24D84574FB75E990893CA269CCC7E46FCD08E7F5
SHA-256:	BFF41CFA6598069A8A1D2B5358D00BB67BD6EF93166D666B51879E8AD812D666
SHA-512:	8E643715863BF2C6C273DB399946C23090CB9E7FB5A8625A176256861E2A0F2D2FD163849D4856FB4438A56B1BAA79BEA8407421B86A245573EEDE7DA893BEF5
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.5.0.4.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9CB2.tmp.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4773
Entropy (8bit):	4.475350857912075
Encrypted:	false
SSDEEP:	48:cvIwWl8zsoJg771I9UHWpW8VYUYm8M4JCpCBiFUyq85mQMe4ptSTSCd:uIjfuI7L27V0JZ44poOCd
MD5:	5451840350E4E6FA5ED5466D8E808443
SHA1:	9EC974DEE7368109A4BF0740BCC6E236784E02DF
SHA-256:	8238C81165AD3947CC0040B1A4F65193F25DB3633431A92C2A1AE3461590532D
SHA-512:	FACDAE4FFE515192EE35ECA8322F1A172254C8D7E1A9110204A1F821071A6FE64735869A3038CA8B700970C041A63FADD73A1EAB4ECE2C0922BD3A4F9402EEFB
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="308335" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERA682.tmp.dmp

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Sat May 4 11:53:08 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	63838
Entropy (8bit):	1.8468330771862371
Encrypted:	false
SSDEEP:	192:hSOlOpX2OM8jP8OSY+mAMTKED6i1KQOJmZCsedWkjzV8c/ZV:YXlAfMJL1KlqfeYk6c/L
MD5:	D141C97F0A43D6027814332C6F1F1589
SHA1:	7EFD1DCB04DD590C66B4954DA29E051E102BFD5F
SHA-256:	212E64E6267006A286342B8D96A93B8DF9ECC7C5A9874BDAF60A69FF58250FB2
SHA-512:	1BC47E10F09E30FC8B5920CEBC17E0D54BBB900975C77D97FC891FCA45F1B110E61F669BFD011EFC4E49743D84C7A19F92F7475D4B311C0A9455C1CDF03F9289
Malicious:	false
Preview:	MDMP..a..... ........!6f....................................4....0..........T.......8...........T...........(...6...........d...........P...............................................................................eJ..............Lw......................T............!6f.............................0..................W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERA897.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8530
Entropy (8bit):	3.6932795613496157
Encrypted:	false
SSDEEP:	192:R6l7wVeJA0pEub6Y128gmfwwGApBH89bxYzofWbm:R6lXJDpEub6YU8gmfwwIx8ofL
MD5:	FFFEB7C09AC8A76828E150A338F05BEE
SHA1:	9ABD5E9F3F887916D58322F12AB62C12215E45A3
SHA-256:	2C1789176BE05ACBDAF6C507E17D119A774068DD88FA2401BB0956993D2FBF6C
SHA-512:	24BD58A8F3509CA13C6AF265314F60C856289FBDBC6450FA363261BFDCD12DF57068077C1CC44F01BA6A45CCEE4124C1252D8290FE4DE7EAEE5F8B81C0DF57BE
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.5.5.7.2.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERA8D6.tmp.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4773
Entropy (8bit):	4.474951189111563
Encrypted:	false
SSDEEP:	48:cvIwWl8zsoJg771I9UHWpW8VY8Ym8M4JCpCBiFt8yq85mQ4ptSTS4d:uIjfuI7L27VkJT3poO4d
MD5:	C9A3598FD6E2F6033D1FF25DB8B8F2D5
SHA1:	85E49FC8684D970F82985A010AD782F6CEB44B04
SHA-256:	F79AE018986A883B4FADE8526580FAA76F919FEEBDDBADBE909279743AACE959
SHA-512:	37F188F14F077D4A86CF6E3DF77837F94A6EDDA1023115659A66F7941D8C916F09C9210F10D7E9AC6B585AE0069DE01BC6EFBEA96D3ADC39194DE48C739F86DF
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="308335" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERB400.tmp.dmp

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Sat May 4 11:53:11 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	65918
Entropy (8bit):	1.7953241507327842
Encrypted:	false
SSDEEP:	192:e66O8XV2BOM8jBg00kqiV1w2Wzd6C6uxR9Hq06aunE:5allg0PHV1Lu6CPxRtq8
MD5:	6E8E94F71B0E037F4D4C67A9CB822A47
SHA1:	648E6B89D6D67B6BC9CF1B3F0A32B9C2CB51E9EF
SHA-256:	07AF679E92272BA909DA4307B1EA9AAC576C89D690F256ED9ABBDA255BD25FF7
SHA-512:	D729184E2A8C488B0A7145D73295DF73652A840392820ACAB93350C8E96774D88228FF81BE9558C130DAF2EF91BF814C3FAC1656BFCD4F11B01495D9BF7D79DE
Malicious:	false
Preview:	MDMP..a..... ........!6f....................................4....0..........T.......8...........T...........(...V...........d...........P...............................................................................eJ..............Lw......................T.......X....!6f.............................0..................W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERB4AC.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8534
Entropy (8bit):	3.6937682000898073
Encrypted:	false
SSDEEP:	192:R6l7wVeJEGM/t6Y1s8gmfwwGApBQ89bROBlzofV7m:R6lXJ1M/t6YO8gmfwwdROBRofE
MD5:	F6927AA95D6F72FFE9056BF07C801B6C
SHA1:	EBE33B411EB5AE76D5474BD2AA0A7248371B2CBD
SHA-256:	12542A02AAA15FDB10D7A4C2890A9BDFA4CDC92E2854BE6F18A6149FFA278D40
SHA-512:	1FE7900327D56860CDCCEA1B96F2ABA57767B264D417814ABFA5C46D78678C9920DB64BBFAD4375289DB9A46D6AA33F13701B4B68A91E33C2443E2F05727B76F
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.5.1.2.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERB4EC.tmp.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4773
Entropy (8bit):	4.47552649147989
Encrypted:	false
SSDEEP:	48:cvIwWl8zsoJg771I9UHWpW8VYEYm8M4JCpCBiFXyq85mQYrXQptSTSUd:uIjfuI7L27V8JyrrApoOUd
MD5:	74CC262C4D9BFE57E1259BD5DF641361
SHA1:	42AE4258D2E804DB629ED3A5D8867617C558AAB9
SHA-256:	9626515CE9D7058FD95D6666055B6AC4144E60E89A96D506ADE08E827AE79985
SHA-512:	B204E3FC8AEA167BD5D33BA56B47FC3460C13A1E2412E1B8555AC7E9BC7DF24B74CCC28F64C9B547129C6D851D721E413E138D87B562773D6999EAACCBBA538D
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="308335" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERBE7F.tmp.dmp

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Sat May 4 11:53:14 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	66212
Entropy (8bit):	1.8730348581057308
Encrypted:	false
SSDEEP:	192:aeVmjX8ttTOPbJE02zpCj0SR1BbFW8+msO4dcEe11lvmzWVDo/a:QAt8Pu0wCASR1PW8+m34qEe111Rt
MD5:	8741939D6F9D7C274EF71B47C4D67B91
SHA1:	0CA9FE29F6BBD5AED89A8D179ACE33B24371730C
SHA-256:	CCC6FE3DFB6CE055441859FF12579E2716EC9E143698F2497B1DDFBCEC68A9C0
SHA-512:	D4976D71A217C730AB596AB50DB621E6BE40957C674FB7AE3AC7C3CC8E1892696871B7811CC17EF789A392F9854C2A53C0F87A896DEB01B7CCED282FA76ABC5F
Malicious:	false
Preview:	MDMP..a..... ........!6f....................................$...p.......4...j0..........`.......8...........T...........(...\|.......................................................................................................eJ..............Lw......................T.......d....!6f.............................0..................W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERBF0D.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8734
Entropy (8bit):	3.6991471064557246
Encrypted:	false
SSDEEP:	192:R6l7wVeJ1QN26Y9hM2/gmfXrpBM89bsO0of2wEvEm:R6lXJyN26YrM2/gmfXNs1of2wm
MD5:	AC37EB6B9CC4C8AE13C38D978D1AE6B5
SHA1:	6D737F6160B3D54EB65545576E04CFDCE61F4E66
SHA-256:	48AE3D99A32856CD1DD7B130AD2002A4181CE265F8392ACDD511EA21B8F716C5
SHA-512:	C22E1D747ABE916D802307C345BC99EE7FEA95CF53B60779B76DE2A24709F72A0FF7A431B6EFE42D93067CE7E6DD0957ED13414ED62680E61323286C71ED8AB0
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.2.4.4.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERBF5C.tmp.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4640
Entropy (8bit):	4.43355539501313
Encrypted:	false
SSDEEP:	48:cvIwWl8zsoJg771I9UHWpW8VYpYm8M4J8iFxayq85DzWFV1xUd:uIjfuI7L27VZJ/axF7xUd
MD5:	77C980A82FD75058DFD233FB56F51C8B
SHA1:	71E570DE2AC38C7FA066E6D0421FBCC33AFA1593
SHA-256:	4409D9CEC7D90F03A0F3261C4ACC9425B20D1982166F757D72657B1082E3592D
SHA-512:	76E2D2914990952DD14C678D2BB2DF8FB549528049FC56D97DCB1864E4CB4A7BB8CC4F3258A4876140467FF70F6E76AB0A5C50BBB57010C39AA420A6713B94C0
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="308335" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERC3FD.tmp.dmp

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Sat May 4 11:53:15 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	32214
Entropy (8bit):	2.3052693617785134
Encrypted:	false
SSDEEP:	192:/zdP1HyHwPXOM6ZCQ82833wD6KXXh1JhYFHTf:buHwP+vZ833wD6KXXlhaj
MD5:	F4728FDFE5D0A3E829F70BBCCE6C0E2C
SHA1:	78FB51E8F10909A858B05B192A267A95A215AC49
SHA-256:	0D909631DF22C0759CDB5A593EA6ECDAED9799E453DE0C3FD31E29C163A64AA4
SHA-512:	92878B0871547207FB6B9FAACE3DC4BAB58AF645F7B1DDD1D9CCDB0326F23C43D3C2CFD21D022A851916ED15FA88AAE652DC89CD4886CAD0A650F886DE1A4428
Malicious:	false
Preview:	MDMP..a..... ........!6f............4...............H...................d...6)..........`.......8...........T................f......................................................................................................eJ......T.......Lw......................T............!6f.............................0..................W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERC4D9.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	10066
Entropy (8bit):	3.7065818700471485
Encrypted:	false
SSDEEP:	192:R6l7wVeJtnxq6Ye280gmf9iNt8pDv89b1uJYItaoknLQfdHm:R6lXJ9xq6YfXgmf9iNj1QYItaoknLQfQ
MD5:	9EC86097966F434625477F7DA3DC2647
SHA1:	4B288205A2BB1D41EF9ACF7DD17B0CA6E596DC42
SHA-256:	240D38C1FCBF6B16812794055DC9700650C4527A48CF8D4FD0416175FD45B4A5
SHA-512:	21EC2E5946BEDC5F223022EA3C40BBC8F8734108AC5FBA44FFD22E847A7C5DF621AE0E628A0B495E3F54BCB8171BC89744B51103A00F8E060DCF07FD10A1B36F
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.6.0.0.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERCA29.tmp.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4898
Entropy (8bit):	4.4661753319096755
Encrypted:	false
SSDEEP:	48:cvIwWl8zsoJg771I9UHWpW8VYw5Ym8M4JCpCBYgFCDyq8vhBY2ptSTSyQd:uIjfuI7L27VnoJcDWrpoOyQd
MD5:	CB541F9215880CA318B604EACA33986B
SHA1:	34C689894FCDA892E5A05DA7341EFA9017DE9B5D
SHA-256:	21F58857F3C5E1DE5A5DEEFA39A0E061379F25F681357C7BC04627BFC1653C17
SHA-512:	74EA4A253D0847F3D92E98E7D929508A0D637192B64A0EFF5244F2AF6E8C6F28A71449B5B3516CED0533199345C492CB94E8B3DDB98CDF9CFD6522484C1FE820
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="308335" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE457.tmp.dmp

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Sat May 4 11:53:23 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	33420
Entropy (8bit):	2.214158111701388
Encrypted:	false
SSDEEP:	192:3hHP1V8WAwnaU3XOM6ZqQ17PnwD6UlSdS1a:RIWAwV+vZNnwD6UlSd
MD5:	C8677C8235A47AAF7900F55240A9C50F
SHA1:	D201C643609445A2212A1B41A6D5090247C3095C
SHA-256:	101A192301BFF128F60E003227216BB2D1F2E4BFB31DBA7071C14E84889CA51E
SHA-512:	C35DFD6BEE918BF5B52B1E7540923C0C06B0F73AA1488DE96235AD6EC221AA462C11BE9B2B7FF10D1C7404B2410965E0A056A8ADB691DA84361D2DC3D2E44AC3
Malicious:	false
Preview:	MDMP..a..... ........!6f............4...............H...................t...6)..........`.......8...........T...........X...4k......................................................................................................eJ......T.......Lw......................T.......X....!6f.............................0..................W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE4D5.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	10230
Entropy (8bit):	3.7087450254537644
Encrypted:	false
SSDEEP:	192:R6l7wVeJECzq6YeFjgmf9iNt8pDRC89bgOBlJxfJXJ8MluCf8Mgm:R6lXJxzq6Y8jgmf9iNY7gOBrxfJXJ8MJ
MD5:	1A54AD993087FA62E324A1077FD70A56
SHA1:	A04E67CEAA1241E402E9546BD58709A81E6E2263
SHA-256:	A8818C8E3E163F40E098457165B81DED9CB8B54CB506EF8C47CEDE1D83EE9685
SHA-512:	5B6392075F6057DB156FA8296A2CAC8E892C466133F13689FB4D401CDED423DC4BD312C8AA8D57827D08FBFCD34D0D8256D97D1EC2424DD409A78CEF09F7319F
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.5.1.2.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE524.tmp.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4898
Entropy (8bit):	4.464995376151546
Encrypted:	false
SSDEEP:	48:cvIwWl8zs5Jg771I9UHWpW8VYBYm8M4JCpCBYgFTMyq8vhBYfrXQptSTSud:uIjfLI7L27VtJOWOrApoOud
MD5:	D2BE5D7FF4AAADBAB2E5D69547DBE41B
SHA1:	193B8C929735E9F03DCC036CB18421CF4FABC002
SHA-256:	AF65AE7AAA185ED30BA5E6ABD0A6D007D198134AA9EF378A9ACA687A311AE5E4
SHA-512:	B0BD4F13E11A0B6F133A86DED882ADCFCCF39320774E3AD7FEB612DDA0CD2237E5E30E171AF067880E2248DEEF1506CD8DD03FCBE12AF9420B126A1E8F8A963F
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="308336" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WEREFEF.tmp.dmp

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Sat May 4 11:53:26 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	33196
Entropy (8bit):	2.2371896754092733
Encrypted:	false
SSDEEP:	192:++1P17Qhwc7Yyt5U4XOM6ZiQjD9MIDwDaqt4VBXAOH:nAhw7yV+vZP9MOwDJ42OH
MD5:	DF4998E65ACD6DE8A245510F2258222F
SHA1:	F04FF0147C065D1A44D35B1DF6482A47D5DED21C
SHA-256:	1835967E2E96BBB8B713DB81A5F5DBABE87624F9E88280BBD7A24BAE7E1FBC59
SHA-512:	1128F58072F730DD49A67239AEF581ABC0BB2605D351AB0B710AA63C534DE2FEB2AF07E6B23F6015649DC693C4A8931115913B19D79EE5E56D7A6997F303EF2B
Malicious:	false
Preview:	MDMP..a..... ........!6f............4...............H...................t...6)..........`.......8...........T...........X...Tj......................................................................................................eJ......T.......Lw......................T.......h....!6f.............................0..................W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERF03E.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	10080
Entropy (8bit):	3.7068720757385165
Encrypted:	false
SSDEEP:	192:R6l7wVeJJM4X06YeEjgmf9iNt8pDRC89bNiJD2wi4dXJ8SfGvm:R6lXJtX06YNjgmf9iNY7NMD2wi4dXJ84
MD5:	C40430BA99711FD372ADCE7F26C20A5A
SHA1:	EEA77B9AD6F5F144BFC3A355A36B004082D53AB8
SHA-256:	0F13DC03EEF922FBECDE3C9C51C80899279646BD717841BFB13D45E2FB65ADB2
SHA-512:	9636555B2C98A275AB724D79114D2FB07A5758F3F6DC8E52316B5CAE33FC7B91EBA613A7F03FA41EBB52EB6CDD812FE4EAE803AB9D75A4EB8D26B5C30575CCD9
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.5.0.4.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERF06E.tmp.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4898
Entropy (8bit):	4.465470252482648
Encrypted:	false
SSDEEP:	48:cvIwWl8zs5Jg771I9UHWpW8VYK5Ym8M4JCpCBYgFNSyq8vhBYJe4ptSTSYd:uIjfLI7L27VKJrSW74poOYd
MD5:	FAD4C10DABDA25F671247E25A848BCDF
SHA1:	032BBD56ABF3D409DE5ED564C267E19E79E032EB
SHA-256:	FC92E4FC7162C7387C045A54999EF47C58BAF059A97368A89818D5E6A02B0B0D
SHA-512:	861BC766AC243D06F2D6D99CABB95A223DA6F767FB7CD4C28126A67458267D45F18C53B879BCC0B2C07264C3E99BD49ACC5242BA4D8E5B9B96AA8BF1054711E8
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="308336" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERFEB5.tmp.dmp

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Sat May 4 11:53:30 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	32972
Entropy (8bit):	2.248357858470906
Encrypted:	false
SSDEEP:	192:KRfP17Qhw0LzqUPXOM6ZiQr23IxwDiT1stU3Dk+i:EChwgzt+vZHxwDixstDV
MD5:	A16A074608A2A15654F6A4C431E4B085
SHA1:	71FF1D2EC95185C62B5CA5E1F834B24862697163
SHA-256:	B5E463BCCC6D9F633A97F3958B67B75B6F6E843DCF3DCF32EB772986C3F560CA
SHA-512:	E865CFCF0B4F032FC100334EB48A028334D74A1642DCACAA1367C2A503CF5BED6DB67D2694999CF6C9F05684694B84CA3CFDFB93CB88D1A541C279B02AF1D30A
Malicious:	false
Preview:	MDMP..a..... ........!6f............4...............H...................t...6)..........`.......8...........T...........X...ti......................................................................................................eJ......T.......Lw......................T............!6f.............................0..................W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERFF04.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	10236
Entropy (8bit):	3.707184021124613
Encrypted:	false
SSDEEP:	192:R6l7wVeJAsI6Yegmjgmf9iNt8pDa89bqYJpiHQqlUEnlfbOm:R6lXJrI6Y4jgmf9iNIqmpiHQqlUEnlfL
MD5:	47867CF28097935AA8956AE73139F3CF
SHA1:	3B66807FEF03EAB2967CCE1179F53E5EE800C34A
SHA-256:	2122C09CE6994CA751794DFC2949DACA7575D2EC01C1BDB8FE1CF038448A11EB
SHA-512:	711329470CBBE89BB5234C09AF027EECA775F827354EA9CD21184D0926B5FC83FB0432494A2F77797161BF40EFC478D0559304E322EE19895EF584BCD62E0028
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.5.5.7.2.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERFF53.tmp.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4898
Entropy (8bit):	4.460504683500209
Encrypted:	false
SSDEEP:	48:cvIwWl8zs5Jg771I9UHWpW8VY3Ym8M4JCpCBYgFr2ryq8vhBYjptSTSCd:uIjfLI7L27VvJ4WWpoOCd
MD5:	C4DCFB06567CFCC1B1E3A3132132F090
SHA1:	54652D7E95BED2B090333A39504FC4494CC5BB8C
SHA-256:	4C93D285D4A6C5DC0E69FD92150A96D5B0F5AF8EC6AA7DD2EB74DC48DF584F27
SHA-512:	EB10945CD7AE56C3F12D1833467CBBE7DAF7994DE783F51432F1A13748F4496072309195654894C256EE64B81A7367D7D5E68EBDA15A831539D0F02F4D8C44E8
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="308336" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.469009994101972
Encrypted:	false
SSDEEP:	6144:+IXfpi67eLPU9skLmb0b47WSPKaJG8nAgejZMMhA2gX4WABl0uNHdwBCswSb0:TXD947WlLZMM6YFH9+0
MD5:	2E9D0DE008D212D6D8D58D3C5A4E612D
SHA1:	696C8B3C1284E87168A73F0D0319E3729768D8AE
SHA-256:	343212856FB0E63196CA39E7AEE456013527B429A19FAB3FE1DC641037FAEA5B
SHA-512:	D5110F0BE3CF879D778DA6E8618B48D2557E42CF4A93ABE5936D7001A888D28E75B711D48C97DD4D72B8A5AE52EF689E9FC684E6A75BFC06AFF32BE056D6B98A
Malicious:	false
Preview:	regf:...:....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm..x.................................................................................................................................................................................................................................................................................................................................................y+o.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Entropy (8bit):	6.248799598890663
TrID:	Win64 Dynamic Link Library (generic) (102004/3) 86.43% Win64 Executable (generic) (12005/4) 10.17% Generic Win/DOS Executable (2004/3) 1.70% DOS Executable Generic (2002/1) 1.70% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.01%
File name:	badata_x64.dll.dll
File size:	4'201'984 bytes
MD5:	63799db91ff4c343eb071cfe3b67321d
SHA1:	d368ced88e0cab4fd211c45e66e8dfa6985714b3
SHA256:	8c432e84946ab677d87d3fa9f263597f30d31adf8611df25744eeeb85dd4faaf
SHA512:	4cb9945abf9ea89b70849a3d5022349619038c1d4d436de60e9ee745fd221deea66930c22744e633dceea98a5522fc580b319abbc6103a404b58a4ec8ffe0113
SSDEEP:	98304:D8ocMa2hVtltuaKs5lE1PQm7dBOW/Y3K+4T+3n:D8oNa2hVtltuaKs5lqPhB
TLSH:	70167D4A6BB941A5C5A6D139C67B8A0BE3F2B8502B3187DF02614B5D2F337F1093E725
File Content Preview:	MZ......................@...................................8...........!..L.!This program cannot be run in DOS mode....$.........-.[.CW[.CW[.CW>x@VO.CW>xFV..CW...W_.CW.vGVy.CW.v@VW.CW.vFV..CW>xGV..CW>xEVZ.CW>xBV\|.CW[.BW..CW.wKVW.CW\|..WZ.CW.wGVX.CW.wFV..C

File Icon


Icon Hash:	7ae282899bbab082

Static PE Info

General

Entrypoint:	0x180278154
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x180000000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, DLL
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x63E425EC [Wed Feb 8 22:45:00 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	5577390a221143e6c84c72ee9b135055

Entrypoint Preview

Instruction
dec eax
mov dword ptr [esp+08h], ebx
dec eax
mov dword ptr [esp+10h], esi
push edi
dec eax
sub esp, 20h
dec ecx
mov edi, eax
mov ebx, edx
dec eax
mov esi, ecx
cmp edx, 01h
jne 00007F75707D5707h
call 00007F75707D5DB4h
dec esp
mov eax, edi
mov edx, ebx
dec eax
mov ecx, esi
dec eax
mov ebx, dword ptr [esp+30h]
dec eax
mov esi, dword ptr [esp+38h]
dec eax
add esp, 20h
pop edi
jmp 00007F75707D5594h
int3
int3
int3
dec eax
mov eax, esp
dec eax
mov dword ptr [eax+18h], ebx
dec eax
mov dword ptr [eax+20h], esi
dec eax
mov dword ptr [eax+10h], edx
dec eax
mov dword ptr [eax+08h], ecx
push edi
inc ecx
push esi
inc ecx
push edi
dec eax
sub esp, 30h
dec ebp
mov edi, ecx
dec ebp
mov esi, eax
dec eax
mov esi, edx
dec eax
mov edi, ecx
xor ebx, ebx
dec eax
mov dword ptr [eax-20h], ebx
mov byte ptr [eax-28h], bl
dec ecx
cmp ebx, esi
je 00007F75707D5723h
dec eax
mov ecx, edi
dec ecx
mov eax, edi
dec eax
mov edx, dword ptr [0004C311h]
call edx
dec eax
add edi, esi
dec eax
mov dword ptr [esp+50h], edi
dec eax
inc ebx
dec eax
mov dword ptr [esp+28h], ebx
jmp 00007F75707D56DCh
mov byte ptr [esp+20h], 00000001h
dec eax
mov ebx, dword ptr [esp+60h]
dec eax
mov esi, dword ptr [esp+68h]
dec eax
add esp, 30h
inc ecx
pop edi
inc ecx
pop esi
pop edi
ret
dec eax
sub esp, 38h
dec eax
mov dword ptr [esp+20h], FFFFFFFEh
call 00007F7570648C0Fh
nop
jmp 00007F75707D5704h
xor eax, eax

Rich Headers

Programming Language:

[ C ] VS2005 build 50727

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x3bbd60	0x1954	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x3bd6b4	0x17c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x4fb000	0x529	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x4d9000	0x21948	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x4fc000	0x114aa
IMAGE_DIRECTORY_ENTRY_DEBUG	0x3516e0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x351800	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x351700	0x100	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2c3000	0x14e0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x2c1fac	0x2c2000	075ca53247e7d7d7001782eba578cc75	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x2c3000	0xfe988	0xfea00	359cac9dd9984aa73fc60886395f41f4	False	0.29186322563819345	data	4.626154973642015	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x3c2000	0x116534	0xda00	109bd0befdee975d255ae30981056895	False	0.3007454128440367	Targa image data - Color 24774 x 28903 x 8 +16516 +20645 - 1-bit alpha - four way interleave	4.913842031336163	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x4d9000	0x21948	0x21a00	df64e50825dd96a00eaf8bf305ae8fb2	False	0.5062441914498141	PEX Binary Archive	6.296634644337165	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x4fb000	0x529	0x600	0ce30680c556f6d9ff405a1e8c54d237	False	0.380859375	data	4.976087619962544	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x4fc000	0x114a4	0x11600	108494dc8bb8f996882e61b6f603d29a	False	0.10410577787769784	data	5.450124513944441	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x4fb088	0x323	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.48816936488169366
RT_MANIFEST	0x4fb3ac	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL	Import
SHLWAPI.dll	PathStripToRootW, PathFindExtensionW, PathRemoveFileSpecW, PathIsUNCW, StrCpyW, PathFindFileNameW, StrFormatKBSizeW
SETUPAPI.dll	SetupDiGetClassDevsW, SetupDiGetDeviceInterfaceDetailW, SetupDiEnumDeviceInterfaces, SetupDiDestroyDeviceInfoList
KERNEL32.dll	TlsFree, CreateSemaphoreA, TlsSetValue, SetThreadPriority, GetCurrentThread, DuplicateHandle, GetThreadPriority, TlsGetValue, SetLastError, TlsAlloc, GetCurrentProcessId, EnterCriticalSection, LeaveCriticalSection, GetCurrentProcess, GetProcessAffinityMask, CreateEventA, SetEvent, GetACP, GetCurrentThreadId, LoadLibraryA, GetSystemDirectoryA, CopyFileW, GetSystemDirectoryW, InitializeCriticalSection, CreateThread, ReadFile, GetFileAttributesW, DeleteFileW, GetModuleHandleW, LocalFree, LocalAlloc, CreateSemaphoreW, ReleaseSemaphore, LoadLibraryW, GetProcAddress, FreeLibrary, CreateEventW, ResetEvent, DeviceIoControl, GetDriveTypeW, FindNextFileW, FindFirstFileW, FindClose, GetVersionExW, GetSystemInfo, GetNativeSystemInfo, CloseHandle, SetThreadContext, GetThreadContext, ResumeThread, SuspendThread, SetFileTime, CreateFileW, WideCharToMultiByte, TerminateThread, WaitForSingleObject, MultiByteToWideChar, FindResourceW, RtlUnwind, SizeofResource, GlobalAlloc, GlobalSize, GlobalLock, GlobalUnlock, GlobalFree, MulDiv, FormatMessageW, OutputDebugStringA, EncodePointer, FreeResource, GetModuleFileNameW, GetModuleHandleExW, LoadLibraryExW, GlobalDeleteAtom, lstrcmpW, GlobalAddAtomW, GlobalFindAtomW, CreateActCtxW, ActivateActCtx, DeactivateActCtx, FindActCtxSectionStringW, QueryActCtxW, CompareStringW, VirtualProtect, lstrcmpA, GetPrivateProfileIntW, GetPrivateProfileStringW, WritePrivateProfileStringW, GlobalReAlloc, GlobalHandle, LocalReAlloc, GlobalGetAtomNameW, FileTimeToSystemTime, GlobalFlags, lstrcpyW, GetLocaleInfoW, WaitForMultipleObjects, GetUserDefaultUILanguage, FindResourceExW, SetErrorMode, GetCurrentDirectoryW, FlushFileBuffers, GetFileSize, GetFullPathNameW, GetVolumeInformationW, LockFile, SetEndOfFile, SetFilePointer, UnlockFile, WriteFile, lstrcmpiW, GetWindowsDirectoryW, VerSetConditionMask, VerifyVersionInfoW, FileTimeToLocalFileTime, GetFileAttributesExW, GetFileSizeEx, GetFileTime, SystemTimeToTzSpecificLocalTime, GetTempPathW, GetProfileIntW, SearchPathW, GetTempFileNameW, GetUserDefaultLCID, WaitForSingleObjectEx, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TerminateProcess, IsProcessorFeaturePresent, IsDebuggerPresent, GetStartupInfoW, QueryPerformanceCounter, GetSystemTimeAsFileTime, InitializeSListHead, OutputDebugStringW, SwitchToThread, LCMapStringW, GetStringTypeW, GetCPInfo, RtlUnwindEx, RtlPcToFileHeader, InterlockedFlushSList, GetFileInformationByHandle, GetFileType, PeekNamedPipe, CreateDirectoryW, GetTimeZoneInformation, ExitThread, FreeLibraryAndExitThread, ExitProcess, GetCommandLineA, GetCommandLineW, HeapQueryInformation, VirtualAlloc, VirtualQuery, QueryPerformanceFrequency, SetStdHandle, GetStdHandle, GetDateFormatW, GetTimeFormatW, IsValidLocale, EnumSystemLocalesW, GetConsoleMode, ReadConsoleW, SetFilePointerEx, GetConsoleCP, FindFirstFileExW, IsValidCodePage, GetOEMCP, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetEnvironmentVariableW, WriteConsoleW, LockResource, LoadResource, GetTickCount, Sleep, DeleteCriticalSection, InitializeCriticalSectionAndSpinCount, GetProcessHeap, HeapSize, HeapFree, HeapReAlloc, HeapAlloc, GetLastError, RaiseException, DecodePointer, GetSystemDefaultUILanguage
USER32.dll	IsDialogMessageW, CreateDialogIndirectParamW, GetNextDlgTabItem, GetActiveWindow, GetDesktopWindow, LoadMenuW, GetMessageW, GetAsyncKeyState, MapDialogRect, PostQuitMessage, ShowOwnedPopups, GetWindowThreadProcessId, GetKeyNameTextW, MapVirtualKeyW, GetDC, ReleaseDC, GetSystemMetrics, GetSysColorBrush, DrawTextW, DrawTextExW, GrayStringW, TabbedTextOutW, GetWindowDC, ClientToScreen, FillRect, RealChildWindowFromPoint, TrackMouseEvent, InvalidateRect, InflateRect, DestroyIcon, LoadImageW, DestroyMenu, GetMenuItemInfoW, SystemParametersInfoW, CopyImage, DeleteMenu, CharUpperW, IntersectRect, GetNextDlgGroupItem, WindowFromPoint, DrawFocusRect, IsRectEmpty, DrawIconEx, GetIconInfo, MessageBeep, EnableScrollBar, HideCaret, InvertRect, NotifyWinEvent, CreatePopupMenu, GetMenuDefaultItem, SetLayeredWindowAttributes, EnumDisplayMonitors, SetClassLongPtrW, SetWindowRgn, SetParent, OpenClipboard, CloseClipboard, SetClipboardData, EmptyClipboard, DrawStateW, DrawEdge, DrawFrameControl, IsZoomed, GetSystemMenu, BringWindowToTop, SetCursorPos, CopyIcon, FrameRect, DrawIcon, UnionRect, UpdateLayeredWindow, MonitorFromPoint, LoadAcceleratorsW, TranslateAcceleratorW, InsertMenuItemW, UnpackDDElParam, ReuseDDElParam, GetComboBoxInfo, PostThreadMessageW, WaitMessage, GetKeyboardLayout, IsCharLowerW, MapVirtualKeyExW, ToUnicodeEx, GetKeyboardState, CreateAcceleratorTableW, DestroyAcceleratorTable, CopyAcceleratorTableW, SetRect, LockWindowUpdate, SetMenuDefaultItem, GetDoubleClickTime, ModifyMenuW, RegisterClipboardFormatW, CharUpperBuffW, IsClipboardFormatAvailable, GetUpdateRect, DrawMenuBar, DefFrameProcW, DefMDIChildProcW, TranslateMDISysAccel, SubtractRect, CreateMenu, GetWindowRgn, DestroyCursor, IsWindowEnabled, IsDlgButtonChecked, CheckDlgButton, SetDlgItemTextW, MoveWindow, ShowWindow, GetMonitorInfoW, MonitorFromWindow, WinHelpW, GetScrollInfo, SetScrollInfo, CallNextHookEx, SetWindowsHookExW, GetLastActivePopup, GetClassLongPtrW, SetWindowLongPtrW, GetWindowLongPtrW, EqualRect, CopyRect, GetSysColor, MapWindowPoints, ScreenToClient, AdjustWindowRectEx, RemovePropW, GetPropW, SetPropW, ShowScrollBar, GetScrollRange, SetScrollRange, ScrollWindow, RedrawWindow, ValidateRect, EndPaint, BeginPaint, SetForegroundWindow, GetForegroundWindow, SetActiveWindow, UpdateWindow, TrackPopupMenu, SetMenu, GetMenu, GetCapture, GetKeyState, GetDlgCtrlID, IsIconic, IsWindowVisible, EndDeferWindowPos, DeferWindowPos, BeginDeferWindowPos, SetWindowPlacement, GetWindowPlacement, SetWindowPos, DestroyWindow, IsChild, IsMenu, IsWindow, GetClassInfoExW, GetClassInfoW, RegisterClassW, CallWindowProcW, GetMessageTime, GetMessagePos, SetMenuItemInfoW, GetMenuCheckMarkDimensions, SetMenuItemBitmaps, EnableMenuItem, CheckMenuItem, GetFocus, GetParent, OffsetRect, SetRectEmpty, GetClientRect, SendDlgItemMessageA, GetWindowTextLengthW, GetWindowTextW, GetScrollPos, SetScrollPos, SetFocus, UnhookWindowsHookEx, RemoveMenu, AppendMenuW, InsertMenuW, GetMenuItemCount, GetMenuItemID, GetSubMenu, GetMenuState, GetMenuStringW, RegisterWindowMessageW, SendMessageW, PostMessageW, UnregisterClassW, EnableWindow, GetWindowRect, LoadIconW, SetCapture, ReleaseCapture, GetClassNameW, GetTopWindow, GetWindow, TranslateMessage, DispatchMessageW, PeekMessageW, DefWindowProcW, CreateWindowExW, DialogBoxIndirectParamW, EndDialog, GetDlgItem, SetTimer, KillTimer, SetWindowTextW, SetCursor, GetCursorPos, PtInRect, GetWindowLongW, SetWindowLongW, EnumThreadWindows, LoadBitmapW, LoadCursorW, MessageBoxW
GDI32.dll	GetTextExtentPoint32W, CreateFontIndirectW, ScaleWindowExtEx, ScaleViewportExtEx, OffsetWindowOrgEx, SetPixel, StretchBlt, OffsetViewportOrgEx, SetWindowOrgEx, SetWindowExtEx, SetViewportOrgEx, CreateDIBSection, SetDIBColorTable, CreateEllipticRgn, Ellipse, GetTextColor, CreatePolygonRgn, Polygon, Polyline, CreateRoundRectRgn, LPtoDP, Rectangle, GetRgnBox, OffsetRgn, RoundRect, FillRgn, FrameRgn, GetBoundsRect, PtInRegion, ExtFloodFill, SetPaletteEntries, SetPixelV, GetWindowOrgEx, GetViewportOrgEx, GetTextCharsetInfo, GetTextMetricsW, GetTextFaceW, SetViewportExtEx, ExtTextOutW, TextOutW, MoveToEx, GetObjectW, EnumFontFamiliesW, CreateDIBitmap, CreateCompatibleBitmap, GetBkColor, RealizePalette, GetSystemPaletteEntries, GetPaletteEntries, GetNearestPaletteIndex, CreatePalette, DPtoLP, CreateRectRgnIndirect, PatBlt, BitBlt, CreateCompatibleDC, CreateHatchBrush, CreatePen, CreatePatternBrush, CreateRectRgn, CreateSolidBrush, DeleteObject, Escape, ExcludeClipRect, GetClipBox, GetObjectType, GetPixel, GetViewportExtEx, GetWindowExtEx, IntersectClipRect, LineTo, GetStockObject, SetBkMode, SetTextColor, PtVisible, RectVisible, RestoreDC, SaveDC, SetRectRgn, CombineRgn, SetBkColor, CreateBitmap, DeleteDC, GetDeviceCaps, CreateDCW, CopyMetaFileW, SelectClipRgn, ExtSelectClipRgn, SelectObject, SelectPalette, SetMapMode, SetLayout, GetLayout, SetPolyFillMode, SetROP2, SetTextAlign, EnumFontFamiliesExW
SHELL32.dll	SHAppBarMessage, SHBrowseForFolderW, ShellExecuteW, DragFinish, DragQueryFileW, SHGetDesktopFolder, SHGetSpecialFolderLocation, SHGetPathFromIDListW, SHGetFileInfoW, SHChangeNotify
OLEAUT32.dll	VarBstrFromDate, VariantCopy, SysAllocStringLen, VariantInit, VariantClear, VariantChangeType, SysAllocString, LoadTypeLib, SysStringLen, SystemTimeToVariantTime, VariantTimeToSystemTime, SysFreeString
COMDLG32.dll	GetSaveFileNameW
ADVAPI32.dll	RegQueryValueExW, RegOpenKeyExW, RegCloseKey, RegCreateKeyExW, RegDeleteKeyW, RegDeleteValueW, RegSetValueExW, RegEnumKeyW, RegQueryValueW, RegEnumValueW, RegEnumKeyExW
MSIMG32.dll	TransparentBlt, AlphaBlend
UxTheme.dll	GetCurrentThemeName, DrawThemeText, DrawThemeParentBackground, GetThemePartSize, GetThemeSysColor, IsThemeBackgroundPartiallyTransparent, IsAppThemed, OpenThemeData, GetWindowTheme, GetThemeColor, DrawThemeBackground, CloseThemeData
WINMM.dll	waveOutOpen, waveOutPrepareHeader, waveOutUnprepareHeader, PlaySoundW, waveOutGetPosition, waveOutReset, waveOutWrite, waveOutClose
WS2_32.dll	WSAStartup, WSACleanup, WSASetLastError, htons, htonl, connect, inet_addr, inet_ntoa, ntohs, recv, send, shutdown, socket, gethostbyaddr, gethostbyname, getservbyport, WSAGetLastError, getservbyname
gdiplus.dll	GdipCreateFromHDC, GdipCreateBitmapFromHBITMAP, GdipDrawImageI, GdipDeleteGraphics, GdipBitmapUnlockBits, GdipBitmapLockBits, GdipCreateBitmapFromScan0, GdipCreateBitmapFromStream, GdipGetImagePaletteSize, GdipGetImagePalette, GdipGetImagePixelFormat, GdipGetImageHeight, GdipGetImageWidth, GdipGetImageGraphicsContext, GdipDisposeImage, GdipCloneImage, GdiplusStartup, GdipFree, GdipAlloc, GdiplusShutdown, GdipDrawImageRectI, GdipSetInterpolationMode
OLEACC.dll	AccessibleObjectFromWindow, CreateStdAccessibleObject, LresultFromObject
IMM32.dll	ImmReleaseContext, ImmGetContext, ImmGetOpenStatus
WINSPOOL.DRV	OpenPrinterW, ClosePrinter, DocumentPropertiesW
ole32.dll	CoInitializeEx, CreateStreamOnHGlobal, CoDisconnectObject, CoInitialize, CoCreateInstance, CoCreateGuid, CoUninitialize, ReleaseStgMedium, OleDuplicateData, CoTaskMemFree, CoTaskMemAlloc, IsAccelerator, OleTranslateAccelerator, OleDestroyMenuDescriptor, OleCreateMenuDescriptor, OleLockRunning, RevokeDragDrop, RegisterDragDrop, CoLockObjectExternal, OleGetClipboard, DoDragDrop

Exports

Name	Ordinal	Address
Abort	1	0x180038d50
AddBurnDevice	2	0x180038d70
AddDir	3	0x180038dd0
AddFile	4	0x180038e00
AddFileEx	5	0x180038e30
AnalyseDeviceCapability	6	0x180038e60
AudioFileStop	7	0x180038eb0
Burn	8	0x180038ed0
BurnDialog	9	0x180014f10
BurnISO	10	0x180038ef0
CheckLicenseKey	11	0x180038f60
CheckSignature	12	0x180039030
ClearAll	13	0x180039050
CloseCDTextHandle	14	0x180039070
CloseDevice	15	0x180039090
CloseDirectory	16	0x1800390b0
CloseDiskSession	17	0x1800390f0
CloseNetworkTagsHandle	18	0x180039130
CloseSession	19	0x180039150
ConvertSpeedFromKBPerSec	20	0x180039170
CopyDisk	21	0x1800391a0
CreateDir	22	0x1800391d0
CreateImage	23	0x180039200
CreateProject	24	0x180039260
DABurn	25	0x180039280
DABurnISOImage	26	0x1800392e0
DACheckSignature	27	0x180039380
DACloseDevice	28	0x1800393e0
DACloseSession	29	0x180039450
DAConvertSpeedFromKBPerSec	30	0x1800394b0
DACopyDisk	31	0x180039530
DACreateImage	32	0x1800395a0
DAEjectDevice	33	0x180039650
DAErase	34	0x1800396c0
DAGetBurnSpeed	35	0x180039750
DAGetDeviceCapabilities	36	0x1800397c0
DAGetDeviceCapabilitiesHandle	37	0x180039830
DAGetDeviceInformation	38	0x1800398a0
DAGetDeviceInformationEx	39	0x180039940
DAGetMaxBurnSpeed	40	0x1800399b0
DAGetMaxReadSpeed	41	0x1800399b0
DAGetMediumFreedbId	42	0x180039a20
DAGetMediumInformation	43	0x180039a90
DAGetPossibleBurnSpeeds	44	0x180039b00
DAGetPossibleImageFormats	45	0x180039b90
DAGetPossibleReadSpeeds	46	0x180039c00
DAGetReadSpeed	47	0x180039c90
DAGetSessionInformation	48	0x180039d00
DAGetTrackFormatEx	49	0x180039d80
DAGetTrackISRC	50	0x180039e00
DAGetTrackIndexes	51	0x180039e80
DAGetTrackInformation	52	0x180039f20
DAGrabAudioTrack	53	0x180039fa0
DAImportFile	54	0x18003a0b0
DAImportFileEx	55	0x18003a180
DAIsDeviceReady	56	0x18003a290
DALockMedium	57	0x18003a330
DAOpenDiskSession	58	0x18003a3a0
DAPlayAudioTrack	59	0x18003a440
DAPrepare	60	0x18003a4b0
DAReadCDText	61	0x18003a510
DAReadFileContents	62	0x18003a5a0
DAReadSectors	63	0x18003a6b0
DASaveTrackToFile	64	0x18003a760
DASetBurnSpeed	65	0x18003a830
DASetReadSpeed	66	0x18003a890
DASetRegionalCode	67	0x18003a8f0
DAVerifyFile	68	0x18003a950
DeInitialize	69	0x18003a9f0
DeleteProject	70	0x18003aa60
DirExists	71	0x18003aa80
EjectDevice	72	0x18003aae0
EnableImageDevice	73	0x18003ab00
EnableMCNDisabling	74	0x18003ab20
Erase	75	0x18003ab40
EraseDialog	76	0x180014f70
EraseMpegByIndex	77	0x18003ab70
ForceDeInitialize	78	0x18003ab90
GetASPI	79	0x18003abb0
GetActiveDevicesCount	80	0x18003abe0
GetAudioFileSize	81	0x18003ac00
GetBootInfoEx	82	0x18003ac70
GetBootVolumeInformation	83	0x18003aca0
GetBurnDevice	84	0x18003acd0
GetBurnDevices	85	0x18003adb0
GetBurnDoneEventCallback	86	0x18003ade0
GetBurnFileEventCallback	87	0x18003ae20
GetBurnSpeed	88	0x18003ae60
GetCDTextDiskTagString	89	0x18003ae90
GetCDTextTrackTagString	90	0x18003af60
GetCompareFilesForArrangementEventCallback	91	0x18003b050
GetCompressEncrypt	92	0x18003b090
GetDVDVideoOptions	93	0x18003b0c0
GetDeviceCapabilities	94	0x18003b0f0
GetDeviceCapabilitiesHandle	95	0x18003b120
GetDeviceInformation	96	0x18003b150
GetDeviceInformationEx	97	0x18003b190
GetDevices	98	0x18003b1c0
GetEraseDoneEventCallback	99	0x18003b1f0
GetErrorDeviceName	100	0x18003b230
GetFileAllocationTable	101	0x18003b250
GetFileEntry	102	0x18003b2f0
GetFileTimeEx	103	0x18003b320
GetFinalizeEventCallback	104	0x18003b350
GetISOInfoEx	105	0x18003b390
GetISOVolumeInformation	106	0x18003b3c0
GetImageFilePath	107	0x18003b3f0
GetImageSize	108	0x18003b4a0
GetInfoTextEventCallback	109	0x18003b4d0
GetJobDoneEventCallback	110	0x18003b510
GetLanguage	111	0x18003b550
GetMaxBurnSpeed	112	0x18003b630
GetMaxReadSpeed	113	0x18003b630
GetMediumFreedbId	114	0x18003b660
GetMediumInformation	115	0x18003b690
GetMpegCount	116	0x18003b6c0
GetNetworkDiskTagInt	117	0x18003b6e0
GetNetworkDiskTagString	118	0x18003b710
GetNetworkTrackTagInt	119	0x18003b7d0
GetNetworkTrackTagString	120	0x18003b810
GetNumberOfFiles	121	0x18003b900
GetOptions	122	0x18003b930
GetPlayTime	123	0x18003b960
GetPossibleBurnSpeeds	124	0x18003b9d0
GetPossibleImageFormats	125	0x18003ba00
GetPossibleReadSpeeds	126	0x18003ba20
GetPrecisePlayTime	127	0x18003ba50
GetProcessEventCallback	128	0x18003bac0
GetProjectType	129	0x18003bb00
GetRAWDataEventCallback	130	0x18003bb30
GetReadDevice	131	0x18003bb60
GetReadSpeed	132	0x18003bc40
GetSessionInformation	133	0x18003bc70
GetStartVerifyEventCallback	134	0x18003bca0
GetText	135	0x18003bce0
GetTmpPath	136	0x18003bd50
GetTrackFormatEx	137	0x18003bda0
GetTrackISRC	138	0x18003bdd0
GetTrackIndexes	139	0x18003be00
GetTrackInformation	140	0x18003be40
GetUDFOptions	141	0x18003be70
GetUDFOptionsEx	142	0x18003bf30
GetUDFVolumeInformation	143	0x18003bf60
GetVerify	144	0x18003bf90
GetVerifyDoneEventCallback	145	0x18003bff0
GetVerifyErrorEventCallback	146	0x18003c030
GetVerifyFileEventCallback	147	0x18003c070
GetVerifySectorEventCallback	148	0x18003c0b0
GetWriteCDTextInUnicode	149	0x18003c0f0
GrabAudioTrack	150	0x18003c130
ImportFile	151	0x18003c200
ImportFileEx	152	0x18003c2a0
Initialize	153	0x18003c360
IsDeviceReady	154	0x18003c430
IsValidVideoTsFolder	155	0x18003c490
LoadBassPlugin	156	0x18003c750
LockMedium	157	0x18003c7b0
MultiDeviceDialog	158	0x180014f90
OpenDirectory	159	0x18003c7d0
OpenDiskSession	160	0x18003c850
PlayAudioFile	161	0x18003c890
PlayAudioTrack	162	0x18003c8f0
Prepare	163	0x18003c910
ReadCDText	164	0x18003c930
ReadDirectory	165	0x18003c980
ReadFileContents	166	0x18003c9b0
ReadSectors	167	0x18003ca70
ReleaseDeviceCapabilities	168	0x18003cac0
RemoveBurnDevice	169	0x18003cae0
RemoveDir	170	0x18003cb40
RemoveFile	171	0x18003cb70
RenameDir	172	0x18003cba0
RenameFile	173	0x18003cbd0
RescanDevices	174	0x18003cc00
ResetCallbacks	175	0x18003cc20
SaveLogToFile	176	0x18003cc50
SaveOptionsToFile	177	0x18003ccb0
SaveTrackToFile	178	0x18003cd10
SetASPI	179	0x18003cd90
SetAddFileEventCallback	180	0x18003cdb0
SetAudioDecodeDoneEventCallback	181	0x18003ce00
SetAudioDecoderEventCallback	182	0x18003ce50
SetAudioFileProperty	183	0x18003cea0
SetBootInfoEx	184	0x18003ced0
SetBurnDevice	185	0x18003cf20
SetBurnDoneEventCallback	186	0x18003cf80
SetBurnFileEventCallback	187	0x18003cfd0
SetBurnSpeed	188	0x18003d020
SetCompareFilesForArrangementEventCallback	189	0x18003d040
SetCompressEncrypt	190	0x18003d090
SetCreateDirEventCallback	191	0x18003d0c0
SetDVDVideoOptions	192	0x18003d110
SetEraseDoneEventCallback	193	0x18003d140
SetFXApp	194	0x180015030
SetFileAttr	195	0x18003d190
SetFileTimeEx	196	0x18003d1b0
SetFileTimes	197	0x18003d1e0
SetFileUserParam	198	0x18003d230
SetFinalizeEventCallback	199	0x18003d260
SetGetTextEventCallback	200	0x18003d2b0
SetISOInfoEx	201	0x18003d300
SetIgnoreFileExist	202	0x18003d330
SetImageFilePath	203	0x18003d350
SetInfoTextEventCallback	204	0x18003d3b0
SetJobDoneEventCallback	205	0x18003d430
SetLanguage	206	0x18003d480
SetOptions	207	0x18003d510
SetOptionsFromFile	208	0x18003d540
SetProcessEventCallback	209	0x18003d5a0
SetRAWDataEventCallback	210	0x18003d5f0
SetRAWStructure	211	0x18003d640
SetReadDevice	212	0x18003d670
SetReadSpeed	213	0x18003d6d0
SetRegionalCode	214	0x18003d6f0
SetRemoveFileEventCallback	215	0x18003d710
SetStartVerifyEventCallback	216	0x18003d760
SetTmpPath	217	0x18003d7b0
SetUDFOptions	218	0x18003d830
SetUDFOptionsEx	219	0x18003d8d0
SetVCDKeyHandler	220	0x18003d900
SetVCDTimeOutHandler	221	0x18003d920
SetVerify	222	0x18003d940
SetVerifyDoneEventCallback	223	0x18003d960
SetVerifyErrorEventCallback	224	0x18003d9b0
SetVerifyFileEventCallback	225	0x18003da00
SetVerifySectorEventCallback	226	0x18003da50
SetVideoScanDoneEventCallback	227	0x18003daa0
SetVideoScannerEventCallback	228	0x18003daf0
SetWriteCDTextInUnicode	229	0x18003db40
StopMpegAction	230	0x18003db60
TagsFromNetworkDialog	231	0x180015040
VerifyFile	232	0x18003db80

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 4, 2024 13:52:59.920548916 CEST	49678	443	192.168.2.4	104.46.162.224
May 4, 2024 13:53:01.311158895 CEST	49675	443	192.168.2.4	173.222.162.32
May 4, 2024 13:53:11.045530081 CEST	49675	443	192.168.2.4	173.222.162.32
May 4, 2024 13:53:15.932365894 CEST	49736	443	192.168.2.4	142.250.217.132
May 4, 2024 13:53:15.932393074 CEST	443	49736	142.250.217.132	192.168.2.4
May 4, 2024 13:53:15.932442904 CEST	49736	443	192.168.2.4	142.250.217.132
May 4, 2024 13:53:15.932797909 CEST	49736	443	192.168.2.4	142.250.217.132
May 4, 2024 13:53:15.932809114 CEST	443	49736	142.250.217.132	192.168.2.4
May 4, 2024 13:53:16.245651960 CEST	443	49736	142.250.217.132	192.168.2.4
May 4, 2024 13:53:16.356993914 CEST	49736	443	192.168.2.4	142.250.217.132
May 4, 2024 13:53:17.430306911 CEST	49736	443	192.168.2.4	142.250.217.132
May 4, 2024 13:53:17.430335999 CEST	443	49736	142.250.217.132	192.168.2.4
May 4, 2024 13:53:17.431509972 CEST	443	49736	142.250.217.132	192.168.2.4
May 4, 2024 13:53:17.431523085 CEST	443	49736	142.250.217.132	192.168.2.4
May 4, 2024 13:53:17.431665897 CEST	49736	443	192.168.2.4	142.250.217.132
May 4, 2024 13:53:17.434149981 CEST	49736	443	192.168.2.4	142.250.217.132
May 4, 2024 13:53:17.434221029 CEST	443	49736	142.250.217.132	192.168.2.4
May 4, 2024 13:53:17.544491053 CEST	49736	443	192.168.2.4	142.250.217.132
May 4, 2024 13:53:17.544506073 CEST	443	49736	142.250.217.132	192.168.2.4
May 4, 2024 13:53:17.653863907 CEST	49736	443	192.168.2.4	142.250.217.132
May 4, 2024 13:53:18.283510923 CEST	49738	443	192.168.2.4	20.190.151.132
May 4, 2024 13:53:18.283559084 CEST	443	49738	20.190.151.132	192.168.2.4
May 4, 2024 13:53:18.283623934 CEST	49738	443	192.168.2.4	20.190.151.132
May 4, 2024 13:53:18.283904076 CEST	49738	443	192.168.2.4	20.190.151.132
May 4, 2024 13:53:18.283916950 CEST	443	49738	20.190.151.132	192.168.2.4
May 4, 2024 13:53:18.314030886 CEST	49739	443	192.168.2.4	23.32.230.129
May 4, 2024 13:53:18.314069986 CEST	443	49739	23.32.230.129	192.168.2.4
May 4, 2024 13:53:18.314126015 CEST	49739	443	192.168.2.4	23.32.230.129
May 4, 2024 13:53:18.315759897 CEST	49739	443	192.168.2.4	23.32.230.129
May 4, 2024 13:53:18.315773010 CEST	443	49739	23.32.230.129	192.168.2.4
May 4, 2024 13:53:18.623912096 CEST	443	49739	23.32.230.129	192.168.2.4
May 4, 2024 13:53:18.623974085 CEST	49739	443	192.168.2.4	23.32.230.129
May 4, 2024 13:53:18.639890909 CEST	49739	443	192.168.2.4	23.32.230.129
May 4, 2024 13:53:18.639908075 CEST	443	49739	23.32.230.129	192.168.2.4
May 4, 2024 13:53:18.640180111 CEST	443	49739	23.32.230.129	192.168.2.4
May 4, 2024 13:53:18.699830055 CEST	49739	443	192.168.2.4	23.32.230.129
May 4, 2024 13:53:18.740155935 CEST	443	49739	23.32.230.129	192.168.2.4
May 4, 2024 13:53:18.918675900 CEST	443	49739	23.32.230.129	192.168.2.4
May 4, 2024 13:53:18.918756008 CEST	443	49739	23.32.230.129	192.168.2.4
May 4, 2024 13:53:18.918874025 CEST	49739	443	192.168.2.4	23.32.230.129
May 4, 2024 13:53:18.918874025 CEST	49739	443	192.168.2.4	23.32.230.129
May 4, 2024 13:53:18.918896914 CEST	49739	443	192.168.2.4	23.32.230.129
May 4, 2024 13:53:18.918908119 CEST	443	49739	23.32.230.129	192.168.2.4
May 4, 2024 13:53:18.935354948 CEST	443	49738	20.190.151.132	192.168.2.4
May 4, 2024 13:53:18.935421944 CEST	49738	443	192.168.2.4	20.190.151.132
May 4, 2024 13:53:18.962692976 CEST	49740	443	192.168.2.4	23.32.230.129
May 4, 2024 13:53:18.962739944 CEST	443	49740	23.32.230.129	192.168.2.4
May 4, 2024 13:53:18.967008114 CEST	49740	443	192.168.2.4	23.32.230.129
May 4, 2024 13:53:18.967184067 CEST	49740	443	192.168.2.4	23.32.230.129
May 4, 2024 13:53:18.967195988 CEST	443	49740	23.32.230.129	192.168.2.4
May 4, 2024 13:53:19.275337934 CEST	443	49740	23.32.230.129	192.168.2.4
May 4, 2024 13:53:19.278719902 CEST	49740	443	192.168.2.4	23.32.230.129
May 4, 2024 13:53:19.302717924 CEST	49740	443	192.168.2.4	23.32.230.129
May 4, 2024 13:53:19.302735090 CEST	443	49740	23.32.230.129	192.168.2.4
May 4, 2024 13:53:19.303021908 CEST	443	49740	23.32.230.129	192.168.2.4
May 4, 2024 13:53:19.306713104 CEST	49740	443	192.168.2.4	23.32.230.129
May 4, 2024 13:53:19.352117062 CEST	443	49740	23.32.230.129	192.168.2.4
May 4, 2024 13:53:19.454719067 CEST	49738	443	192.168.2.4	20.190.151.132
May 4, 2024 13:53:19.454745054 CEST	443	49738	20.190.151.132	192.168.2.4
May 4, 2024 13:53:19.455178976 CEST	443	49738	20.190.151.132	192.168.2.4
May 4, 2024 13:53:19.480654001 CEST	49738	443	192.168.2.4	20.190.151.132
May 4, 2024 13:53:19.480654001 CEST	49738	443	192.168.2.4	20.190.151.132
May 4, 2024 13:53:19.480695009 CEST	443	49738	20.190.151.132	192.168.2.4
May 4, 2024 13:53:19.579332113 CEST	443	49740	23.32.230.129	192.168.2.4
May 4, 2024 13:53:19.579413891 CEST	443	49740	23.32.230.129	192.168.2.4
May 4, 2024 13:53:19.579545975 CEST	49740	443	192.168.2.4	23.32.230.129
May 4, 2024 13:53:19.580250025 CEST	49740	443	192.168.2.4	23.32.230.129
May 4, 2024 13:53:19.580265045 CEST	443	49740	23.32.230.129	192.168.2.4
May 4, 2024 13:53:19.580292940 CEST	49740	443	192.168.2.4	23.32.230.129
May 4, 2024 13:53:19.580297947 CEST	443	49740	23.32.230.129	192.168.2.4
May 4, 2024 13:53:19.924954891 CEST	443	49738	20.190.151.132	192.168.2.4
May 4, 2024 13:53:19.925055027 CEST	443	49738	20.190.151.132	192.168.2.4
May 4, 2024 13:53:19.930726051 CEST	49738	443	192.168.2.4	20.190.151.132
May 4, 2024 13:53:19.942601919 CEST	49738	443	192.168.2.4	20.190.151.132
May 4, 2024 13:53:19.942601919 CEST	49738	443	192.168.2.4	20.190.151.132
May 4, 2024 13:53:19.942624092 CEST	443	49738	20.190.151.132	192.168.2.4
May 4, 2024 13:53:19.942650080 CEST	443	49738	20.190.151.132	192.168.2.4
May 4, 2024 13:53:20.012020111 CEST	49743	443	192.168.2.4	20.190.151.132
May 4, 2024 13:53:20.012053967 CEST	443	49743	20.190.151.132	192.168.2.4
May 4, 2024 13:53:20.012119055 CEST	49743	443	192.168.2.4	20.190.151.132
May 4, 2024 13:53:20.012258053 CEST	49743	443	192.168.2.4	20.190.151.132
May 4, 2024 13:53:20.012273073 CEST	443	49743	20.190.151.132	192.168.2.4
May 4, 2024 13:53:20.670175076 CEST	443	49743	20.190.151.132	192.168.2.4
May 4, 2024 13:53:20.721018076 CEST	49743	443	192.168.2.4	20.190.151.132
May 4, 2024 13:53:22.995357990 CEST	49743	443	192.168.2.4	20.190.151.132
May 4, 2024 13:53:22.995398045 CEST	443	49743	20.190.151.132	192.168.2.4
May 4, 2024 13:53:22.998984098 CEST	49743	443	192.168.2.4	20.190.151.132
May 4, 2024 13:53:22.998991966 CEST	443	49743	20.190.151.132	192.168.2.4
May 4, 2024 13:53:22.999217033 CEST	49743	443	192.168.2.4	20.190.151.132
May 4, 2024 13:53:22.999232054 CEST	443	49743	20.190.151.132	192.168.2.4
May 4, 2024 13:53:23.815258026 CEST	49672	443	192.168.2.4	173.222.162.32
May 4, 2024 13:53:23.815294981 CEST	443	49672	173.222.162.32	192.168.2.4
May 4, 2024 13:53:23.976105928 CEST	49745	443	192.168.2.4	40.127.169.103
May 4, 2024 13:53:23.976134062 CEST	443	49745	40.127.169.103	192.168.2.4
May 4, 2024 13:53:23.976365089 CEST	49745	443	192.168.2.4	40.127.169.103
May 4, 2024 13:53:23.977364063 CEST	49745	443	192.168.2.4	40.127.169.103
May 4, 2024 13:53:23.977374077 CEST	443	49745	40.127.169.103	192.168.2.4
May 4, 2024 13:53:24.830527067 CEST	443	49745	40.127.169.103	192.168.2.4
May 4, 2024 13:53:24.830636978 CEST	49745	443	192.168.2.4	40.127.169.103
May 4, 2024 13:53:24.834125042 CEST	49745	443	192.168.2.4	40.127.169.103
May 4, 2024 13:53:24.834132910 CEST	443	49745	40.127.169.103	192.168.2.4
May 4, 2024 13:53:24.834378004 CEST	443	49745	40.127.169.103	192.168.2.4
May 4, 2024 13:53:24.916409016 CEST	49745	443	192.168.2.4	40.127.169.103
May 4, 2024 13:53:24.960115910 CEST	443	49745	40.127.169.103	192.168.2.4
May 4, 2024 13:53:25.667166948 CEST	443	49745	40.127.169.103	192.168.2.4
May 4, 2024 13:53:25.667190075 CEST	443	49745	40.127.169.103	192.168.2.4
May 4, 2024 13:53:25.667196989 CEST	443	49745	40.127.169.103	192.168.2.4
May 4, 2024 13:53:25.667224884 CEST	443	49745	40.127.169.103	192.168.2.4
May 4, 2024 13:53:25.667238951 CEST	443	49745	40.127.169.103	192.168.2.4
May 4, 2024 13:53:25.667251110 CEST	443	49745	40.127.169.103	192.168.2.4
May 4, 2024 13:53:25.667350054 CEST	49745	443	192.168.2.4	40.127.169.103
May 4, 2024 13:53:25.667350054 CEST	49745	443	192.168.2.4	40.127.169.103
May 4, 2024 13:53:25.667368889 CEST	443	49745	40.127.169.103	192.168.2.4
May 4, 2024 13:53:25.667378902 CEST	443	49745	40.127.169.103	192.168.2.4
May 4, 2024 13:53:25.667397976 CEST	443	49745	40.127.169.103	192.168.2.4
May 4, 2024 13:53:25.667404890 CEST	443	49745	40.127.169.103	192.168.2.4
May 4, 2024 13:53:25.667418957 CEST	49745	443	192.168.2.4	40.127.169.103
May 4, 2024 13:53:25.667459965 CEST	49745	443	192.168.2.4	40.127.169.103
May 4, 2024 13:53:26.256763935 CEST	443	49736	142.250.217.132	192.168.2.4
May 4, 2024 13:53:26.256827116 CEST	443	49736	142.250.217.132	192.168.2.4
May 4, 2024 13:53:26.256889105 CEST	49736	443	192.168.2.4	142.250.217.132
May 4, 2024 13:53:26.366442919 CEST	49745	443	192.168.2.4	40.127.169.103
May 4, 2024 13:53:26.366460085 CEST	443	49745	40.127.169.103	192.168.2.4
May 4, 2024 13:53:26.366472960 CEST	49745	443	192.168.2.4	40.127.169.103
May 4, 2024 13:53:26.366478920 CEST	443	49745	40.127.169.103	192.168.2.4
May 4, 2024 13:53:26.667907953 CEST	49736	443	192.168.2.4	142.250.217.132
May 4, 2024 13:53:26.667937994 CEST	443	49736	142.250.217.132	192.168.2.4
May 4, 2024 13:53:33.551183939 CEST	443	49743	20.190.151.132	192.168.2.4
May 4, 2024 13:53:33.551275015 CEST	443	49743	20.190.151.132	192.168.2.4
May 4, 2024 13:53:33.551376104 CEST	49743	443	192.168.2.4	20.190.151.132
May 4, 2024 13:53:34.391283035 CEST	49743	443	192.168.2.4	20.190.151.132
May 4, 2024 13:53:34.391304970 CEST	443	49743	20.190.151.132	192.168.2.4
May 4, 2024 13:53:34.391318083 CEST	49743	443	192.168.2.4	20.190.151.132
May 4, 2024 13:53:34.391323090 CEST	443	49743	20.190.151.132	192.168.2.4
May 4, 2024 13:53:34.424822092 CEST	49747	443	192.168.2.4	20.190.151.132
May 4, 2024 13:53:34.424870014 CEST	443	49747	20.190.151.132	192.168.2.4
May 4, 2024 13:53:34.424920082 CEST	49747	443	192.168.2.4	20.190.151.132
May 4, 2024 13:53:34.425185919 CEST	49747	443	192.168.2.4	20.190.151.132
May 4, 2024 13:53:34.425199032 CEST	443	49747	20.190.151.132	192.168.2.4
May 4, 2024 13:53:35.079641104 CEST	443	49747	20.190.151.132	192.168.2.4
May 4, 2024 13:53:35.088536024 CEST	49747	443	192.168.2.4	20.190.151.132
May 4, 2024 13:53:35.088563919 CEST	443	49747	20.190.151.132	192.168.2.4
May 4, 2024 13:53:35.090723038 CEST	49747	443	192.168.2.4	20.190.151.132
May 4, 2024 13:53:35.090728045 CEST	443	49747	20.190.151.132	192.168.2.4
May 4, 2024 13:53:35.090899944 CEST	49747	443	192.168.2.4	20.190.151.132
May 4, 2024 13:53:35.090903044 CEST	443	49747	20.190.151.132	192.168.2.4
May 4, 2024 13:53:37.622200012 CEST	443	49747	20.190.151.132	192.168.2.4
May 4, 2024 13:53:37.622292042 CEST	443	49747	20.190.151.132	192.168.2.4
May 4, 2024 13:53:37.622359037 CEST	49747	443	192.168.2.4	20.190.151.132
May 4, 2024 13:53:38.585244894 CEST	49747	443	192.168.2.4	20.190.151.132
May 4, 2024 13:53:38.585277081 CEST	443	49747	20.190.151.132	192.168.2.4
May 4, 2024 13:53:38.585292101 CEST	49747	443	192.168.2.4	20.190.151.132
May 4, 2024 13:53:38.585298061 CEST	443	49747	20.190.151.132	192.168.2.4
May 4, 2024 13:53:38.619463921 CEST	49748	443	192.168.2.4	20.190.151.132
May 4, 2024 13:53:38.619503021 CEST	443	49748	20.190.151.132	192.168.2.4
May 4, 2024 13:53:38.619555950 CEST	49748	443	192.168.2.4	20.190.151.132
May 4, 2024 13:53:38.619894028 CEST	49748	443	192.168.2.4	20.190.151.132
May 4, 2024 13:53:38.619906902 CEST	443	49748	20.190.151.132	192.168.2.4
May 4, 2024 13:53:39.275243044 CEST	443	49748	20.190.151.132	192.168.2.4
May 4, 2024 13:53:39.277230978 CEST	49748	443	192.168.2.4	20.190.151.132
May 4, 2024 13:53:39.277256012 CEST	443	49748	20.190.151.132	192.168.2.4
May 4, 2024 13:53:39.278275013 CEST	49748	443	192.168.2.4	20.190.151.132
May 4, 2024 13:53:39.278280973 CEST	443	49748	20.190.151.132	192.168.2.4
May 4, 2024 13:53:39.278367043 CEST	49748	443	192.168.2.4	20.190.151.132
May 4, 2024 13:53:39.278372049 CEST	443	49748	20.190.151.132	192.168.2.4
May 4, 2024 13:53:39.772701025 CEST	443	49748	20.190.151.132	192.168.2.4
May 4, 2024 13:53:39.772720098 CEST	443	49748	20.190.151.132	192.168.2.4
May 4, 2024 13:53:39.772772074 CEST	49748	443	192.168.2.4	20.190.151.132
May 4, 2024 13:53:39.772789955 CEST	443	49748	20.190.151.132	192.168.2.4
May 4, 2024 13:53:39.772818089 CEST	443	49748	20.190.151.132	192.168.2.4
May 4, 2024 13:53:39.772861958 CEST	49748	443	192.168.2.4	20.190.151.132
May 4, 2024 13:53:39.773025036 CEST	49748	443	192.168.2.4	20.190.151.132
May 4, 2024 13:53:39.773040056 CEST	443	49748	20.190.151.132	192.168.2.4
May 4, 2024 13:53:39.795248032 CEST	49749	443	192.168.2.4	20.190.151.132
May 4, 2024 13:53:39.795286894 CEST	443	49749	20.190.151.132	192.168.2.4
May 4, 2024 13:53:39.795341015 CEST	49749	443	192.168.2.4	20.190.151.132
May 4, 2024 13:53:39.795586109 CEST	49749	443	192.168.2.4	20.190.151.132
May 4, 2024 13:53:39.795604944 CEST	443	49749	20.190.151.132	192.168.2.4
May 4, 2024 13:53:40.452019930 CEST	443	49749	20.190.151.132	192.168.2.4
May 4, 2024 13:53:40.452455044 CEST	49749	443	192.168.2.4	20.190.151.132
May 4, 2024 13:53:40.452481031 CEST	443	49749	20.190.151.132	192.168.2.4
May 4, 2024 13:53:40.453017950 CEST	49749	443	192.168.2.4	20.190.151.132
May 4, 2024 13:53:40.453025103 CEST	443	49749	20.190.151.132	192.168.2.4
May 4, 2024 13:53:40.453056097 CEST	49749	443	192.168.2.4	20.190.151.132
May 4, 2024 13:53:40.453059912 CEST	443	49749	20.190.151.132	192.168.2.4
May 4, 2024 13:53:42.422665119 CEST	443	49749	20.190.151.132	192.168.2.4
May 4, 2024 13:53:42.422756910 CEST	443	49749	20.190.151.132	192.168.2.4
May 4, 2024 13:53:42.422807932 CEST	49749	443	192.168.2.4	20.190.151.132
May 4, 2024 13:53:42.886332035 CEST	49749	443	192.168.2.4	20.190.151.132
May 4, 2024 13:53:42.886372089 CEST	443	49749	20.190.151.132	192.168.2.4
May 4, 2024 13:53:42.886385918 CEST	49749	443	192.168.2.4	20.190.151.132
May 4, 2024 13:53:42.886392117 CEST	443	49749	20.190.151.132	192.168.2.4
May 4, 2024 13:53:43.172820091 CEST	49750	443	192.168.2.4	20.190.151.132
May 4, 2024 13:53:43.172856092 CEST	443	49750	20.190.151.132	192.168.2.4
May 4, 2024 13:53:43.172909975 CEST	49750	443	192.168.2.4	20.190.151.132
May 4, 2024 13:53:43.174968004 CEST	49750	443	192.168.2.4	20.190.151.132
May 4, 2024 13:53:43.174977064 CEST	443	49750	20.190.151.132	192.168.2.4
May 4, 2024 13:53:43.832845926 CEST	443	49750	20.190.151.132	192.168.2.4
May 4, 2024 13:53:43.833328962 CEST	49750	443	192.168.2.4	20.190.151.132
May 4, 2024 13:53:43.833339930 CEST	443	49750	20.190.151.132	192.168.2.4
May 4, 2024 13:53:43.834073067 CEST	49750	443	192.168.2.4	20.190.151.132
May 4, 2024 13:53:43.834078074 CEST	443	49750	20.190.151.132	192.168.2.4
May 4, 2024 13:53:43.834116936 CEST	49750	443	192.168.2.4	20.190.151.132
May 4, 2024 13:53:43.834124088 CEST	443	49750	20.190.151.132	192.168.2.4
May 4, 2024 13:53:44.295738935 CEST	443	49750	20.190.151.132	192.168.2.4
May 4, 2024 13:53:44.295758963 CEST	443	49750	20.190.151.132	192.168.2.4
May 4, 2024 13:53:44.295810938 CEST	49750	443	192.168.2.4	20.190.151.132
May 4, 2024 13:53:44.295830965 CEST	443	49750	20.190.151.132	192.168.2.4
May 4, 2024 13:53:44.295841932 CEST	443	49750	20.190.151.132	192.168.2.4
May 4, 2024 13:53:44.295914888 CEST	49750	443	192.168.2.4	20.190.151.132
May 4, 2024 13:53:44.296155930 CEST	49750	443	192.168.2.4	20.190.151.132
May 4, 2024 13:53:44.296155930 CEST	49750	443	192.168.2.4	20.190.151.132
May 4, 2024 13:53:44.296175003 CEST	443	49750	20.190.151.132	192.168.2.4
May 4, 2024 13:53:44.296180964 CEST	443	49750	20.190.151.132	192.168.2.4
May 4, 2024 13:54:03.449832916 CEST	49755	443	192.168.2.4	40.127.169.103
May 4, 2024 13:54:03.449862957 CEST	443	49755	40.127.169.103	192.168.2.4
May 4, 2024 13:54:03.449938059 CEST	49755	443	192.168.2.4	40.127.169.103
May 4, 2024 13:54:03.450303078 CEST	49755	443	192.168.2.4	40.127.169.103
May 4, 2024 13:54:03.450316906 CEST	443	49755	40.127.169.103	192.168.2.4
May 4, 2024 13:54:04.302138090 CEST	443	49755	40.127.169.103	192.168.2.4
May 4, 2024 13:54:04.302211046 CEST	49755	443	192.168.2.4	40.127.169.103
May 4, 2024 13:54:05.094479084 CEST	49755	443	192.168.2.4	40.127.169.103
May 4, 2024 13:54:05.094496012 CEST	443	49755	40.127.169.103	192.168.2.4
May 4, 2024 13:54:05.094810963 CEST	443	49755	40.127.169.103	192.168.2.4
May 4, 2024 13:54:05.099050045 CEST	49755	443	192.168.2.4	40.127.169.103
May 4, 2024 13:54:05.140122890 CEST	443	49755	40.127.169.103	192.168.2.4
May 4, 2024 13:54:05.659974098 CEST	443	49755	40.127.169.103	192.168.2.4
May 4, 2024 13:54:05.659996986 CEST	443	49755	40.127.169.103	192.168.2.4
May 4, 2024 13:54:05.660012007 CEST	443	49755	40.127.169.103	192.168.2.4
May 4, 2024 13:54:05.660074949 CEST	49755	443	192.168.2.4	40.127.169.103
May 4, 2024 13:54:05.660088062 CEST	443	49755	40.127.169.103	192.168.2.4
May 4, 2024 13:54:05.660150051 CEST	443	49755	40.127.169.103	192.168.2.4
May 4, 2024 13:54:05.660151005 CEST	49755	443	192.168.2.4	40.127.169.103
May 4, 2024 13:54:05.660190105 CEST	49755	443	192.168.2.4	40.127.169.103
May 4, 2024 13:54:05.689830065 CEST	49755	443	192.168.2.4	40.127.169.103
May 4, 2024 13:54:05.689863920 CEST	443	49755	40.127.169.103	192.168.2.4
May 4, 2024 13:54:05.689897060 CEST	49755	443	192.168.2.4	40.127.169.103
May 4, 2024 13:54:05.689903021 CEST	443	49755	40.127.169.103	192.168.2.4
May 4, 2024 13:54:15.842957973 CEST	49757	443	192.168.2.4	142.250.217.132
May 4, 2024 13:54:15.842995882 CEST	443	49757	142.250.217.132	192.168.2.4
May 4, 2024 13:54:15.843061924 CEST	49757	443	192.168.2.4	142.250.217.132
May 4, 2024 13:54:15.843338966 CEST	49757	443	192.168.2.4	142.250.217.132
May 4, 2024 13:54:15.843354940 CEST	443	49757	142.250.217.132	192.168.2.4
May 4, 2024 13:54:16.153637886 CEST	443	49757	142.250.217.132	192.168.2.4
May 4, 2024 13:54:16.201148033 CEST	49757	443	192.168.2.4	142.250.217.132
May 4, 2024 13:54:17.318048000 CEST	49757	443	192.168.2.4	142.250.217.132
May 4, 2024 13:54:17.318072081 CEST	443	49757	142.250.217.132	192.168.2.4
May 4, 2024 13:54:17.318574905 CEST	443	49757	142.250.217.132	192.168.2.4
May 4, 2024 13:54:17.349355936 CEST	49757	443	192.168.2.4	142.250.217.132
May 4, 2024 13:54:17.349426985 CEST	443	49757	142.250.217.132	192.168.2.4
May 4, 2024 13:54:17.404289007 CEST	49757	443	192.168.2.4	142.250.217.132
May 4, 2024 13:54:18.873224020 CEST	49723	80	192.168.2.4	23.206.229.76
May 4, 2024 13:54:19.024597883 CEST	80	49723	23.206.229.76	192.168.2.4
May 4, 2024 13:54:19.024650097 CEST	49723	80	192.168.2.4	23.206.229.76
May 4, 2024 13:54:26.196012974 CEST	443	49757	142.250.217.132	192.168.2.4
May 4, 2024 13:54:26.196080923 CEST	443	49757	142.250.217.132	192.168.2.4
May 4, 2024 13:54:26.196192026 CEST	49757	443	192.168.2.4	142.250.217.132
May 4, 2024 13:54:26.281270027 CEST	49757	443	192.168.2.4	142.250.217.132
May 4, 2024 13:54:26.281296968 CEST	443	49757	142.250.217.132	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 4, 2024 13:53:11.589695930 CEST	51542	53	192.168.2.4	8.8.8.8
May 4, 2024 13:53:11.590344906 CEST	58322	53	192.168.2.4	1.1.1.1
May 4, 2024 13:53:11.627665043 CEST	53	60786	1.1.1.1	192.168.2.4
May 4, 2024 13:53:11.651282072 CEST	53	60637	1.1.1.1	192.168.2.4
May 4, 2024 13:53:11.740444899 CEST	53	58322	1.1.1.1	192.168.2.4
May 4, 2024 13:53:11.747253895 CEST	53	51542	8.8.8.8	192.168.2.4
May 4, 2024 13:53:13.972687960 CEST	53	52545	1.1.1.1	192.168.2.4
May 4, 2024 13:53:15.780375004 CEST	60779	53	192.168.2.4	1.1.1.1
May 4, 2024 13:53:15.780508041 CEST	56166	53	192.168.2.4	1.1.1.1
May 4, 2024 13:53:15.930543900 CEST	53	60779	1.1.1.1	192.168.2.4
May 4, 2024 13:53:15.931523085 CEST	53	56166	1.1.1.1	192.168.2.4
May 4, 2024 13:53:30.464740038 CEST	138	138	192.168.2.4	192.168.2.255
May 4, 2024 13:53:33.164223909 CEST	53	56322	1.1.1.1	192.168.2.4
May 4, 2024 13:53:52.712666035 CEST	53	55823	1.1.1.1	192.168.2.4
May 4, 2024 13:54:11.214421988 CEST	53	50823	1.1.1.1	192.168.2.4
May 4, 2024 13:54:15.572798967 CEST	53	51344	1.1.1.1	192.168.2.4
May 4, 2024 13:54:40.352781057 CEST	53	51173	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
May 4, 2024 13:53:11.589695930 CEST	192.168.2.4	8.8.8.8	0xeed2	Standard query (0)	google.com	A (IP address)	IN (0x0001)	false
May 4, 2024 13:53:11.590344906 CEST	192.168.2.4	1.1.1.1	0xcd63	Standard query (0)	google.com	A (IP address)	IN (0x0001)	false
May 4, 2024 13:53:15.780375004 CEST	192.168.2.4	1.1.1.1	0xdfd4	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
May 4, 2024 13:53:15.780508041 CEST	192.168.2.4	1.1.1.1	0xdf6	Standard query (0)	www.google.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
May 4, 2024 13:53:11.740444899 CEST	1.1.1.1	192.168.2.4	0xcd63	No error (0)	google.com	142.250.189.14	A (IP address)	IN (0x0001)	false
May 4, 2024 13:53:11.747253895 CEST	8.8.8.8	192.168.2.4	0xeed2	No error (0)	google.com	142.250.68.46	A (IP address)	IN (0x0001)	false
May 4, 2024 13:53:15.930543900 CEST	1.1.1.1	192.168.2.4	0xdfd4	No error (0)	www.google.com	142.250.217.132	A (IP address)	IN (0x0001)	false
May 4, 2024 13:53:15.931523085 CEST	1.1.1.1	192.168.2.4	0xdf6	No error (0)	www.google.com		65	IN (0x0001)	false

HTTP Request Dependency Graph

fs.microsoft.com

slscr.update.microsoft.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49739	23.32.230.129	443

Timestamp	Bytes transferred	Direction	Data
2024-05-04 11:53:18 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-05-04 11:53:18 UTC	509	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (sac/2518) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Content-Length: 55 Cache-Control: public, max-age=155430 Date: Sat, 04 May 2024 11:53:18 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49740	23.32.230.129	443

Timestamp	Bytes transferred	Direction	Data
2024-05-04 11:53:19 UTC	212	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-05-04 11:53:19 UTC	510	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (sac/2518) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-eus2-z1 Content-Length: 55 Cache-Control: public, max-age=155429 Date: Sat, 04 May 2024 11:53:19 GMT Connection: close X-CID: 2
2024-05-04 11:53:19 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
2	192.168.2.4	49738	20.190.151.132	443

Timestamp	Bytes transferred	Direction	Data
2024-05-04 11:53:19 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-05-04 11:53:19 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-05-04 11:53:19 UTC	568	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Sat, 04 May 2024 11:52:19 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C533_BL2 x-ms-request-id: b340a02e-0039-46bb-b7cc-bde052d5e7b9 PPServer: PPV: 30 H: BL02EPF0001D80B V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Sat, 04 May 2024 11:53:18 GMT Connection: close Content-Length: 1276
2024-05-04 11:53:19 UTC	1276	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
3	192.168.2.4	49743	20.190.151.132	443

Timestamp	Bytes transferred	Direction	Data
2024-05-04 11:53:22 UTC	446	OUT	POST /ppsecure/deviceaddcredential.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 7642 Host: login.live.com
2024-05-04 11:53:22 UTC	7642	OUT	Data Raw: 3c 44 65 76 69 63 65 41 64 64 52 65 71 75 65 73 74 3e 3c 43 6c 69 65 6e 74 49 6e 66 6f 20 6e 61 6d 65 3d 22 49 44 43 52 4c 22 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 3e 3c 42 69 6e 61 72 79 56 65 72 73 69 6f 6e 3e 32 34 3c 2f 42 69 6e 61 72 79 56 65 72 73 69 6f 6e 3e 3c 2f 43 6c 69 65 6e 74 49 6e 66 6f 3e 3c 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 3e 3c 4d 65 6d 62 65 72 6e 61 6d 65 3e 30 32 61 79 74 75 7a 67 68 6d 76 71 79 67 67 62 3c 2f 4d 65 6d 62 65 72 6e 61 6d 65 3e 3c 50 61 73 73 77 6f 72 64 3e 33 61 59 34 66 65 53 6c 4a 52 3a 40 69 47 3b 6c 46 4a 5e 4a 3c 2f 50 61 73 73 77 6f 72 64 3e 3c 2f 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 3e 3c 4f 6c 64 4d 65 6d 62 65 72 6e 61 6d 65 3e 30 32 61 6b 71 72 6c 66 67 75 6b 69 6a 65 76 6c 3c 2f 4f 6c 64 4d Data Ascii: <DeviceAddRequest><ClientInfo name="IDCRL" version="1.0"><BinaryVersion>24</BinaryVersion></ClientInfo><Authentication><Membername>02aytuzghmvqyggb</Membername><Password>3aY4feSlJR:@iG;lFJ^J</Password></Authentication><OldMembername>02akqrlfgukijevl</OldM
2024-05-04 11:53:33 UTC	549	IN	HTTP/1.1 400 Bad Request Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: text/xml Expires: Sat, 04 May 2024 11:52:23 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C528_BL2 x-ms-request-id: fcf094de-a9ef-4bc8-89db-b41e4eaf4a55 PPServer: PPV: 30 H: BL02EPF0001D958 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Sat, 04 May 2024 11:53:33 GMT Connection: close Content-Length: 210
2024-05-04 11:53:33 UTC	210	IN	Data Raw: 3c 44 65 76 69 63 65 41 64 64 52 65 73 70 6f 6e 73 65 20 53 75 63 63 65 73 73 3d 22 66 61 6c 73 65 22 3e 3c 45 72 72 6f 72 20 43 6f 64 65 3d 22 64 63 31 31 22 2f 3e 3c 45 72 72 6f 72 53 75 62 63 6f 64 65 3e 30 78 43 46 46 46 45 30 43 39 3c 2f 45 72 72 6f 72 53 75 62 63 6f 64 65 3e 3c 53 65 72 76 65 72 49 6e 66 6f 20 53 65 72 76 65 72 54 69 6d 65 3d 22 32 30 32 34 2d 30 35 2d 30 34 54 31 31 3a 35 33 3a 33 33 5a 22 3e 42 4c 30 32 45 50 46 30 30 30 31 44 39 35 38 20 32 30 32 34 2e 30 34 2e 31 39 2e 31 38 2e 33 31 2e 35 38 3c 2f 53 65 72 76 65 72 49 6e 66 6f 3e 3c 2f 44 65 76 69 63 65 41 64 64 52 65 73 70 6f 6e 73 65 3e 0d 0a Data Ascii: <DeviceAddResponse Success="false"><Error Code="dc11"/><ErrorSubcode>0xCFFFE0C9</ErrorSubcode><ServerInfo ServerTime="2024-05-04T11:53:33Z">BL02EPF0001D958 2024.04.19.18.31.58</ServerInfo></DeviceAddResponse>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49745	40.127.169.103	443

Timestamp	Bytes transferred	Direction	Data
2024-05-04 11:53:24 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=Yt4TMO2HoLLZN1a&MD=ols8++gs HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-05-04 11:53:25 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: d17500c5-63bd-4df8-af02-47a15751d82d MS-RequestId: ba764110-124a-4d73-9f4d-be62036137f9 MS-CV: ow8PgR4AEE22/pSU.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Sat, 04 May 2024 11:53:24 GMT Connection: close Content-Length: 24490
2024-05-04 11:53:25 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-05-04 11:53:25 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port
5	192.168.2.4	49747	20.190.151.132	443

Timestamp	Bytes transferred	Direction	Data
2024-05-04 11:53:35 UTC	445	OUT	POST /ppsecure/deviceaddcredential.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 334 Host: login.live.com
2024-05-04 11:53:35 UTC	334	OUT	Data Raw: 3c 44 65 76 69 63 65 41 64 64 52 65 71 75 65 73 74 3e 3c 43 6c 69 65 6e 74 49 6e 66 6f 20 6e 61 6d 65 3d 22 49 44 43 52 4c 22 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 3e 3c 42 69 6e 61 72 79 56 65 72 73 69 6f 6e 3e 32 34 3c 2f 42 69 6e 61 72 79 56 65 72 73 69 6f 6e 3e 3c 2f 43 6c 69 65 6e 74 49 6e 66 6f 3e 3c 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 3e 3c 4d 65 6d 62 65 72 6e 61 6d 65 3e 30 32 61 79 74 75 7a 67 68 6d 76 71 79 67 67 62 3c 2f 4d 65 6d 62 65 72 6e 61 6d 65 3e 3c 50 61 73 73 77 6f 72 64 3e 33 61 59 34 66 65 53 6c 4a 52 3a 40 69 47 3b 6c 46 4a 5e 4a 3c 2f 50 61 73 73 77 6f 72 64 3e 3c 2f 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 3e 3c 4f 6c 64 4d 65 6d 62 65 72 6e 61 6d 65 3e 30 32 61 6b 71 72 6c 66 67 75 6b 69 6a 65 76 6c 3c 2f 4f 6c 64 4d Data Ascii: <DeviceAddRequest><ClientInfo name="IDCRL" version="1.0"><BinaryVersion>24</BinaryVersion></ClientInfo><Authentication><Membername>02aytuzghmvqyggb</Membername><Password>3aY4feSlJR:@iG;lFJ^J</Password></Authentication><OldMembername>02akqrlfgukijevl</OldM
2024-05-04 11:53:37 UTC	540	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: text/xml Expires: Sat, 04 May 2024 11:52:35 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C532_BL2 x-ms-request-id: 5cd5ed58-9d94-4025-b4b4-58c853243da7 PPServer: PPV: 30 H: BL02EPF0001D8AD V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Sat, 04 May 2024 11:53:36 GMT Connection: close Content-Length: 261
2024-05-04 11:53:37 UTC	261	IN	Data Raw: 3c 44 65 76 69 63 65 41 64 64 52 65 73 70 6f 6e 73 65 20 53 75 63 63 65 73 73 3d 22 74 72 75 65 22 3e 3c 73 75 63 63 65 73 73 3e 74 72 75 65 3c 2f 73 75 63 63 65 73 73 3e 3c 70 75 69 64 3e 30 30 31 38 43 30 30 44 44 34 37 39 35 42 35 37 3c 2f 70 75 69 64 3e 3c 4c 69 63 65 6e 73 65 53 69 67 6e 61 74 75 72 65 4b 65 79 56 65 72 73 69 6f 6e 3e 2d 31 3c 2f 4c 69 63 65 6e 73 65 53 69 67 6e 61 74 75 72 65 4b 65 79 56 65 72 73 69 6f 6e 3e 3c 53 65 72 76 65 72 49 6e 66 6f 20 53 65 72 76 65 72 54 69 6d 65 3d 22 32 30 32 34 2d 30 35 2d 30 34 54 31 31 3a 35 33 3a 33 37 5a 22 3e 42 4c 30 32 45 50 46 30 30 30 31 44 38 41 44 20 32 30 32 34 2e 30 34 2e 31 39 2e 31 38 2e 33 31 2e 35 38 3c 2f 53 65 72 76 65 72 49 6e 66 6f 3e 3c 2f 44 65 76 69 63 65 41 64 64 52 65 73 70 6f Data Ascii: <DeviceAddResponse Success="true"><success>true</success><puid>0018C00DD4795B57</puid><LicenseSignatureKeyVersion>-1</LicenseSignatureKeyVersion><ServerInfo ServerTime="2024-05-04T11:53:37Z">BL02EPF0001D8AD 2024.04.19.18.31.58</ServerInfo></DeviceAddRespo

Session ID	Source IP	Source Port	Destination IP	Destination Port
6	192.168.2.4	49748	20.190.151.132	443

Timestamp	Bytes transferred	Direction	Data
2024-05-04 11:53:39 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 2041 Host: login.live.com
2024-05-04 11:53:39 UTC	2041	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-05-04 11:53:39 UTC	568	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Sat, 04 May 2024 11:52:39 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C532_BL2 x-ms-request-id: d15b0ce7-5307-43da-b558-4d7f79d15299 PPServer: PPV: 30 H: BL02EPF0001D852 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Sat, 04 May 2024 11:53:38 GMT Connection: close Content-Length: 5265
2024-05-04 11:53:39 UTC	5265	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
7	192.168.2.4	49749	20.190.151.132	443

Timestamp	Bytes transferred	Direction	Data
2024-05-04 11:53:40 UTC	445	OUT	POST /ppsecure/deviceaddcredential.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 334 Host: login.live.com
2024-05-04 11:53:40 UTC	334	OUT	Data Raw: 3c 44 65 76 69 63 65 41 64 64 52 65 71 75 65 73 74 3e 3c 43 6c 69 65 6e 74 49 6e 66 6f 20 6e 61 6d 65 3d 22 49 44 43 52 4c 22 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 3e 3c 42 69 6e 61 72 79 56 65 72 73 69 6f 6e 3e 32 34 3c 2f 42 69 6e 61 72 79 56 65 72 73 69 6f 6e 3e 3c 2f 43 6c 69 65 6e 74 49 6e 66 6f 3e 3c 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 3e 3c 4d 65 6d 62 65 72 6e 61 6d 65 3e 30 32 62 62 67 65 71 70 62 64 71 73 72 75 74 76 3c 2f 4d 65 6d 62 65 72 6e 61 6d 65 3e 3c 50 61 73 73 77 6f 72 64 3e 23 53 58 6a 78 67 71 62 2a 73 32 2e 2e 44 75 69 34 47 52 40 3c 2f 50 61 73 73 77 6f 72 64 3e 3c 2f 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 3e 3c 4f 6c 64 4d 65 6d 62 65 72 6e 61 6d 65 3e 30 32 61 71 75 6a 64 6f 6e 70 76 66 75 66 64 6d 3c 2f 4f 6c 64 4d Data Ascii: <DeviceAddRequest><ClientInfo name="IDCRL" version="1.0"><BinaryVersion>24</BinaryVersion></ClientInfo><Authentication><Membername>02bbgeqpbdqsrutv</Membername><Password>#SXjxgqb*s2..Dui4GR@</Password></Authentication><OldMembername>02aqujdonpvfufdm</OldM
2024-05-04 11:53:42 UTC	540	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: text/xml Expires: Sat, 04 May 2024 11:52:40 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C557_BL2 x-ms-request-id: ec046c72-00ba-4f52-829c-d8318fe0c57a PPServer: PPV: 30 H: BL02EPF0001DA25 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Sat, 04 May 2024 11:53:41 GMT Connection: close Content-Length: 261
2024-05-04 11:53:42 UTC	261	IN	Data Raw: 3c 44 65 76 69 63 65 41 64 64 52 65 73 70 6f 6e 73 65 20 53 75 63 63 65 73 73 3d 22 74 72 75 65 22 3e 3c 73 75 63 63 65 73 73 3e 74 72 75 65 3c 2f 73 75 63 63 65 73 73 3e 3c 70 75 69 64 3e 30 30 31 38 30 30 30 46 31 39 31 41 39 45 46 39 3c 2f 70 75 69 64 3e 3c 4c 69 63 65 6e 73 65 53 69 67 6e 61 74 75 72 65 4b 65 79 56 65 72 73 69 6f 6e 3e 2d 31 3c 2f 4c 69 63 65 6e 73 65 53 69 67 6e 61 74 75 72 65 4b 65 79 56 65 72 73 69 6f 6e 3e 3c 53 65 72 76 65 72 49 6e 66 6f 20 53 65 72 76 65 72 54 69 6d 65 3d 22 32 30 32 34 2d 30 35 2d 30 34 54 31 31 3a 35 33 3a 34 32 5a 22 3e 42 4c 30 32 45 50 46 30 30 30 31 44 41 32 35 20 32 30 32 34 2e 30 34 2e 31 39 2e 31 38 2e 33 31 2e 35 38 3c 2f 53 65 72 76 65 72 49 6e 66 6f 3e 3c 2f 44 65 76 69 63 65 41 64 64 52 65 73 70 6f Data Ascii: <DeviceAddResponse Success="true"><success>true</success><puid>0018000F191A9EF9</puid><LicenseSignatureKeyVersion>-1</LicenseSignatureKeyVersion><ServerInfo ServerTime="2024-05-04T11:53:42Z">BL02EPF0001DA25 2024.04.19.18.31.58</ServerInfo></DeviceAddRespo

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.4	49750	20.190.151.132	443

Timestamp	Bytes transferred	Direction	Data
2024-05-04 11:53:43 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3358 Host: login.live.com
2024-05-04 11:53:43 UTC	3358	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-05-04 11:53:44 UTC	568	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Sat, 04 May 2024 11:52:44 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C557_BL2 x-ms-request-id: 8c45cf9d-6415-4e49-9cda-0d83a3d40b89 PPServer: PPV: 30 H: BL02EPF0001D90B V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Sat, 04 May 2024 11:53:43 GMT Connection: close Content-Length: 5285
2024-05-04 11:53:44 UTC	5285	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49755	40.127.169.103	443

Timestamp	Bytes transferred	Direction	Data
2024-05-04 11:54:05 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=Yt4TMO2HoLLZN1a&MD=ols8++gs HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-05-04 11:54:05 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "Mx1RoJH/qEwpWfKllx7sbsl28AuERz5IYdcsvtTJcgM=_2160" MS-CorrelationId: 229da351-78e3-4021-8bd7-6659413c8526 MS-RequestId: 7cda510e-7458-4755-8c7b-be0f5fb15b22 MS-CV: pXAGQemyvUiYPlJH.0 X-Microsoft-SLSClientCache: 2160 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Sat, 04 May 2024 11:54:04 GMT Connection: close Content-Length: 25457
2024-05-04 11:54:05 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 51 22 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 db 8e 00 00 14 00 00 00 00 00 10 00 51 22 00 00 20 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 f3 43 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 0d 92 6f db e5 21 f3 43 43 4b ed 5a 09 38 55 5b df 3f 93 99 90 29 99 e7 29 ec 73 cc 4a 66 32 cf 84 32 64 c8 31 c7 11 52 38 87 90 42 66 09 99 87 32 0f 19 0a 09 51 a6 a8 08 29 53 86 4a 52 84 50 df 46 83 ba dd 7b df fb 7e ef 7d ee 7d bf ef 9e e7 d9 67 ef 35 ee b5 fe eb 3f ff b6 96 81 a2 0a 04 fc 31 40 21 5b 3f a5 ed 1b 04 0e 85 42 a0 10 04 64 12 6c a5 de aa a1 d8 ea f3 58 01 f2 f5 67 0b 5e 9b bd e8 a0 90 1d bf 40 88 9d eb 49 b4 87 9b ab 8b 9d 2b 46 c8 c7 c5 19 92 Data Ascii: MSCFQ"DQ" AdCenvironment.cabo!CCKZ8U[?))sJf22d1R8Bf2Q)SJRPF{~}}g5?1@![?BdlXg^@I+F
2024-05-04 11:54:05 UTC	9633	IN	Data Raw: 21 6f b3 eb a6 cc f5 31 be cf 05 e2 a9 fe fa 57 6d 19 30 b3 c2 c5 66 c9 6a df f5 e7 f0 78 bd c7 a8 9e 25 e3 f9 bc ed 6b 54 57 08 2b 51 82 44 12 fb b9 53 8c cc f4 60 12 8a 76 cc 40 40 41 9b dc 5c 17 ff 5c f9 5e 17 35 98 24 56 4b 74 ef 42 10 c8 af bf 7f c6 7f f2 37 7d 5a 3f 1c f2 99 79 4a 91 52 00 af 38 0f 17 f5 2f 79 81 65 d9 a9 b5 6b e4 c7 ce f6 ca 7a 00 6f 4b 30 44 24 22 3c cf ed 03 a5 96 8f 59 29 bc b6 fd 04 e1 70 9f 32 4a 27 fd 55 af 2f fe b6 e5 8e 33 bb 62 5f 9a db 57 40 e9 f1 ce 99 66 90 8c ff 6a 62 7f dd c5 4a 0b 91 26 e2 39 ec 19 4a 71 63 9d 7b 21 6d c3 9c a3 a2 3c fa 7f 7d 96 6a 90 78 a6 6d d2 e1 9c f9 1d fc 38 d8 94 f4 c6 a5 0a 96 86 a4 bd 9e 1a ae 04 42 83 b8 b5 80 9b 22 38 20 b5 25 e5 64 ec f7 f4 bf 7e 63 59 25 0f 7a 2e 39 57 76 a2 71 aa 06 8a Data Ascii: !o1Wm0fjx%kTW+QDS`v@@A\\^5$VKtB7}Z?yJR8/yekzoK0D$"<Y)p2J'U/3b_W@fjbJ&9Jqc{!m<}jxm8B"8 %d~cY%z.9Wvq

Target ID:	0
Start time:	13:53:04
Start date:	04/05/2024
Path:	C:\Windows\System32\loaddll64.exe
Wow64 process (32bit):	false
Commandline:	loaddll64.exe "C:\Users\user\Desktop\badata_x64.dll.dll"
Imagebase:	0x7ff724360000
File size:	165'888 bytes
MD5 hash:	763455F9DCB24DFEECC2B9D9F8D46D52
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	13:53:04
Start date:	04/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	13:53:04
Start date:	04/05/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd.exe /C rundll32.exe "C:\Users\user\Desktop\badata_x64.dll.dll",#1
Imagebase:	0x7ff625c00000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	13:53:04
Start date:	04/05/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe C:\Users\user\Desktop\badata_x64.dll.dll,Abort
Imagebase:	0x7ff688e10000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	13:53:04
Start date:	04/05/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\badata_x64.dll.dll",#1
Imagebase:	0x7ff688e10000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	13:53:04
Start date:	04/05/2024
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -u -p 6504 -s 528
Imagebase:	0x7ff7103b0000
File size:	570'736 bytes
MD5 hash:	FD27D9F6D02763BDE32511B5DF7FF7A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	13:53:04
Start date:	04/05/2024
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -u -p 6600 -s 536
Imagebase:	0x7ff7103b0000
File size:	570'736 bytes
MD5 hash:	FD27D9F6D02763BDE32511B5DF7FF7A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	13:53:07
Start date:	04/05/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe C:\Users\user\Desktop\badata_x64.dll.dll,AddBurnDevice
Imagebase:	0x7ff688e10000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	13:53:07
Start date:	04/05/2024
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -u -p 5572 -s 528
Imagebase:	0x7ff7103b0000
File size:	570'736 bytes
MD5 hash:	FD27D9F6D02763BDE32511B5DF7FF7A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	13:53:09
Start date:	04/05/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://%3cfnc1%3e(79)/
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	15
Start time:	13:53:10
Start date:	04/05/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2336 --field-trial-handle=2036,i,18134803902397787512,7146960864463359065,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	16
Start time:	13:53:10
Start date:	04/05/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe C:\Users\user\Desktop\badata_x64.dll.dll,AddDir
Imagebase:	0x7ff688e10000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	13:53:11
Start date:	04/05/2024
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -u -p 7512 -s 528
Imagebase:	0x7ff7103b0000
File size:	570'736 bytes
MD5 hash:	FD27D9F6D02763BDE32511B5DF7FF7A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	13:53:13
Start date:	04/05/2024
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -u -p 6244 -s 588
Imagebase:	0x7ff7103b0000
File size:	570'736 bytes
MD5 hash:	FD27D9F6D02763BDE32511B5DF7FF7A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	13:53:15
Start date:	04/05/2024
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -u -p 6600 -s 384
Imagebase:	0x7ff7103b0000
File size:	570'736 bytes
MD5 hash:	FD27D9F6D02763BDE32511B5DF7FF7A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	13:53:23
Start date:	04/05/2024
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -u -p 7512 -s 656
Imagebase:	0x7ff7103b0000
File size:	570'736 bytes
MD5 hash:	FD27D9F6D02763BDE32511B5DF7FF7A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	13:53:26
Start date:	04/05/2024
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -u -p 6504 -s 600
Imagebase:	0x7ff7103b0000
File size:	570'736 bytes
MD5 hash:	FD27D9F6D02763BDE32511B5DF7FF7A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	13:53:30
Start date:	04/05/2024
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -u -p 5572 -s 604
Imagebase:	0x7ff7103b0000
File size:	570'736 bytes
MD5 hash:	FD27D9F6D02763BDE32511B5DF7FF7A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTUser-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=Yt4TMO2HoLLZN1a&MD=ols8++gs HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=Yt4TMO2HoLLZN1a&MD=ols8++gs HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com

Source: global traffic	DNS traffic detected: DNS query: google.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com

Source: unknown	TCP traffic detected without corresponding DNS query: 104.46.162.224
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.151.132
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.151.132
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.151.132
Source: unknown	TCP traffic detected without corresponding DNS query: 23.32.230.129
Source: unknown	TCP traffic detected without corresponding DNS query: 23.32.230.129
Source: unknown	TCP traffic detected without corresponding DNS query: 23.32.230.129
Source: unknown	TCP traffic detected without corresponding DNS query: 23.32.230.129
Source: unknown	TCP traffic detected without corresponding DNS query: 23.32.230.129
Source: unknown	TCP traffic detected without corresponding DNS query: 23.32.230.129
Source: unknown	TCP traffic detected without corresponding DNS query: 23.32.230.129
Source: unknown	TCP traffic detected without corresponding DNS query: 23.32.230.129
Source: unknown	TCP traffic detected without corresponding DNS query: 23.32.230.129
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.151.132
Source: unknown	TCP traffic detected without corresponding DNS query: 23.32.230.129
Source: unknown	TCP traffic detected without corresponding DNS query: 23.32.230.129
Source: unknown	TCP traffic detected without corresponding DNS query: 23.32.230.129
Source: unknown	TCP traffic detected without corresponding DNS query: 23.32.230.129
Source: unknown	TCP traffic detected without corresponding DNS query: 23.32.230.129
Source: unknown	TCP traffic detected without corresponding DNS query: 23.32.230.129
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.151.132
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.151.132
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.151.132
Source: unknown	TCP traffic detected without corresponding DNS query: 23.32.230.129
Source: unknown	TCP traffic detected without corresponding DNS query: 23.32.230.129
Source: unknown	TCP traffic detected without corresponding DNS query: 23.32.230.129
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.151.132
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.151.132
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.151.132
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.151.132
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.151.132
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.151.132
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.151.132
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.151.132
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.151.132
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.151.132
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads (ex: `rundll32.exe {DLLname, DLLfunction}` ).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report badata_x64.dll.dll

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_loaddll64.exe_33699c824f9c2edcea33082e96eb61413f0e629_606702e6_93a04a0f-f5a5-4238-8707-8e68348ea6b1\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_bad_20b35f4e9e7e4ee7dfdaf2f7e2bfa18e82db71be_2631c2b9_7d75c075-c21f-4abb-b272-410a49a270ad\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_bad_20b35f4e9e7e4ee7dfdaf2f7e2bfa18e82db71be_2631c2b9_89437b38-9572-46da-9fa9-bdab69a1f727\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_bad_20b35f4e9e7e4ee7dfdaf2f7e2bfa18e82db71be_2631c2b9_95596a0f-33ed-48ac-9d1b-a100d67c7c53\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_bad_20b35f4e9e7e4ee7dfdaf2f7e2bfa18e82db71be_2631c2b9_fb8576ae-1f92-4593-b2a8-4ec6080766d6\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_bad_31793adb08f1679e480d49537b44d5657e0eb9d_2631c2b9_53cea94a-5e5d-4b98-9d19-9416f69297f1\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_bad_31793adb08f1679e480d49537b44d5657e0eb9d_2631c2b9_95798867-7b70-41f8-99c5-d59a644d3dc3\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_bad_31793adb08f1679e480d49537b44d5657e0eb9d_2631c2b9_ea3eaa38-4707-4dc2-90ab-b2db92566c5c\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_bad_31793adb08f1679e480d49537b44d5657e0eb9d_2631c2b9_ebf9c3e4-6606-465a-a0ee-a6f73001d978\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9AF9.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9B09.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9C04.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9C24.tmp.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9C82.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9CB2.tmp.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERA682.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WERA897.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERA8D6.tmp.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERB400.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WERB4AC.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERB4EC.tmp.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERBE7F.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WERBF0D.tmp.WERInternalMetadata.xml

Windows Analysis Report
badata_x64.dll.dll