Windows Analysis Report
MoneyChatv1.exe

Overview

General Information

Sample name:	MoneyChatv1.exe
Analysis ID:	1442327
MD5:	368b9633a3ccbb209416a111402f8ad5
SHA1:	d0d3956f1fa4f87d95698315ff77b13715ce44de
SHA256:	d7b380e7fced4519fce629d2cec6ef58a2aee2a7e7da65ef3aaa37e3c0b163fc
Tags:	BlankGrabberexe
Infos:

Detection

Blank Grabber

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Found malware configuration

Sigma detected: Capture Wi-Fi password

Yara detected Blank Grabber

Yara detected Telegram RAT

Adds a directory exclusion to Windows Defender

Bypasses PowerShell execution policy

Encrypted powershell cmdline option found

Found many strings related to Crypto-Wallets (likely being stolen)

Loading BitLocker PowerShell Module

Machine Learning detection for sample

Modifies Windows Defender protection settings

Modifies existing user documents (likely ransomware behavior)

Modifies the hosts file

Potential dropper URLs found in powershell memory

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Removes signatures from Windows Defender

Sigma detected: Dot net compiler compiles file from suspicious location

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Sigma detected: Powershell Defender Disable Scan Feature

Sigma detected: Rar Usage with Password and Compression Level

Sigma detected: Rare Remote Thread Creation By Uncommon Source Image

Sigma detected: Suspicious Encoded PowerShell Command Line

Sigma detected: Suspicious PowerShell Encoded Command Patterns

Sigma detected: Suspicious Startup Folder Persistence

Suspicious powershell command line found

Tries to harvest and steal WLAN passwords

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Uses cmd line tools excessively to alter registry or file data

Uses netsh to modify the Windows network and firewall settings

Very long command line found

Writes or reads registry keys via WMI

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Compiles C# or VB.Net code

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality to shutdown / reboot the system

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a start menu entry (Start Menu\Programs\Startup)

Creates a window with clipboard capturing capabilities

Detected potential crypto function

Drops PE files

Enables debug privileges

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found evasive API chain checking for process token information

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

PE / OLE file has an invalid certificate

PE file contains an invalid checksum

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Change PowerShell Policies to an Insecure Level

Sigma detected: Dynamic .NET Compilation Via Csc.EXE

Sigma detected: PowerShell Get-Clipboard Cmdlet Via CLI

Sigma detected: Powershell Defender Exclusion

Sigma detected: SCR File Write Event

Sigma detected: Startup Folder File Write

Sigma detected: Suspicious Execution of Powershell with Base64

Sigma detected: Suspicious Screensaver Binary File Creation

Stores files to the Windows start menu directory

Too many similar processes found

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Uses reg.exe to modify the Windows registry

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Yara detected Credential Stealer

Classification

Signatures

AV Detection

Antivirus / Scanner detection for submitted sample

Source: MoneyChatv1.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://pesterbdd.com/images/Pester.png

URL Reputation: Label: malware

Found malware configuration

Source: MoneyChatv1.exe.6832.1.memstrmin

Malware Configuration Extractor: Blank Grabber {"C2 url": "https://discord.com/api/webhooks/1240380657666887700/TnMjALQrWBxb3bTdzbRJ91Rss2Poryr8-psQe2X-8dMlc0OpBQe43uFEdbnzOA4LZ5Gk"}

Machine Learning detection for sample

Source: MoneyChatv1.exe

Joe Sandbox ML: detected

Uses Microsoft's Enhanced Cryptographic Provider

Source: C:\Users\user\AppData\Local\Temp\_MEI68002\rar.exe

Code function: 80_2_00007FF7E2F4901C CryptAcquireContextW,CryptGenRandom,CryptReleaseContext,

80_2_00007FF7E2F4901C

Source: MoneyChatv1.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source:	Binary string: D:\a\1\b\bin\amd64\python312.pdb source: MoneyChatv1.exe, 00000001.00000002.1980337100.00007FFDFB5D4000.00000040.00000001.01000000.00000004.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\unicodedata.pdb source: MoneyChatv1.exe, 00000001.00000002.1978939505.00007FFDFAC8F000.00000040.00000001.01000000.00000013.sdmp
Source:	Binary string: D:\a\1\b\libcrypto-3.pdb\| source: MoneyChatv1.exe, 00000001.00000002.1979324107.00007FFDFB0E1000.00000040.00000001.01000000.0000000F.sdmp
Source:	Binary string: D:\a\1\b\libssl-3.pdbDD source: MoneyChatv1.exe, 00000001.00000002.1981410670.00007FFE00424000.00000040.00000001.01000000.00000010.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: MoneyChatv1.exe, 00000000.00000003.1620893036.000001D726AE4000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000001.00000002.1983187955.00007FFE148E3000.00000002.00000001.01000000.00000005.sdmp, VCRUNTIME140.dll.0.dr
Source:	Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG" source: MoneyChatv1.exe, 00000001.00000002.1979324107.00007FFDFB049000.00000040.00000001.01000000.0000000F.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdbGCTL source: MoneyChatv1.exe, 00000000.00000003.1620893036.000001D726AE4000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000001.00000002.1983187955.00007FFE148E3000.00000002.00000001.01000000.00000005.sdmp, VCRUNTIME140.dll.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\sqlite3.pdb source: MoneyChatv1.exe, MoneyChatv1.exe, 00000001.00000002.1981141658.00007FFDFF191000.00000040.00000001.01000000.0000000B.sdmp
Source:	Binary string: D:\a\1\b\libcrypto-3.pdb source: MoneyChatv1.exe, MoneyChatv1.exe, 00000001.00000002.1979324107.00007FFDFB0E1000.00000040.00000001.01000000.0000000F.sdmp
Source:	Binary string: D:\Projects\WinRAR\rar\build\rar64\Release\RAR.pdb source: rar.exe, 00000050.00000000.1842949064.00007FF7E2FA0000.00000002.00000001.01000000.0000001A.sdmp, rar.exe, 00000050.00000002.1863882737.00007FF7E2FA0000.00000002.00000001.01000000.0000001A.sdmp, rar.exe.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\select.pdb source: MoneyChatv1.exe, 00000001.00000002.1983436926.00007FFE1A451000.00000040.00000001.01000000.0000000D.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_ctypes.pdb source: MoneyChatv1.exe, MoneyChatv1.exe, 00000001.00000002.1982410523.00007FFE13321000.00000040.00000001.01000000.00000006.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_hashlib.pdb source: MoneyChatv1.exe, MoneyChatv1.exe, 00000001.00000002.1982588166.00007FFE13381000.00000040.00000001.01000000.00000011.sdmp
Source:	Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WA source: MoneyChatv1.exe
Source:	Binary string: D:\a\1\b\bin\amd64\_lzma.pdbNN source: MoneyChatv1.exe, 00000001.00000002.1982068259.00007FFE1323C000.00000040.00000001.01000000.00000008.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_queue.pdb source: MoneyChatv1.exe, MoneyChatv1.exe, 00000001.00000002.1982272090.00007FFE13311000.00000040.00000001.01000000.00000012.sdmp
Source:	Binary string: 7C:\Users\user\AppData\Local\Temp\5yc1e5ua\5yc1e5ua.pdb source: powershell.exe, 00000028.00000002.1756287966.000001CA20175000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_lzma.pdb source: MoneyChatv1.exe, 00000001.00000002.1982068259.00007FFE1323C000.00000040.00000001.01000000.00000008.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_bz2.pdb source: MoneyChatv1.exe, MoneyChatv1.exe, 00000001.00000002.1982980769.00007FFE148B1000.00000040.00000001.01000000.00000009.sdmp
Source:	Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG"OpenSSL 3.0.13 30 Jan 20243.0.13built on: Mon Feb 5 17:39:09 2024 UTCplatform: VC-WIN64A-masmOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-3"MODULESDIR: "C:\Program Files\OpenSSL\lib\ossl-modules"CPUINFO: N/Anot availableget_and_lock..\s\crypto\ex_data.cossl_crypto_get_ex_new_index_exossl_crypto_new_ex_data_exCRYPTO_dup_ex_dataCRYPTO_set_ex_dataOPENSSL_WIN32_UTF8..\s\crypto\getenv.ccompiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG";CPUINFO: OPENSSL_ia32cap=0x%llx:0x%llxOPENSSL_ia32cap env:%sos-specificC:\Program Files\Common Files\SSLC:\Program Files\OpenSSL\lib\ossl-modules.dllCPUINFO: ..\s\crypto\init.cOPENSSL_init_cryptoOPENSSL_atexit..\s\crypto\initthread.c..\s\crypto\mem_sec.cassertion failed: (bit & 1) == 0assertion failed: list >= 0 && list < sh.freelist_sizeassertion failed: ((ptr - sh.arena) & ((sh.arena_size >> list) - 1)) == 0assertion failed: bit > 0 && bit < sh.bittable_sizeassertion failed: TESTBIT(table, bit)assertion failed: !TESTBIT(table, bit)assertion failed: WITHIN_FREELIST(list)assertion failed: WITHIN_ARENA(ptr)assertion failed: temp->next == NULL \|\| WITHIN_ARENA(temp->next)assertion failed: (char *)temp->next->p_next == listassertion failed: WITHIN_FREELIST(temp2->p_next) \|\| WITHIN_ARENA(temp2->p_next)assertion failed: size > 0assertion failed: (size & (size - 1)) == 0assertion failed: (minsize & (minsize - 1)) == 0assertion failed: sh.freelist != NULLassertion failed: sh.bittable != NULLassertion failed: sh.bitmalloc != NULLassertion failed: !sh_testbit(temp, slist, sh.bitmalloc)assertion failed: temp != sh.freelist[slist]assertion failed: sh.freelist[slist] == tempassertion failed: temp-(sh.arena_size >> slist) == sh_find_my_buddy(temp, slist)assertion failed: sh_testbit(chunk, list, sh.bittable)assertion failed: WITHIN_ARENA(chunk)assertion failed: sh_testbit(ptr, list, sh.bittable)assertion failed: ptr == sh_find_my_buddy(buddy, list)assertion failed: ptr != NULLassertion failed: !sh_testbit(ptr, list, sh.bitmalloc)assertion failed: sh.freelist[list] == ptr/0123456789ABCDEFCRYPTO_memdup..\s\crypto\o_str.chexstr2buf_sepossl_hexstr2buf_sepbuf2hexstr_sepossl_buf2hexstr_sep..\s\crypto\packet.cwpacket_intern_init_lenWPACKET_start_sub_packet_len__..\s\crypto\param_build.cparam_pushparam_push_numOSSL_PARAM_BLD_push_BN_padNegative big numbers are unsupported for OSSL_PARAMOSSL_PARAM_BLD_push_utf8_stringOSSL_PARAM_BLD_push_utf8_ptrOSSL_PARAM_BLD_push_octet_stringOSSL_PARAM_BLD_
Source:	Binary string: D:\a\1\b\bin\amd64\_socket.pdb source: MoneyChatv1.exe, MoneyChatv1.exe, 00000001.00000002.1982774175.00007FFE14631000.00000040.00000001.01000000.0000000C.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_sqlite3.pdb source: MoneyChatv1.exe, MoneyChatv1.exe, 00000001.00000002.1981898522.00007FFE126D1000.00000040.00000001.01000000.0000000A.sdmp
Source:	Binary string: D:\a\1\b\libssl-3.pdb source: MoneyChatv1.exe, MoneyChatv1.exe, 00000001.00000002.1981410670.00007FFE00424000.00000040.00000001.01000000.00000010.sdmp
Source:	Binary string: 7C:\Users\user\AppData\Local\Temp\5yc1e5ua\5yc1e5ua.pdbhP source: powershell.exe, 00000028.00000002.1756287966.000001CA20175000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_ssl.pdb source: MoneyChatv1.exe, MoneyChatv1.exe, 00000001.00000002.1981699976.00007FFE11511000.00000040.00000001.01000000.0000000E.sdmp

Source: C:\Users\user\Desktop\MoneyChatv1.exe	Code function: 0_2_00007FF7ADE68670 _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,	0_2_00007FF7ADE68670
Source: C:\Users\user\Desktop\MoneyChatv1.exe	Code function: 0_2_00007FF7ADE58D00 FindFirstFileExW,FindClose,	0_2_00007FF7ADE58D00
Source: C:\Users\user\Desktop\MoneyChatv1.exe	Code function: 0_2_00007FF7ADE726C4 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	0_2_00007FF7ADE726C4
Source: C:\Users\user\Desktop\MoneyChatv1.exe	Code function: 0_2_00007FF7ADE68670 _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,	0_2_00007FF7ADE68670
Source: C:\Users\user\AppData\Local\Temp\_MEI68002\rar.exe	Code function: 80_2_00007FF7E2F546EC FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,	80_2_00007FF7E2F546EC
Source: C:\Users\user\AppData\Local\Temp\_MEI68002\rar.exe	Code function: 80_2_00007FF7E2F4E21C FindFirstFileW,FindClose,CreateFileW,DeviceIoControl,CloseHandle,	80_2_00007FF7E2F4E21C
Source: C:\Users\user\AppData\Local\Temp\_MEI68002\rar.exe	Code function: 80_2_00007FF7E2F988E0 FindFirstFileExA,	80_2_00007FF7E2F988E0

Source: C:\Users\user\Desktop\MoneyChatv1.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\js\	Jump to behavior
Source: C:\Users\user\Desktop\MoneyChatv1.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\	Jump to behavior
Source: C:\Users\user\Desktop\MoneyChatv1.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\	Jump to behavior
Source: C:\Users\user\Desktop\MoneyChatv1.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\	Jump to behavior
Source: C:\Users\user\Desktop\MoneyChatv1.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\	Jump to behavior
Source: C:\Users\user\Desktop\MoneyChatv1.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\	Jump to behavior

Networking

Potential dropper URLs found in powershell memory

Source: powershell.exe, 00000028.00000002.1829495060.000001CA381A7000.00000004.00000020.00020000.00000000.sdmp

String found in memory: ifdapp1xmpexifunknownsubinteropgpsapp0app13iptcirb8bimiptc8bimResInfo8bimiptcdigestthumbtEXtxmpstructxmpbagxmpseqxmpaltlogscrdescimgdescgrctlextappextcommentextcomchrominanceluminancegAMAbKGDiTXtcHRMhISTiCCPsRGBtIMEddsInfoheifPropsheifHDRANIMANMFbmppngicocurjpgtiffgifwmphotoddsadngheifwebprdfhttp://www.w3.org/1999/02/22-rdf-syntax-ns#dchttp://purl.org/dc/elements/1.1/xmphttp://ns.adobe.com/xap/1.0/xmpidqhttp://ns.adobe.com/xmp/Identifier/qual/1.0/xmpRightshttp://ns.adobe.com/xap/1.0/rights/xmpMMhttp://ns.adobe.com/xap/1.0/mm/xmpBJhttp://ns.adobe.com/xap/1.0/bj/xmpTPghttp://ns.adobe.com/xap/1.0/t/pg/pdfhttp://ns.adobe.com/pdf/1.3/photoshophttp://ns.adobe.com/photoshop/1.0/tiffhttp://ns.adobe.com/tiff/1.0/exifhttp://ns.adobe.com/exif/1.0/stDimhttp://ns.adobe.com/xap/1.0/sType/Dimensions#xapGImghttp://ns.adobe.com/xap/1.0/g/img/stEvthttp://ns.adobe.com/xap/1.0/sType/ResourceEvent#stRefhttp://ns.adobe.com/xap/1.0/sType/ResourceRef#stVerhttp://ns.adobe.com/xap/1.0/sType/Version#stJobhttp://ns.adobe.com/xap/1.0/sType/Job#auxhttp://ns.adobe.com/exif/1.0/aux/crshttp://ns.adobe.com/camera-raw-settings/1.0/xmpDMhttp://ns.adobe.com/xmp/1.0/DynamicMedia/Iptc4xmpCorehttp://iptc.org/std/Iptc4xmpCore/1.0/xmlns/MicrosoftPhotohttp://ns.microsoft.com/photo/1.0/MPhttp://ns.microsoft.com/photo/1.2/MPRIhttp://ns.microsoft.com/photo/1.2/t/RegionInfo#MPReghttp://ns.microsoft.com/photo/1.2/t/Region#rdfhttp://www.w3.org/1999/02/22-rdf-syntax-ns#dchttp://purl.org/dc/elements/1.1/xmphttp://ns.adobe.com/xap/1.0/xmpidqhttp://ns.adobe.com/xmp/Identifier/qual/1.0/xmpRightshttp://ns.adobe.com/xap/1.0/rights/xmpMMhttp://ns.adobe.com/xap/1.0/mm/xmpBJhttp://ns.adobe.com/xap/1.0/bj/xmpTPghttp://ns.adobe.com/xap/1.0/t/pg/pdfhttp://ns.adobe.com/pdf/1.3/photoshophttp://ns.adobe.com/photoshop/1.0/tiffhttp://ns.adobe.com/tiff/1.0/exifhttp://ns.adobe.com/exif/1.0/rrrstDimhttp://ns.adobe.com/xap/1.0/sType/Dimensions#xapGImghttp://ns.adobe.com/xap/1.0/g/img/stEvthttp://ns.adobe.com/xap/1.0/sType/ResourceEvent#stRefhttp://ns.adobe.com/xap/1.0/sType/ResourceRef#stVerhttp://ns.adobe.com/xap/1.0/sType/Version#stJobhttp://ns.adobe.com/xap/1.0/sType/Job#auxhttp://ns.adobe.com/exif/1.0/aux/crshttp://ns.adobe.com/camera-raw-settings/1.0/xmpDMhttp://ns.adobe.com/xmp/1.0/DynamicMedia/Iptc4xmpCorehttp://iptc.org/std/Iptc4xmpCore/1.0/xmlns/MicrosoftPhotohttp://ns.microsoft.com/photo/1.0/MPhttp://ns.microsoft.com/photo/1.2/MPRIhttp://ns.microsoft.com/photo/1.2/t/RegionInfo#MPReghttp://ns.microsoft.com/photo/1.2/t/Region#G

IP address seen in connection with other malware

Source: Joe Sandbox View	IP Address: 208.95.112.1 208.95.112.1
Source: Joe Sandbox View	IP Address: 162.159.138.232 162.159.138.232

Internet Provider seen in connection with other malware

Source: Joe Sandbox View

ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

May check the online IP address of the machine

Source: unknown

DNS query: name: ip-api.com

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET /json/?fields=225545 HTTP/1.1Host: ip-api.comAccept-Encoding: identityUser-Agent: python-urllib3/2.2.1

Source: MoneyChatv1.exe, 00000001.00000002.1976777089.000001B7ED97C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: `https://www.facebook.com/ equals www.facebook.com (Facebook)
Source: MoneyChatv1.exe, 00000001.00000002.1976777089.000001B7ED97C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: `https://www.youtube.com/ equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: ip-api.com
Source: global traffic	DNS traffic detected: DNS query: discord.com

Source: unknown

HTTP traffic detected: POST /api/webhooks/1240380657666887700/TnMjALQrWBxb3bTdzbRJ91Rss2Poryr8-psQe2X-8dMlc0OpBQe43uFEdbnzOA4LZ5Gk HTTP/1.1Host: discord.comAccept-Encoding: identityContent-Length: 763053User-Agent: python-urllib3/2.2.1Content-Type: multipart/form-data; boundary=09aea10d5a71499786c42730b1440dc1

Source: MoneyChatv1.exe, 00000000.00000003.1622959812.000001D726AF3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digi
Source: MoneyChatv1.exe, 00000000.00000003.1622959812.000001D726AF3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digi/0
Source: MoneyChatv1.exe, 00000000.00000003.1624228652.000001D726AE6000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1623235396.000001D726AE6000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1983916180.000001D726AF3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.co
Source: MoneyChatv1.exe, 00000000.00000003.1624228652.000001D726AE6000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1623235396.000001D726AE6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.co/0
Source: MoneyChatv1.exe, 00000000.00000003.1624228652.000001D726AE6000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1623235396.000001D726AE6000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1621762722.000001D726AE4000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1621695445.000001D726AF0000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1622599367.000001D726AE6000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1621837390.000001D726AE5000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1621152121.000001D726AE4000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1621916177.000001D726AE5000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1623941850.000001D726AF3000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1621599467.000001D726AE4000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1621262390.000001D726AE4000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1623941850.000001D726AE6000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1621077123.000001D726AE4000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1621695445.000001D726AE4000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1624030064.000001D726AE6000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1621005623.000001D726AE4000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1623041828.000001D726AE6000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1622959812.000001D726AE6000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1983916180.000001D726AF3000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: MoneyChatv1.exe, 00000000.00000003.1624228652.000001D726AE6000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1623235396.000001D726AE6000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1621762722.000001D726AE4000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1622599367.000001D726AE6000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1621837390.000001D726AE5000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1621152121.000001D726AE4000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1621916177.000001D726AE5000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1621599467.000001D726AE4000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1621262390.000001D726AE4000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1623941850.000001D726AE6000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1621077123.000001D726AE4000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1621695445.000001D726AE4000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1624030064.000001D726AE6000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1621005623.000001D726AE4000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1623041828.000001D726AE6000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1622959812.000001D726AE6000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr, libffi-8.dll.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: MoneyChatv1.exe, 00000000.00000003.1624228652.000001D726AE6000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1623235396.000001D726AE6000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1621762722.000001D726AE4000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1622599367.000001D726AE6000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1621837390.000001D726AE5000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1621152121.000001D726AE4000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1621916177.000001D726AE5000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1621599467.000001D726AE4000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1621262390.000001D726AE4000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1623941850.000001D726AE6000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1621077123.000001D726AE4000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1621695445.000001D726AE4000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1624030064.000001D726AE6000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1621005623.000001D726AE4000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1623041828.000001D726AE6000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1622959812.000001D726AE6000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr, libffi-8.dll.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: MoneyChatv1.exe, 00000000.00000003.1624228652.000001D726AE6000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1622959812.000001D726AF3000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1623235396.000001D726AE6000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1621762722.000001D726AE4000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1621695445.000001D726AF0000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1622599367.000001D726AE6000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1621837390.000001D726AE5000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1621152121.000001D726AE4000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1621916177.000001D726AE5000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1623941850.000001D726AF3000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1621599467.000001D726AE4000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1621262390.000001D726AE4000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1623941850.000001D726AE6000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1621077123.000001D726AE4000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1621695445.000001D726AE4000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1624030064.000001D726AE6000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1621005623.000001D726AE4000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1623041828.000001D726AE6000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1622959812.000001D726AE6000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1983916180.000001D726AF3000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: MoneyChatv1.exe, rar.exe.0.dr	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: MoneyChatv1.exe, 00000001.00000003.1653668199.000001B7ECB32000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000001.00000003.1680974003.000001B7ECB39000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000001.00000003.1653668199.000001B7ECC18000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000001.00000002.1975607128.000001B7ECE47000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000001.00000002.1974012792.000001B7ECB39000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000001.00000003.1680974003.000001B7ECBEA000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000001.00000003.1658914202.000001B7ECC1B000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000001.00000003.1691193325.000001B7ECE48000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000001.00000002.1974012792.000001B7ECA30000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000001.00000003.1655984083.000001B7ECC19000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000001.00000003.1653465925.000001B7ECE41000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.1889723358.00000185BC3D1000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000028.00000002.1826181767.000001CA37F84000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: powershell.exe, 00000009.00000002.1897179573.00000185BC780000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.mic
Source: powershell.exe, 00000009.00000002.1897179573.00000185BC780000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.micft.cMicRosof
Source: powershell.exe, 00000009.00000002.1895224283.00000185BC590000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.micros
Source: powershell.exe, 00000028.00000002.1827926988.000001CA38018000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.mx
Source: MoneyChatv1.exe	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningCAEVR36.crl0
Source: MoneyChatv1.exe	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0
Source: MoneyChatv1.exe, 00000000.00000003.1623690646.000001D726AE6000.00000004.00000020.00020000.00000000.sdmp, rar.exe.0.dr	String found in binary or memory: http://crl.sectigo.com/SectigoRSACodeSigningCA.crl0s
Source: MoneyChatv1.exe, 00000000.00000003.1623690646.000001D726AE6000.00000004.00000020.00020000.00000000.sdmp, rar.exe.0.dr	String found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: MoneyChatv1.exe, 00000000.00000003.1624228652.000001D726AE6000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1622959812.000001D726AF3000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1623235396.000001D726AE6000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1621762722.000001D726AE4000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1621695445.000001D726AF0000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1622599367.000001D726AE6000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1621837390.000001D726AE5000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1621152121.000001D726AE4000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1621916177.000001D726AE5000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1623941850.000001D726AF3000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1621599467.000001D726AE4000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1621262390.000001D726AE4000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1623941850.000001D726AE6000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1621077123.000001D726AE4000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1621695445.000001D726AE4000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1624030064.000001D726AE6000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1621005623.000001D726AE4000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1623041828.000001D726AE6000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1622959812.000001D726AE6000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1983916180.000001D726AF3000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: MoneyChatv1.exe, 00000000.00000003.1624228652.000001D726AE6000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1623235396.000001D726AE6000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1621762722.000001D726AE4000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1622599367.000001D726AE6000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1621837390.000001D726AE5000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1621152121.000001D726AE4000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1621916177.000001D726AE5000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1621599467.000001D726AE4000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1621262390.000001D726AE4000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1623941850.000001D726AE6000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1621077123.000001D726AE4000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1621695445.000001D726AE4000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1624030064.000001D726AE6000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1621005623.000001D726AE4000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1623041828.000001D726AE6000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1622959812.000001D726AE6000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1983916180.000001D726AF3000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr, libffi-8.dll.0.dr, _socket.pyd.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: MoneyChatv1.exe, 00000000.00000003.1624228652.000001D726AE6000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1623235396.000001D726AE6000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1621762722.000001D726AE4000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1622599367.000001D726AE6000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1621837390.000001D726AE5000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1621152121.000001D726AE4000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1621916177.000001D726AE5000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1621599467.000001D726AE4000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1621262390.000001D726AE4000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1623941850.000001D726AE6000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1621077123.000001D726AE4000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1621695445.000001D726AE4000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1624030064.000001D726AE6000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1621005623.000001D726AE4000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1623041828.000001D726AE6000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1622959812.000001D726AE6000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr, libffi-8.dll.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: _sqlite3.pyd.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: MoneyChatv1.exe, 00000000.00000003.1624228652.000001D726AE6000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1623235396.000001D726AE6000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1621762722.000001D726AE4000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1622599367.000001D726AE6000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1621837390.000001D726AE5000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1621152121.000001D726AE4000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1621916177.000001D726AE5000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1621599467.000001D726AE4000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1621262390.000001D726AE4000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1623941850.000001D726AE6000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1621077123.000001D726AE4000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1621695445.000001D726AE4000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1624030064.000001D726AE6000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1621005623.000001D726AE4000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1623041828.000001D726AE6000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1622959812.000001D726AE6000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1983916180.000001D726AF3000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr, libffi-8.dll.0.dr, _socket.pyd.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: MoneyChatv1.exe	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningCAEVR36.crt0#
Source: MoneyChatv1.exe	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#
Source: MoneyChatv1.exe, 00000000.00000003.1623690646.000001D726AE6000.00000004.00000020.00020000.00000000.sdmp, rar.exe.0.dr	String found in binary or memory: http://crt.sectigo.com/SectigoRSACodeSigningCA.crt0#
Source: MoneyChatv1.exe, 00000001.00000002.1973208910.000001B7EC630000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000001.00000002.1972659607.000001B7EC26C000.00000004.00001000.00020000.00000000.sdmp, MoneyChatv1.exe, 00000001.00000003.1634283643.000001B7EC3A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://csrc.nist.gov/publications/nistpubs/800-38a/sp800-38a.pdf);
Source: MoneyChatv1.exe, 00000001.00000002.1975607128.000001B7ECE47000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000001.00000003.1691193325.000001B7ECE48000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000001.00000003.1653465925.000001B7ECE41000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://google.com/
Source: MoneyChatv1.exe, 00000001.00000002.1973023233.000001B7EC2F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://google.com/mail/
Source: MoneyChatv1.exe, 00000001.00000002.1975607128.000001B7ECE70000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000001.00000003.1971420809.000001B7ECE79000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000001.00000003.1971783291.000001B7ECE6F000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000001.00000003.1691193325.000001B7ECE48000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000001.00000002.1975694125.000001B7ECE7C000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000001.00000003.1653465925.000001B7ECE41000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://hg.python.org/cpython/file/603b4d593758/Lib/socket.py#l535
Source: MoneyChatv1.exe, 00000001.00000002.1973878570.000001B7EC930000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com/json/?fields=225545
Source: MoneyChatv1.exe, 00000001.00000003.1634249753.000001B7EC7E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com/json/?fields=225545r
Source: MoneyChatv1.exe, 00000001.00000002.1973878570.000001B7EC930000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com/line/?fields=hosting
Source: MoneyChatv1.exe, 00000001.00000003.1634249753.000001B7EC7E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com/line/?fields=hostingrz
Source: MoneyChatv1.exe, 00000001.00000003.1634249753.000001B7EC7E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com/line/?fields=hostingrzr
Source: powershell.exe, 00000028.00000002.1829495060.000001CA381A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ns.a.0/sTy
Source: powershell.exe, 00000028.00000002.1829495060.000001CA381A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ns.adobe.hotosh
Source: powershell.exe, 00000009.00000002.1875538931.00000185B3FE3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000028.00000002.1816304387.000001CA2FE6A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000028.00000002.1816304387.000001CA2FFAD000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000028.00000002.1756287966.000001CA2175B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: MoneyChatv1.exe, rar.exe.0.dr	String found in binary or memory: http://ocsp.comodoca.com0
Source: MoneyChatv1.exe, 00000000.00000003.1624228652.000001D726AE6000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1623235396.000001D726AE6000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1621762722.000001D726AE4000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1622599367.000001D726AE6000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1621837390.000001D726AE5000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1621152121.000001D726AE4000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1621916177.000001D726AE5000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1621599467.000001D726AE4000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1621262390.000001D726AE4000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1623941850.000001D726AE6000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1621077123.000001D726AE4000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1621695445.000001D726AE4000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1624030064.000001D726AE6000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1621005623.000001D726AE4000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1623041828.000001D726AE6000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1622959812.000001D726AE6000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1983916180.000001D726AF3000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr, libffi-8.dll.0.dr, _socket.pyd.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: MoneyChatv1.exe, 00000000.00000003.1624228652.000001D726AE6000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1622959812.000001D726AF3000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1623235396.000001D726AE6000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1621762722.000001D726AE4000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1621695445.000001D726AF0000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1622599367.000001D726AE6000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1621837390.000001D726AE5000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1621152121.000001D726AE4000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1621916177.000001D726AE5000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1623941850.000001D726AF3000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1621599467.000001D726AE4000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1621262390.000001D726AE4000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1623941850.000001D726AE6000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1621077123.000001D726AE4000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1621695445.000001D726AE4000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1624030064.000001D726AE6000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1621005623.000001D726AE4000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1623041828.000001D726AE6000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1622959812.000001D726AE6000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1983916180.000001D726AF3000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: MoneyChatv1.exe, 00000000.00000003.1624228652.000001D726AE6000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1622959812.000001D726AF3000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1623235396.000001D726AE6000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1621762722.000001D726AE4000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1621695445.000001D726AF0000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1622599367.000001D726AE6000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1621837390.000001D726AE5000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1621152121.000001D726AE4000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1621916177.000001D726AE5000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1623941850.000001D726AF3000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1621599467.000001D726AE4000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1621262390.000001D726AE4000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1623941850.000001D726AE6000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1621077123.000001D726AE4000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1621695445.000001D726AE4000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1624030064.000001D726AE6000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1621005623.000001D726AE4000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1623041828.000001D726AE6000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1622959812.000001D726AE6000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1983916180.000001D726AF3000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: MoneyChatv1.exe, 00000000.00000003.1624228652.000001D726AE6000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1623235396.000001D726AE6000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1621762722.000001D726AE4000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1622599367.000001D726AE6000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1621837390.000001D726AE5000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1621152121.000001D726AE4000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1621916177.000001D726AE5000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1621599467.000001D726AE4000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1621262390.000001D726AE4000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1623941850.000001D726AE6000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1621077123.000001D726AE4000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1621695445.000001D726AE4000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1624030064.000001D726AE6000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1621005623.000001D726AE4000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1623041828.000001D726AE6000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1622959812.000001D726AE6000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr, libffi-8.dll.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: MoneyChatv1.exe, rar.exe.0.dr	String found in binary or memory: http://ocsp.sectigo.com0
Source: MoneyChatv1.exe	String found in binary or memory: http://ocsp.sectigo.com0$
Source: MoneyChatv1.exe, 00000000.00000003.1623690646.000001D726AE6000.00000004.00000020.00020000.00000000.sdmp, rar.exe.0.dr	String found in binary or memory: http://ocsp.thawte.com0
Source: powershell.exe, 00000028.00000002.1756287966.000001CA216D5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000028.00000002.1756287966.000001CA21443000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: MoneyChatv1.exe, rar.exe.0.dr	String found in binary or memory: http://s.symcb.com/universal-root.crl0
Source: MoneyChatv1.exe, rar.exe.0.dr	String found in binary or memory: http://s.symcd.com06
Source: powershell.exe, 00000009.00000002.1797522875.00000185A4198000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: powershell.exe, 00000009.00000002.1797522875.00000185A3F71000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000028.00000002.1756287966.000001CA1FDF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000009.00000002.1797522875.00000185A4198000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: MoneyChatv1.exe, 00000001.00000002.1976644828.000001B7ED8F4000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://tools.ietf.org/html/rfc6125#section-6.4.3
Source: MoneyChatv1.exe, rar.exe.0.dr	String found in binary or memory: http://ts-aia.ws.symantec.com/sha256-tss-ca.cer0(
Source: MoneyChatv1.exe, 00000000.00000003.1623690646.000001D726AE6000.00000004.00000020.00020000.00000000.sdmp, rar.exe.0.dr	String found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: MoneyChatv1.exe, rar.exe.0.dr	String found in binary or memory: http://ts-crl.ws.symantec.com/sha256-tss-ca.crl0
Source: MoneyChatv1.exe, 00000000.00000003.1623690646.000001D726AE6000.00000004.00000020.00020000.00000000.sdmp, rar.exe.0.dr	String found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: MoneyChatv1.exe, 00000000.00000003.1623690646.000001D726AE6000.00000004.00000020.00020000.00000000.sdmp, rar.exe.0.dr	String found in binary or memory: http://ts-ocsp.ws.symantec.com07
Source: MoneyChatv1.exe, rar.exe.0.dr	String found in binary or memory: http://ts-ocsp.ws.symantec.com0;
Source: powershell.exe, 00000028.00000002.1756287966.000001CA21443000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: powershell.exe, 00000028.00000002.1756287966.000001CA216D5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000028.00000002.1756287966.000001CA21443000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: MoneyChatv1.exe, 00000000.00000003.1624228652.000001D726AE6000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1623235396.000001D726AE6000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1621762722.000001D726AE4000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1622599367.000001D726AE6000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1621837390.000001D726AE5000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1621152121.000001D726AE4000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1621916177.000001D726AE5000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1621599467.000001D726AE4000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1621262390.000001D726AE4000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1623941850.000001D726AE6000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1621077123.000001D726AE4000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1621695445.000001D726AE4000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1624030064.000001D726AE6000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1621005623.000001D726AE4000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1623041828.000001D726AE6000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1622959812.000001D726AE6000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000000.00000003.1983916180.000001D726AF3000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr, libffi-8.dll.0.dr, _socket.pyd.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: MoneyChatv1.exe, 00000001.00000002.1975607128.000001B7ECE47000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000001.00000003.1691193325.000001B7ECE48000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000001.00000003.1653465925.000001B7ECE41000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-6
Source: MoneyChatv1.exe, 00000001.00000002.1975607128.000001B7ECE47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.microsoftCHROME~2.TXTy.
Source: MoneyChatv1.exe, 00000001.00000003.1691193325.000001B7ECE48000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000001.00000003.1653465925.000001B7ECE41000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.microsoftDATABA~1.DB-y.
Source: MoneyChatv1.exe, 00000001.00000002.1975607128.000001B7ECE47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.microsoftISPLA~1.PNGy./
Source: MoneyChatv1.exe, 00000001.00000002.1976777089.000001B7ED9D4000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://MD8.mozilla.org/1/m
Source: MoneyChatv1.exe, 00000001.00000003.1970435948.000001B7EC7A4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: MoneyChatv1.exe, 00000001.00000002.1976777089.000001B7EDA10000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://account.bellmedia.c
Source: powershell.exe, 00000009.00000002.1797522875.00000185A3F71000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000028.00000002.1756287966.000001CA1FDF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: MoneyChatv1.exe, 00000001.00000002.1976777089.000001B7ED97C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://allegro.pl/
Source: MoneyChatv1.exe, 00000001.00000002.1973878570.000001B7EC930000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://api.anonfiles.com/upload
Source: MoneyChatv1.exe, 00000001.00000003.1634249753.000001B7EC7E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.anonfiles.com/uploadr
Source: MoneyChatv1.exe, 00000001.00000002.1973878570.000001B7EC930000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://api.gofile.io/getServer
Source: MoneyChatv1.exe, 00000001.00000003.1634249753.000001B7EC7E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.gofile.io/getServerrz
Source: MoneyChatv1.exe, 00000001.00000003.1634249753.000001B7EC7E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.gofile.io/getServerrzr
Source: MoneyChatv1.exe, 00000001.00000002.1975293915.000001B7ECD73000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.stripe.com/v
Source: MoneyChatv1.exe, 00000001.00000002.1973878570.000001B7EC930000.00000004.00001000.00020000.00000000.sdmp, MoneyChatv1.exe, 00000001.00000003.1634249753.000001B7EC7E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot
Source: MoneyChatv1.exe, 00000001.00000002.1976777089.000001B7ED994000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mo
Source: MoneyChatv1.exe, 00000001.00000003.1970435948.000001B7EC7A4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: MoneyChatv1.exe, 00000001.00000003.1970435948.000001B7EC7A4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: MoneyChatv1.exe, 00000001.00000003.1970435948.000001B7EC7A4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: powershell.exe, 00000028.00000002.1756287966.000001CA2175B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000028.00000002.1756287966.000001CA2175B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000028.00000002.1756287966.000001CA2175B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: MoneyChatv1.exe, rar.exe.0.dr	String found in binary or memory: https://d.symcb.com/cps0%
Source: MoneyChatv1.exe, rar.exe.0.dr	String found in binary or memory: https://d.symcb.com/rpa0
Source: MoneyChatv1.exe, rar.exe.0.dr	String found in binary or memory: https://d.symcb.com/rpa0.
Source: MoneyChatv1.exe, 00000001.00000002.1973712346.000001B7EC830000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://discord.com/api/v9/users/
Source: MoneyChatv1.exe, 00000001.00000002.1976534926.000001B7ED730000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://discord.com/api/webhooks/1240380657666887700/TnMjALQrWBxb3bTdzbRJ91Rss2Poryr8-psQe2X-8dMlc0O
Source: MoneyChatv1.exe, 00000001.00000002.1975293915.000001B7ECD73000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://discordapp.com/api/v
Source: MoneyChatv1.exe, 00000001.00000002.1973712346.000001B7EC830000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://discordapp.com/api/v9/users/
Source: MoneyChatv1.exe, 00000001.00000002.1972433837.000001B7EA8E6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3.11/library/binascii.html#binascii.a2b_base64
Source: MoneyChatv1.exe, 00000001.00000003.1970435948.000001B7EC7A4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: MoneyChatv1.exe, 00000001.00000003.1970435948.000001B7EC7A4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: MoneyChatv1.exe, 00000001.00000003.1970435948.000001B7EC7A4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: MoneyChatv1.exe, 00000001.00000003.1653465925.000001B7ECE8F000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000001.00000003.1971420809.000001B7ECE8F000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000001.00000002.1976644828.000001B7ED830000.00000004.00001000.00020000.00000000.sdmp, MoneyChatv1.exe, 00000001.00000003.1691193325.000001B7ECE8F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://foss.heptapod.net/pypy/pypy/-/issues/3539
Source: MoneyChatv1.exe, 00000001.00000003.1971942904.000001B7ECBEA000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000001.00000003.1964503531.000001B7ECD13000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000001.00000003.1969040388.000001B7ED47F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Blank-c/Blank-Grabber
Source: MoneyChatv1.exe, 00000001.00000003.1634249753.000001B7EC7E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Blank-c/Blank-Grabberi
Source: MoneyChatv1.exe, 00000001.00000003.1634249753.000001B7EC7E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Blank-c/Blank-Grabberr
Source: MoneyChatv1.exe, 00000001.00000003.1633727077.000001B7EC75F000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000001.00000003.1633807044.000001B7EC760000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000001.00000003.1633533579.000001B7EC6CF000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000001.00000003.1633936530.000001B7EC760000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000001.00000003.1632958530.000001B7EC760000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000001.00000003.1633109198.000001B7ED634000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000001.00000003.1633662759.000001B7EC759000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000001.00000003.1632890658.000001B7EC724000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Blank-c/BlankOBF
Source: powershell.exe, 00000028.00000002.1756287966.000001CA216D5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000028.00000002.1756287966.000001CA21443000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: MoneyChatv1.exe, 00000001.00000002.1973023233.000001B7EC2F0000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000001.00000003.1627808131.000001B7EC31A000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000001.00000003.1628145682.000001B7EC317000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_sy
Source: MoneyChatv1.exe, 00000001.00000002.1972659607.000001B7EC26C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688
Source: MoneyChatv1.exe, 00000001.00000003.1628145682.000001B7EC317000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py
Source: MoneyChatv1.exe, 00000001.00000002.1973023233.000001B7EC2F0000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000001.00000003.1627808131.000001B7EC31A000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000001.00000003.1628145682.000001B7EC317000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/reader
Source: MoneyChatv1.exe, 00000001.00000003.1756172914.000001B7EC7D0000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000001.00000002.1973570214.000001B7EC7D0000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000001.00000003.1639787926.000001B7ECE70000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000001.00000003.1969228971.000001B7EC7CE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/issues/86361.
Source: MoneyChatv1.exe, 00000001.00000002.1973023233.000001B7EC2F0000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000001.00000003.1627808131.000001B7EC31A000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000001.00000003.1628145682.000001B7EC317000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#
Source: MoneyChatv1.exe, 00000001.00000003.1653465925.000001B7ECE8F000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000001.00000003.1971420809.000001B7ECE8F000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000001.00000002.1976644828.000001B7ED830000.00000004.00001000.00020000.00000000.sdmp, MoneyChatv1.exe, 00000001.00000003.1691193325.000001B7ECE8F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/urllib3/urllib3/issues/2192#issuecomment-821832963
Source: MoneyChatv1.exe, 00000001.00000003.1653668199.000001B7ECB32000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000001.00000003.1680974003.000001B7ECB39000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000001.00000002.1975694125.000001B7ECEDF000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000001.00000002.1974012792.000001B7ECB39000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000001.00000003.1653465925.000001B7ECEDF000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000001.00000003.1691193325.000001B7ECEDF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/urllib3/urllib3/issues/2513#issuecomment-1152559900.
Source: MoneyChatv1.exe, 00000001.00000002.1976534926.000001B7ED7A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/urllib3/urllib3/issues/2920
Source: powershell.exe, 00000028.00000002.1756287966.000001CA20CCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: MoneyChatv1.exe, 00000001.00000002.1973023233.000001B7EC331000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000001.00000003.1653668199.000001B7ECB53000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000001.00000002.1973570214.000001B7EC82A000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000001.00000003.1969228971.000001B7EC82A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.com/
Source: MoneyChatv1.exe, 00000001.00000003.1756172914.000001B7EC82A000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000001.00000002.1973023233.000001B7EC331000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000001.00000002.1973570214.000001B7EC82A000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000001.00000003.1969228971.000001B7EC82A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.com/mail
Source: MoneyChatv1.exe, 00000001.00000002.1973023233.000001B7EC2F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.com/mail/
Source: MoneyChatv1.exe, 00000001.00000002.1973878570.000001B7EC930000.00000004.00001000.00020000.00000000.sdmp, MoneyChatv1.exe, 00000001.00000003.1634249753.000001B7EC7E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gstatic.com/generate_204
Source: MoneyChatv1.exe, 00000001.00000002.1974012792.000001B7ECA30000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://html.spec.whatwg.org/multipage/
Source: MoneyChatv1.exe, 00000001.00000003.1653668199.000001B7ECB53000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://httpbin.org/
Source: MoneyChatv1.exe, 00000001.00000002.1976397894.000001B7ED486000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000001.00000003.1964503531.000001B7ECD13000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000001.00000003.1969040388.000001B7ED47F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://images-ext-1.discordapp.net/external/etSU0hGkd0ttMXA41AUjUl74oI1ajbez8WS2N-KLvK4/https/raw.g
Source: MoneyChatv1.exe, 00000001.00000002.1973501089.000001B7EC7AE000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000001.00000002.1973256829.000001B7EC6A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://json.org
Source: MoneyChatv1.exe, 00000001.00000002.1976777089.000001B7EDA14000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com
Source: MoneyChatv1.exe, 00000001.00000002.1976777089.000001B7ED97C000.00000004.00001000.00020000.00000000.sdmp, MoneyChatv1.exe, 00000001.00000003.1698322060.000001B7ECCF8000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000001.00000002.1976777089.000001B7ED9FC000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com
Source: powershell.exe, 00000009.00000002.1875538931.00000185B3FE3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000028.00000002.1816304387.000001CA2FE6A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000028.00000002.1816304387.000001CA2FFAD000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000028.00000002.1756287966.000001CA2175B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: powershell.exe, 00000028.00000002.1756287966.000001CA21443000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneget.org
Source: powershell.exe, 00000028.00000002.1756287966.000001CA21443000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneget.orgX
Source: MoneyChatv1.exe, 00000001.00000003.1632195902.000001B7EC681000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000001.00000003.1628953608.000001B7EC681000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000001.00000002.1973712346.000001B7EC830000.00000004.00001000.00020000.00000000.sdmp, MoneyChatv1.exe, 00000001.00000002.1973208910.000001B7EC630000.00000004.00000020.00020000.00000000.sdmp, base_library.zip.0.dr	String found in binary or memory: https://peps.python.org/pep-0205/
Source: MoneyChatv1.exe, 00000001.00000002.1980337100.00007FFDFB5D4000.00000040.00000001.01000000.00000004.sdmp	String found in binary or memory: https://peps.python.org/pep-0263/
Source: MoneyChatv1.exe, 00000001.00000003.1971942904.000001B7ECBEA000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000001.00000003.1964503531.000001B7ECD13000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000001.00000003.1969040388.000001B7ED47F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/Blank-c/Blank-Grabber/main/.github/workflows/image.png
Source: MoneyChatv1.exe, 00000001.00000002.1973131338.000001B7EC530000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/Blank-c/Blank-Grabber/main/.github/workflows/image.png0
Source: MoneyChatv1.exe, 00000001.00000003.1634249753.000001B7EC7E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/Blank-c/Blank-Grabber/main/.github/workflows/image.pngz
Source: MoneyChatv1.exe, rar.exe.0.dr	String found in binary or memory: https://sectigo.com/CPS0
Source: MoneyChatv1.exe, 00000001.00000003.1969040388.000001B7ED47F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.microsoft
Source: MoneyChatv1.exe, 00000001.00000003.1969040388.000001B7ED47F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.microsoft.
Source: MoneyChatv1.exe, 00000001.00000003.1690982222.000001B7ECC79000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000001.00000003.1669032365.000001B7ECC79000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org
Source: MoneyChatv1.exe, 00000001.00000003.1653668199.000001B7ECB32000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000001.00000003.1674602748.000001B7ECD08000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000001.00000003.1680974003.000001B7ECB39000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000001.00000003.1659440162.000001B7ECC86000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000001.00000003.1669246649.000001B7ECD08000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000001.00000003.1680974003.000001B7ECBEA000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000001.00000003.1690931194.000001B7ECD08000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: MoneyChatv1.exe, 00000001.00000002.1975694125.000001B7ECEDF000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000001.00000003.1659440162.000001B7ECC86000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000001.00000003.1653465925.000001B7ECEDF000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000001.00000003.1691193325.000001B7ECEDF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefox
Source: MoneyChatv1.exe, 00000001.00000003.1674602748.000001B7ECD08000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000001.00000003.1669246649.000001B7ECD08000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000001.00000003.1690931194.000001B7ECD08000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
Source: MoneyChatv1.exe, 00000001.00000003.1969040388.000001B7ED47F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.of
Source: MoneyChatv1.exe, 00000001.00000002.1976777089.000001B7ED964000.00000004.00001000.00020000.00000000.sdmp, MoneyChatv1.exe, 00000001.00000003.1970621860.000001B7ECC2E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: MoneyChatv1.exe, 00000001.00000003.1964503531.000001B7ECCEB000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000001.00000003.1968609500.000001B7ECDDC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: MoneyChatv1.exe, 00000001.00000003.1964503531.000001B7ECD0F000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000001.00000003.1964503531.000001B7ECD37000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: MoneyChatv1.exe, 00000001.00000003.1964503531.000001B7ECCEB000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000001.00000003.1968609500.000001B7ECDDC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: MoneyChatv1.exe, 00000001.00000002.1973286313.000001B7EC6C1000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000001.00000003.1971111629.000001B7EC6A4000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000001.00000003.1971330467.000001B7EC6BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/rfc2388#section-4.4
Source: MoneyChatv1.exe, 00000001.00000002.1975607128.000001B7ECE30000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/rfc7231#section-4.3.6)
Source: MoneyChatv1.exe, 00000001.00000002.1974012792.000001B7ECB53000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000001.00000002.1976777089.000001B7ED97C000.00000004.00001000.00020000.00000000.sdmp, MoneyChatv1.exe, 00000001.00000003.1680974003.000001B7ECB53000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000001.00000002.1973023233.000001B7EC331000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000001.00000003.1653668199.000001B7ECB53000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://twitter.com/
Source: MoneyChatv1.exe, 00000001.00000002.1976644828.000001B7ED89C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#https-proxy-error-http-proxy
Source: MoneyChatv1.exe, 00000001.00000002.1976534926.000001B7ED730000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warnings
Source: MoneyChatv1.exe, 00000001.00000002.1976777089.000001B7ED97C000.00000004.00001000.00020000.00000000.sdmp, MoneyChatv1.exe, 00000001.00000002.1976777089.000001B7ED994000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://weibo.com/
Source: MoneyChatv1.exe, 00000001.00000002.1976777089.000001B7ED97C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.aliexpress.com/
Source: MoneyChatv1.exe, 00000001.00000002.1976777089.000001B7ED994000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.ca/
Source: MoneyChatv1.exe, 00000001.00000002.1976777089.000001B7ED994000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.co.uk/
Source: MoneyChatv1.exe, 00000001.00000002.1976777089.000001B7ED994000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/
Source: MoneyChatv1.exe, 00000001.00000002.1976777089.000001B7ED994000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.de/
Source: MoneyChatv1.exe, 00000001.00000002.1976777089.000001B7ED994000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.fr/
Source: MoneyChatv1.exe, 00000001.00000002.1976777089.000001B7ED974000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.avito.ru/
Source: MoneyChatv1.exe, 00000001.00000002.1976777089.000001B7ED97C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.baidu.com/
Source: MoneyChatv1.exe, 00000001.00000002.1976777089.000001B7ED97C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.bbc.co.uk/
Source: MoneyChatv1.exe, 00000001.00000002.1976777089.000001B7ED97C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.ctrip.com/
Source: MoneyChatv1.exe, 00000001.00000002.1976777089.000001B7ED97C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.ebay.co.uk/
Source: MoneyChatv1.exe, 00000001.00000002.1976777089.000001B7ED97C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.ebay.de/
Source: MoneyChatv1.exe, 00000001.00000003.1970435948.000001B7EC7A4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: MoneyChatv1.exe, 00000001.00000002.1976777089.000001B7ED97C000.00000004.00001000.00020000.00000000.sdmp, MoneyChatv1.exe, 00000001.00000002.1976777089.000001B7ED994000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/
Source: MoneyChatv1.exe, 00000001.00000002.1976777089.000001B7ED940000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/complete/
Source: MoneyChatv1.exe, 00000001.00000003.1970435948.000001B7EC7A4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: MoneyChatv1.exe, 00000001.00000002.1976777089.000001B7ED97C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.ifeng.com/
Source: MoneyChatv1.exe, 00000001.00000002.1976777089.000001B7ED97C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.iqiyi.com/
Source: MoneyChatv1.exe, 00000001.00000002.1976777089.000001B7ED97C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.leboncoin.fr/
Source: MoneyChatv1.exe, 00000001.00000002.1976777089.000001B7ED9F8000.00000004.00001000.00020000.00000000.sdmp, MoneyChatv1.exe, 00000001.00000003.1690982222.000001B7ECC79000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000001.00000003.1674602748.000001B7ECCE1000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000001.00000003.1749456863.000001B7ECDB3000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000001.00000003.1669032365.000001B7ECC79000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000001.00000002.1976534926.000001B7ED7A0000.00000004.00001000.00020000.00000000.sdmp, MoneyChatv1.exe, 00000001.00000003.1697229637.000001B7ECDB3000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000001.00000002.1976777089.000001B7ED9E8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org
Source: MoneyChatv1.exe, 00000001.00000003.1659440162.000001B7ECC86000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: MoneyChatv1.exe, 00000001.00000003.1674602748.000001B7ECD08000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000001.00000003.1669246649.000001B7ECD08000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000001.00000003.1690931194.000001B7ECD08000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: MoneyChatv1.exe, 00000001.00000003.1653668199.000001B7ECB32000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000001.00000003.1680974003.000001B7ECB39000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000001.00000003.1659440162.000001B7ECC86000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000001.00000003.1680974003.000001B7ECBEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: MoneyChatv1.exe, 00000001.00000003.1674602748.000001B7ECD08000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000001.00000003.1669246649.000001B7ECD08000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000001.00000003.1690931194.000001B7ECD08000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: MoneyChatv1.exe, 00000001.00000003.1659440162.000001B7ECC86000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: MoneyChatv1.exe, 00000001.00000003.1674602748.000001B7ECD08000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000001.00000003.1669246649.000001B7ECD08000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000001.00000003.1690931194.000001B7ECD08000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: MoneyChatv1.exe, 00000001.00000003.1674602748.000001B7ECD08000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000001.00000003.1659440162.000001B7ECC86000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000001.00000003.1669246649.000001B7ECD08000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000001.00000003.1690931194.000001B7ECD08000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: MoneyChatv1.exe, 00000001.00000003.1653345615.000001B7ECD84000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000001.00000003.1657878118.000001B7ECD84000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/media/img/favicons/mozilla/favicon-196x196.2af054fea211.png
Source: MoneyChatv1.exe, 00000001.00000003.1658914202.000001B7ECC2F000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000001.00000002.1975607128.000001B7ECE47000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000001.00000003.1655984083.000001B7ECC2F000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000001.00000003.1691193325.000001B7ECE48000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000001.00000003.1653465925.000001B7ECE41000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000001.00000003.1653668199.000001B7ECC2F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/media/img/favicons/mozilla/favicon.d25d81d39065.icox
Source: MoneyChatv1.exe, 00000001.00000003.1674602748.000001B7ECD08000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000001.00000003.1669246649.000001B7ECD08000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000001.00000003.1690931194.000001B7ECD08000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: MoneyChatv1.exe, 00000001.00000002.1976777089.000001B7EDA18000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com
Source: MoneyChatv1.exe, 00000001.00000002.1976777089.000001B7ED97C000.00000004.00001000.00020000.00000000.sdmp, MoneyChatv1.exe, 00000001.00000002.1976777089.000001B7ED994000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.olx.pl/
Source: MoneyChatv1.exe, 00000000.00000003.1623041828.000001D726AE6000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000001.00000002.1981640686.00007FFE00468000.00000004.00000001.01000000.00000010.sdmp, MoneyChatv1.exe, 00000001.00000002.1980270787.00007FFDFB1A0000.00000004.00000001.01000000.0000000F.sdmp, libcrypto-3.dll.0.dr, libssl-3.dll.0.dr	String found in binary or memory: https://www.openssl.org/H
Source: MoneyChatv1.exe, 00000001.00000002.1972659607.000001B7EC1F0000.00000004.00001000.00020000.00000000.sdmp, base_library.zip.0.dr	String found in binary or memory: https://www.python.org/download/releases/2.3/mro/.
Source: MoneyChatv1.exe, MoneyChatv1.exe, 00000001.00000002.1980337100.00007FFDFB6DA000.00000040.00000001.01000000.00000004.sdmp	String found in binary or memory: https://www.python.org/psf/license/
Source: MoneyChatv1.exe, 00000001.00000002.1980337100.00007FFDFB5D4000.00000040.00000001.01000000.00000004.sdmp	String found in binary or memory: https://www.python.org/psf/license/)
Source: MoneyChatv1.exe, 00000001.00000002.1976777089.000001B7ED97C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.reddit.com/
Source: MoneyChatv1.exe, 00000001.00000002.1976777089.000001B7ED974000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.wykop.pl/
Source: MoneyChatv1.exe, 00000001.00000002.1976777089.000001B7ED97C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/
Source: MoneyChatv1.exe, 00000001.00000002.1976777089.000001B7ED994000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.zhihu.com/
Source: MoneyChatv1.exe, 00000001.00000003.1756172914.000001B7EC82A000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000001.00000002.1973023233.000001B7EC331000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000001.00000002.1973570214.000001B7EC82A000.00000004.00000020.00020000.00000000.sdmp, MoneyChatv1.exe, 00000001.00000003.1969228971.000001B7EC82A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://yahoo.com/

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443

Creates a window with clipboard capturing capabilities

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Window created: window name: CLIPBRDWNDCLASS

Spam, unwanted Advertisements and Ransom Demands

Modifies existing user documents (likely ransomware behavior)

Source: C:\Users\user\Desktop\MoneyChatv1.exe	File deleted: C:\Users\user\AppData\Local\Temp\ ? ? ???\Common Files\Desktop\DTBZGIOOSO.pdf	Jump to behavior
Source: C:\Users\user\Desktop\MoneyChatv1.exe	File deleted: C:\Users\user\AppData\Local\Temp\ ? ? ???\Common Files\Desktop\NWTVCDUMOB.mp3	Jump to behavior
Source: C:\Users\user\Desktop\MoneyChatv1.exe	File deleted: C:\Users\user\AppData\Local\Temp\ ? ? ???\Common Files\Desktop\DVWHKMNFNN.png	Jump to behavior
Source: C:\Users\user\Desktop\MoneyChatv1.exe	File deleted: C:\Users\user\AppData\Local\Temp\ ? ? ???\Common Files\Desktop\AIXACVYBSB.xlsx	Jump to behavior
Source: C:\Users\user\Desktop\MoneyChatv1.exe	File deleted: C:\Users\user\AppData\Local\Temp\ ? ? ???\Common Files\Desktop\AIXACVYBSB.xlsx	Jump to behavior

Modifies the hosts file

Source: C:\Users\user\Desktop\MoneyChatv1.exe

File written: C:\Windows\System32\drivers\etc\hosts

Jump to behavior

Too many similar processes found

Source: cmd.exe

Process created: 58

System Summary

Very long command line found

Source: C:\Users\user\Desktop\MoneyChatv1.exe	Process created: Commandline size = 3647
Source: C:\Windows\System32\cmd.exe	Process created: Commandline size = 3615
Source: C:\Users\user\Desktop\MoneyChatv1.exe	Process created: Commandline size = 3647	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: Commandline size = 3615

Writes or reads registry keys via WMI

Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue

Contains functionality to communicate with device drivers

Source: C:\Users\user\AppData\Local\Temp\_MEI68002\rar.exe

Code function: 80_2_00007FF7E2F4E21C: FindFirstFileW,FindClose,CreateFileW,DeviceIoControl,CloseHandle,

80_2_00007FF7E2F4E21C

Contains functionality to shutdown / reboot the system

Source: C:\Users\user\AppData\Local\Temp\_MEI68002\rar.exe

Code function: 80_2_00007FF7E2F7B57C GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitWindowsEx,

80_2_00007FF7E2F7B57C

Detected potential crypto function

Source: C:\Users\user\Desktop\MoneyChatv1.exe	Code function: 0_2_00007FF7ADE68670	0_2_00007FF7ADE68670
Source: C:\Users\user\Desktop\MoneyChatv1.exe	Code function: 0_2_00007FF7ADE59D9B	0_2_00007FF7ADE59D9B
Source: C:\Users\user\Desktop\MoneyChatv1.exe	Code function: 0_2_00007FF7ADE51000	0_2_00007FF7ADE51000
Source: C:\Users\user\Desktop\MoneyChatv1.exe	Code function: 0_2_00007FF7ADE77A9C	0_2_00007FF7ADE77A9C
Source: C:\Users\user\Desktop\MoneyChatv1.exe	Code function: 0_2_00007FF7ADE57B60	0_2_00007FF7ADE57B60
Source: C:\Users\user\Desktop\MoneyChatv1.exe	Code function: 0_2_00007FF7ADE76B50	0_2_00007FF7ADE76B50
Source: C:\Users\user\Desktop\MoneyChatv1.exe	Code function: 0_2_00007FF7ADE74EFC	0_2_00007FF7ADE74EFC
Source: C:\Users\user\Desktop\MoneyChatv1.exe	Code function: 0_2_00007FF7ADE68EF4	0_2_00007FF7ADE68EF4
Source: C:\Users\user\Desktop\MoneyChatv1.exe	Code function: 0_2_00007FF7ADE63ED0	0_2_00007FF7ADE63ED0
Source: C:\Users\user\Desktop\MoneyChatv1.exe	Code function: 0_2_00007FF7ADE726C4	0_2_00007FF7ADE726C4
Source: C:\Users\user\Desktop\MoneyChatv1.exe	Code function: 0_2_00007FF7ADE62684	0_2_00007FF7ADE62684
Source: C:\Users\user\Desktop\MoneyChatv1.exe	Code function: 0_2_00007FF7ADE76DCC	0_2_00007FF7ADE76DCC
Source: C:\Users\user\Desktop\MoneyChatv1.exe	Code function: 0_2_00007FF7ADE77550	0_2_00007FF7ADE77550
Source: C:\Users\user\Desktop\MoneyChatv1.exe	Code function: 0_2_00007FF7ADE63540	0_2_00007FF7ADE63540
Source: C:\Users\user\Desktop\MoneyChatv1.exe	Code function: 0_2_00007FF7ADE62890	0_2_00007FF7ADE62890
Source: C:\Users\user\Desktop\MoneyChatv1.exe	Code function: 0_2_00007FF7ADE62070	0_2_00007FF7ADE62070
Source: C:\Users\user\Desktop\MoneyChatv1.exe	Code function: 0_2_00007FF7ADE6E80C	0_2_00007FF7ADE6E80C
Source: C:\Users\user\Desktop\MoneyChatv1.exe	Code function: 0_2_00007FF7ADE7A7D8	0_2_00007FF7ADE7A7D8
Source: C:\Users\user\Desktop\MoneyChatv1.exe	Code function: 0_2_00007FF7ADE68670	0_2_00007FF7ADE68670
Source: C:\Users\user\Desktop\MoneyChatv1.exe	Code function: 0_2_00007FF7ADE5A76D	0_2_00007FF7ADE5A76D
Source: C:\Users\user\Desktop\MoneyChatv1.exe	Code function: 0_2_00007FF7ADE66750	0_2_00007FF7ADE66750
Source: C:\Users\user\Desktop\MoneyChatv1.exe	Code function: 0_2_00007FF7ADE59F3B	0_2_00007FF7ADE59F3B
Source: C:\Users\user\Desktop\MoneyChatv1.exe	Code function: 0_2_00007FF7ADE71720	0_2_00007FF7ADE71720
Source: C:\Users\user\Desktop\MoneyChatv1.exe	Code function: 0_2_00007FF7ADE642D4	0_2_00007FF7ADE642D4
Source: C:\Users\user\Desktop\MoneyChatv1.exe	Code function: 0_2_00007FF7ADE592D0	0_2_00007FF7ADE592D0
Source: C:\Users\user\Desktop\MoneyChatv1.exe	Code function: 0_2_00007FF7ADE62A94	0_2_00007FF7ADE62A94
Source: C:\Users\user\Desktop\MoneyChatv1.exe	Code function: 0_2_00007FF7ADE71720	0_2_00007FF7ADE71720
Source: C:\Users\user\Desktop\MoneyChatv1.exe	Code function: 0_2_00007FF7ADE62274	0_2_00007FF7ADE62274
Source: C:\Users\user\Desktop\MoneyChatv1.exe	Code function: 0_2_00007FF7ADE74A60	0_2_00007FF7ADE74A60
Source: C:\Users\user\Desktop\MoneyChatv1.exe	Code function: 0_2_00007FF7ADE684BC	0_2_00007FF7ADE684BC
Source: C:\Users\user\Desktop\MoneyChatv1.exe	Code function: 0_2_00007FF7ADE6ECA0	0_2_00007FF7ADE6ECA0
Source: C:\Users\user\Desktop\MoneyChatv1.exe	Code function: 0_2_00007FF7ADE62480	0_2_00007FF7ADE62480
Source: C:\Users\user\Desktop\MoneyChatv1.exe	Code function: 0_2_00007FF7ADE6AC50	0_2_00007FF7ADE6AC50
Source: C:\Users\user\Desktop\MoneyChatv1.exe	Code function: 0_2_00007FF7ADE6F320	0_2_00007FF7ADE6F320
Source: C:\Users\user\Desktop\MoneyChatv1.exe	Code function: 1_2_00007FFDFAB812F0	1_2_00007FFDFAB812F0
Source: C:\Users\user\Desktop\MoneyChatv1.exe	Code function: 1_2_00007FFDFAB818A0	1_2_00007FFDFAB818A0
Source: C:\Users\user\Desktop\MoneyChatv1.exe	Code function: 1_2_00007FFDFB19F160	1_2_00007FFDFB19F160
Source: C:\Users\user\Desktop\MoneyChatv1.exe	Code function: 1_2_00007FFDFB899D30	1_2_00007FFDFB899D30
Source: C:\Users\user\Desktop\MoneyChatv1.exe	Code function: 1_2_00007FFDFF212BB0	1_2_00007FFDFF212BB0
Source: C:\Users\user\Desktop\MoneyChatv1.exe	Code function: 1_2_00007FFDFF1B1630	1_2_00007FFDFF1B1630
Source: C:\Users\user\Desktop\MoneyChatv1.exe	Code function: 1_2_00007FFDFF1A9060	1_2_00007FFDFF1A9060
Source: C:\Users\user\Desktop\MoneyChatv1.exe	Code function: 1_2_00007FFDFF1A7F60	1_2_00007FFDFF1A7F60
Source: C:\Users\user\Desktop\MoneyChatv1.exe	Code function: 1_2_00007FFDFF1ABFA0	1_2_00007FFDFF1ABFA0
Source: C:\Users\user\Desktop\MoneyChatv1.exe	Code function: 1_2_00007FFDFF1EEFB0	1_2_00007FFDFF1EEFB0
Source: C:\Users\user\Desktop\MoneyChatv1.exe	Code function: 1_2_00007FFDFF1D9010	1_2_00007FFDFF1D9010
Source: C:\Users\user\Desktop\MoneyChatv1.exe	Code function: 1_2_00007FFDFF1BCFE0	1_2_00007FFDFF1BCFE0
Source: C:\Users\user\Desktop\MoneyChatv1.exe	Code function: 1_2_00007FFDFF239FE0	1_2_00007FFDFF239FE0
Source: C:\Users\user\Desktop\MoneyChatv1.exe	Code function: 1_2_00007FFDFF197030	1_2_00007FFDFF197030
Source: C:\Users\user\Desktop\MoneyChatv1.exe	Code function: 1_2_00007FFDFF1FAE70	1_2_00007FFDFF1FAE70
Source: C:\Users\user\Desktop\MoneyChatv1.exe	Code function: 1_2_00007FFDFF225EF0	1_2_00007FFDFF225EF0
Source: C:\Users\user\Desktop\MoneyChatv1.exe	Code function: 1_2_00007FFDFF1E9D80	1_2_00007FFDFF1E9D80
Source: C:\Users\user\Desktop\MoneyChatv1.exe	Code function: 1_2_00007FFDFF22FD80	1_2_00007FFDFF22FD80
Source: C:\Users\user\Desktop\MoneyChatv1.exe	Code function: 1_2_00007FFDFF19BDA0	1_2_00007FFDFF19BDA0
Source: C:\Users\user\Desktop\MoneyChatv1.exe	Code function: 1_2_00007FFDFF1DDDA0	1_2_00007FFDFF1DDDA0
Source: C:\Users\user\Desktop\MoneyChatv1.exe	Code function: 1_2_00007FFDFF1ACDE0	1_2_00007FFDFF1ACDE0
Source: C:\Users\user\Desktop\MoneyChatv1.exe	Code function: 1_2_00007FFDFF199C80	1_2_00007FFDFF199C80
Source: C:\Users\user\Desktop\MoneyChatv1.exe	Code function: 1_2_00007FFDFF19FC70	1_2_00007FFDFF19FC70
Source: C:\Users\user\Desktop\MoneyChatv1.exe	Code function: 1_2_00007FFDFF1B8CB0	1_2_00007FFDFF1B8CB0
Source: C:\Users\user\Desktop\MoneyChatv1.exe	Code function: 1_2_00007FFDFF1CBB91	1_2_00007FFDFF1CBB91
Source: C:\Users\user\Desktop\MoneyChatv1.exe	Code function: 1_2_00007FFDFF193BC0	1_2_00007FFDFF193BC0
Source: C:\Users\user\Desktop\MoneyChatv1.exe	Code function: 1_2_00007FFDFF1D3BA0	1_2_00007FFDFF1D3BA0
Source: C:\Users\user\Desktop\MoneyChatv1.exe	Code function: 1_2_00007FFDFF1A9AB0	1_2_00007FFDFF1A9AB0
Source: C:\Users\user\Desktop\MoneyChatv1.exe	Code function: 1_2_00007FFDFF225B00	1_2_00007FFDFF225B00
Source: C:\Users\user\Desktop\MoneyChatv1.exe	Code function: 1_2_00007FFDFF1D6B40	1_2_00007FFDFF1D6B40
Source: C:\Users\user\Desktop\MoneyChatv1.exe	Code function: 1_2_00007FFDFF1B3980	1_2_00007FFDFF1B3980
Source: C:\Users\user\Desktop\MoneyChatv1.exe	Code function: 1_2_00007FFDFF20099B	1_2_00007FFDFF20099B
Source: C:\Users\user\Desktop\MoneyChatv1.exe	Code function: 1_2_00007FFDFF1DE990	1_2_00007FFDFF1DE990
Source: C:\Users\user\Desktop\MoneyChatv1.exe	Code function: 1_2_00007FFDFF1C5960	1_2_00007FFDFF1C5960
Source: C:\Users\user\Desktop\MoneyChatv1.exe	Code function: 1_2_00007FFDFF1F5A40	1_2_00007FFDFF1F5A40
Source: C:\Users\user\Desktop\MoneyChatv1.exe	Code function: 1_2_00007FFDFF23C870	1_2_00007FFDFF23C870
Source: C:\Users\user\Desktop\MoneyChatv1.exe	Code function: 1_2_00007FFDFF2058A0	1_2_00007FFDFF2058A0
Source: C:\Users\user\Desktop\MoneyChatv1.exe	Code function: 1_2_00007FFDFF23E8E0	1_2_00007FFDFF23E8E0
Source: C:\Users\user\Desktop\MoneyChatv1.exe	Code function: 1_2_00007FFDFF19A940	1_2_00007FFDFF19A940
Source: C:\Users\user\Desktop\MoneyChatv1.exe	Code function: 1_2_00007FFDFF1C0790	1_2_00007FFDFF1C0790
Source: C:\Users\user\Desktop\MoneyChatv1.exe	Code function: 1_2_00007FFDFF1BD7C0	1_2_00007FFDFF1BD7C0
Source: C:\Users\user\Desktop\MoneyChatv1.exe	Code function: 1_2_00007FFDFF1947C0	1_2_00007FFDFF1947C0
Source: C:\Users\user\Desktop\MoneyChatv1.exe	Code function: 1_2_00007FFDFF1977C4	1_2_00007FFDFF1977C4
Source: C:\Users\user\Desktop\MoneyChatv1.exe	Code function: 1_2_00007FFDFF1DF7D0	1_2_00007FFDFF1DF7D0
Source: C:\Users\user\Desktop\MoneyChatv1.exe	Code function: 1_2_00007FFDFF2327A0	1_2_00007FFDFF2327A0
Source: C:\Users\user\Desktop\MoneyChatv1.exe	Code function: 1_2_00007FFDFF1AC800	1_2_00007FFDFF1AC800
Source: C:\Users\user\Desktop\MoneyChatv1.exe	Code function: 1_2_00007FFDFF19282E	1_2_00007FFDFF19282E
Source: C:\Users\user\Desktop\MoneyChatv1.exe	Code function: 1_2_00007FFDFF2376C0	1_2_00007FFDFF2376C0
Source: C:\Users\user\Desktop\MoneyChatv1.exe	Code function: 1_2_00007FFDFF1A66F0	1_2_00007FFDFF1A66F0
Source: C:\Users\user\Desktop\MoneyChatv1.exe	Code function: 1_2_00007FFDFF234750	1_2_00007FFDFF234750
Source: C:\Users\user\Desktop\MoneyChatv1.exe	Code function: 1_2_00007FFDFF202580	1_2_00007FFDFF202580
Source: C:\Users\user\Desktop\MoneyChatv1.exe	Code function: 1_2_00007FFDFF1D4590	1_2_00007FFDFF1D4590
Source: C:\Users\user\Desktop\MoneyChatv1.exe	Code function: 1_2_00007FFDFF2335D0	1_2_00007FFDFF2335D0
Source: C:\Users\user\Desktop\MoneyChatv1.exe	Code function: 1_2_00007FFDFF2385B0	1_2_00007FFDFF2385B0
Source: C:\Users\user\Desktop\MoneyChatv1.exe	Code function: 1_2_00007FFDFF199640	1_2_00007FFDFF199640
Source: C:\Users\user\Desktop\MoneyChatv1.exe	Code function: 1_2_00007FFDFF1A3490	1_2_00007FFDFF1A3490
Source: C:\Users\user\Desktop\MoneyChatv1.exe	Code function: 1_2_00007FFDFF1EA490	1_2_00007FFDFF1EA490
Source: C:\Users\user\Desktop\MoneyChatv1.exe	Code function: 1_2_00007FFDFF1BE4D0	1_2_00007FFDFF1BE4D0
Source: C:\Users\user\Desktop\MoneyChatv1.exe	Code function: 1_2_00007FFDFF1974B1	1_2_00007FFDFF1974B1
Source: C:\Users\user\Desktop\MoneyChatv1.exe	Code function: 1_2_00007FFDFF194510	1_2_00007FFDFF194510
Source: C:\Users\user\Desktop\MoneyChatv1.exe	Code function: 1_2_00007FFDFF1BC530	1_2_00007FFDFF1BC530
Source: C:\Users\user\Desktop\MoneyChatv1.exe	Code function: 1_2_00007FFDFF1EB530	1_2_00007FFDFF1EB530
Source: C:\Users\user\Desktop\MoneyChatv1.exe	Code function: 1_2_00007FFDFF1F33B0	1_2_00007FFDFF1F33B0
Source: C:\Users\user\Desktop\MoneyChatv1.exe	Code function: 1_2_00007FFDFF193295	1_2_00007FFDFF193295
Source: C:\Users\user\Desktop\MoneyChatv1.exe	Code function: 1_2_00007FFDFF22A280	1_2_00007FFDFF22A280
Source: C:\Users\user\Desktop\MoneyChatv1.exe	Code function: 1_2_00007FFDFF1B72D0	1_2_00007FFDFF1B72D0
Source: C:\Users\user\Desktop\MoneyChatv1.exe	Code function: 1_2_00007FFDFF1B62F0	1_2_00007FFDFF1B62F0
Source: C:\Users\user\Desktop\MoneyChatv1.exe	Code function: 1_2_00007FFDFF234330	1_2_00007FFDFF234330
Source: C:\Users\user\Desktop\MoneyChatv1.exe	Code function: 1_2_00007FFDFF1F11D0	1_2_00007FFDFF1F11D0
Source: C:\Users\user\Desktop\MoneyChatv1.exe	Code function: 1_2_00007FFDFF1A1060	1_2_00007FFDFF1A1060
Source: C:\Users\user\Desktop\MoneyChatv1.exe	Code function: 1_2_00007FFDFF20B060	1_2_00007FFDFF20B060
Source: C:\Users\user\Desktop\MoneyChatv1.exe	Code function: 1_2_00007FFDFF1940B0	1_2_00007FFDFF1940B0
Source: C:\Users\user\Desktop\MoneyChatv1.exe	Code function: 1_2_00007FFDFF1FA110	1_2_00007FFDFF1FA110
Source: C:\Users\user\Desktop\MoneyChatv1.exe	Code function: 1_2_00007FFDFF2510E0	1_2_00007FFDFF2510E0
Source: C:\Users\user\Desktop\MoneyChatv1.exe	Code function: 1_2_00007FFE003E5770	1_2_00007FFE003E5770
Source: C:\Users\user\Desktop\MoneyChatv1.exe	Code function: 1_2_00007FFE003A116D	1_2_00007FFE003A116D
Source: C:\Users\user\Desktop\MoneyChatv1.exe	Code function: 1_2_00007FFE003A1B54	1_2_00007FFE003A1B54
Source: C:\Users\user\Desktop\MoneyChatv1.exe	Code function: 1_2_00007FFE003D83F0	1_2_00007FFE003D83F0
Source: C:\Users\user\Desktop\MoneyChatv1.exe	Code function: 1_2_00007FFE003A1A0F	1_2_00007FFE003A1A0F
Source: C:\Users\user\Desktop\MoneyChatv1.exe	Code function: 1_2_00007FFE0040C530	1_2_00007FFE0040C530
Source: C:\Users\user\Desktop\MoneyChatv1.exe	Code function: 1_2_00007FFE003A16FE	1_2_00007FFE003A16FE
Source: C:\Users\user\Desktop\MoneyChatv1.exe	Code function: 1_2_00007FFE003A8630	1_2_00007FFE003A8630
Source: C:\Users\user\Desktop\MoneyChatv1.exe	Code function: 1_2_00007FFE004126E0	1_2_00007FFE004126E0
Source: C:\Users\user\Desktop\MoneyChatv1.exe	Code function: 1_2_00007FFE003A13DE	1_2_00007FFE003A13DE
Source: C:\Users\user\Desktop\MoneyChatv1.exe	Code function: 1_2_00007FFE003A143D	1_2_00007FFE003A143D
Source: C:\Users\user\Desktop\MoneyChatv1.exe	Code function: 1_2_00007FFE003A17F8	1_2_00007FFE003A17F8
Source: C:\Users\user\Desktop\MoneyChatv1.exe	Code function: 1_2_00007FFE003A1618	1_2_00007FFE003A1618
Source: C:\Users\user\Desktop\MoneyChatv1.exe	Code function: 1_2_00007FFE003A26FD	1_2_00007FFE003A26FD
Source: C:\Users\user\Desktop\MoneyChatv1.exe	Code function: 1_2_00007FFE003A2612	1_2_00007FFE003A2612
Source: C:\Users\user\Desktop\MoneyChatv1.exe	Code function: 1_2_00007FFE003A117C	1_2_00007FFE003A117C
Source: C:\Users\user\Desktop\MoneyChatv1.exe	Code function: 1_2_00007FFE003A24D7	1_2_00007FFE003A24D7
Source: C:\Users\user\Desktop\MoneyChatv1.exe	Code function: 1_2_00007FFE003A149C	1_2_00007FFE003A149C
Source: C:\Users\user\Desktop\MoneyChatv1.exe	Code function: 1_2_00007FFE00466D90	1_2_00007FFE00466D90
Source: C:\Users\user\Desktop\MoneyChatv1.exe	Code function: 1_2_00007FFE003A21C1	1_2_00007FFE003A21C1
Source: C:\Users\user\Desktop\MoneyChatv1.exe	Code function: 1_2_00007FFE003B70B0	1_2_00007FFE003B70B0
Source: C:\Users\user\Desktop\MoneyChatv1.exe	Code function: 1_2_00007FFE003A1C12	1_2_00007FFE003A1C12
Source: C:\Users\user\Desktop\MoneyChatv1.exe	Code function: 1_2_00007FFE003A155A	1_2_00007FFE003A155A
Source: C:\Users\user\Desktop\MoneyChatv1.exe	Code function: 1_2_00007FFE003ED2F0	1_2_00007FFE003ED2F0
Source: C:\Users\user\Desktop\MoneyChatv1.exe	Code function: 1_2_00007FFE003A1FD7	1_2_00007FFE003A1FD7
Source: C:\Users\user\Desktop\MoneyChatv1.exe	Code function: 1_2_00007FFE003E9370	1_2_00007FFE003E9370
Source: C:\Users\user\Desktop\MoneyChatv1.exe	Code function: 1_2_00007FFE003CB700	1_2_00007FFE003CB700
Source: C:\Users\user\Desktop\MoneyChatv1.exe	Code function: 1_2_00007FFE003ED7C0	1_2_00007FFE003ED7C0
Source: C:\Users\user\Desktop\MoneyChatv1.exe	Code function: 1_2_00007FFE003A1546	1_2_00007FFE003A1546
Source: C:\Users\user\Desktop\MoneyChatv1.exe	Code function: 1_2_00007FFE003A1596	1_2_00007FFE003A1596
Source: C:\Users\user\Desktop\MoneyChatv1.exe	Code function: 1_2_00007FFE003A21DF	1_2_00007FFE003A21DF
Source: C:\Users\user\Desktop\MoneyChatv1.exe	Code function: 1_2_00007FFE00419B30	1_2_00007FFE00419B30
Source: C:\Users\user\Desktop\MoneyChatv1.exe	Code function: 1_2_00007FFE003A1AD7	1_2_00007FFE003A1AD7
Source: C:\Users\user\Desktop\MoneyChatv1.exe	Code function: 1_2_00007FFE003A1CBC	1_2_00007FFE003A1CBC
Source: C:\Users\user\Desktop\MoneyChatv1.exe	Code function: 1_2_00007FFE003C5CF0	1_2_00007FFE003C5CF0
Source: C:\Users\user\Desktop\MoneyChatv1.exe	Code function: 1_2_00007FFE003A1D8E	1_2_00007FFE003A1D8E
Source: C:\Users\user\Desktop\MoneyChatv1.exe	Code function: 1_2_00007FFE003A1EDD	1_2_00007FFE003A1EDD
Source: C:\Users\user\Desktop\MoneyChatv1.exe	Code function: 1_2_00007FFE11519DBC	1_2_00007FFE11519DBC
Source: C:\Users\user\Desktop\MoneyChatv1.exe	Code function: 1_2_00007FFE11518CAC	1_2_00007FFE11518CAC
Source: C:\Users\user\Desktop\MoneyChatv1.exe	Code function: 1_2_00007FFE115199C0	1_2_00007FFE115199C0
Source: C:\Users\user\AppData\Local\Temp\_MEI68002\rar.exe	Code function: 80_2_00007FF7E2F454C0	80_2_00007FF7E2F454C0
Source: C:\Users\user\AppData\Local\Temp\_MEI68002\rar.exe	Code function: 80_2_00007FF7E2F382F0	80_2_00007FF7E2F382F0
Source: C:\Users\user\AppData\Local\Temp\_MEI68002\rar.exe	Code function: 80_2_00007FF7E2F41180	80_2_00007FF7E2F41180
Source: C:\Users\user\AppData\Local\Temp\_MEI68002\rar.exe	Code function: 80_2_00007FF7E2F31884	80_2_00007FF7E2F31884
Source: C:\Users\user\AppData\Local\Temp\_MEI68002\rar.exe	Code function: 80_2_00007FF7E2F3B540	80_2_00007FF7E2F3B540
Source: C:\Users\user\AppData\Local\Temp\_MEI68002\rar.exe	Code function: 80_2_00007FF7E2F67B24	80_2_00007FF7E2F67B24
Source: C:\Users\user\AppData\Local\Temp\_MEI68002\rar.exe	Code function: 80_2_00007FF7E2F3ABA0	80_2_00007FF7E2F3ABA0
Source: C:\Users\user\AppData\Local\Temp\_MEI68002\rar.exe	Code function: 80_2_00007FF7E2F40A2C	80_2_00007FF7E2F40A2C
Source: C:\Users\user\AppData\Local\Temp\_MEI68002\rar.exe	Code function: 80_2_00007FF7E2F5AE10	80_2_00007FF7E2F5AE10
Source: C:\Users\user\AppData\Local\Temp\_MEI68002\rar.exe	Code function: 80_2_00007FF7E2F5D458	80_2_00007FF7E2F5D458
Source: C:\Users\user\AppData\Local\Temp\_MEI68002\rar.exe	Code function: 80_2_00007FF7E2F75468	80_2_00007FF7E2F75468
Source: C:\Users\user\AppData\Local\Temp\_MEI68002\rar.exe	Code function: 80_2_00007FF7E2F3A504	80_2_00007FF7E2F3A504
Source: C:\Users\user\AppData\Local\Temp\_MEI68002\rar.exe	Code function: 80_2_00007FF7E2F8832C	80_2_00007FF7E2F8832C
Source: C:\Users\user\AppData\Local\Temp\_MEI68002\rar.exe	Code function: 80_2_00007FF7E2F42360	80_2_00007FF7E2F42360
Source: C:\Users\user\AppData\Local\Temp\_MEI68002\rar.exe	Code function: 80_2_00007FF7E2F60374	80_2_00007FF7E2F60374
Source: C:\Users\user\AppData\Local\Temp\_MEI68002\rar.exe	Code function: 80_2_00007FF7E2F5C3E0	80_2_00007FF7E2F5C3E0
Source: C:\Users\user\AppData\Local\Temp\_MEI68002\rar.exe	Code function: 80_2_00007FF7E2F4E21C	80_2_00007FF7E2F4E21C
Source: C:\Users\user\AppData\Local\Temp\_MEI68002\rar.exe	Code function: 80_2_00007FF7E2F57244	80_2_00007FF7E2F57244
Source: C:\Users\user\AppData\Local\Temp\_MEI68002\rar.exe	Code function: 80_2_00007FF7E2F3F24C	80_2_00007FF7E2F3F24C
Source: C:\Users\user\AppData\Local\Temp\_MEI68002\rar.exe	Code function: 80_2_00007FF7E2F82268	80_2_00007FF7E2F82268
Source: C:\Users\user\AppData\Local\Temp\_MEI68002\rar.exe	Code function: 80_2_00007FF7E2F702A4	80_2_00007FF7E2F702A4
Source: C:\Users\user\AppData\Local\Temp\_MEI68002\rar.exe	Code function: 80_2_00007FF7E2F4D2C0	80_2_00007FF7E2F4D2C0
Source: C:\Users\user\AppData\Local\Temp\_MEI68002\rar.exe	Code function: 80_2_00007FF7E2F342E0	80_2_00007FF7E2F342E0
Source: C:\Users\user\AppData\Local\Temp\_MEI68002\rar.exe	Code function: 80_2_00007FF7E2F81314	80_2_00007FF7E2F81314
Source: C:\Users\user\AppData\Local\Temp\_MEI68002\rar.exe	Code function: 80_2_00007FF7E2F72164	80_2_00007FF7E2F72164
Source: C:\Users\user\AppData\Local\Temp\_MEI68002\rar.exe	Code function: 80_2_00007FF7E2F781CC	80_2_00007FF7E2F781CC
Source: C:\Users\user\AppData\Local\Temp\_MEI68002\rar.exe	Code function: 80_2_00007FF7E2F941CC	80_2_00007FF7E2F941CC
Source: C:\Users\user\AppData\Local\Temp\_MEI68002\rar.exe	Code function: 80_2_00007FF7E2F38884	80_2_00007FF7E2F38884
Source: C:\Users\user\AppData\Local\Temp\_MEI68002\rar.exe	Code function: 80_2_00007FF7E2F42890	80_2_00007FF7E2F42890
Source: C:\Users\user\AppData\Local\Temp\_MEI68002\rar.exe	Code function: 80_2_00007FF7E2F818A8	80_2_00007FF7E2F818A8
Source: C:\Users\user\AppData\Local\Temp\_MEI68002\rar.exe	Code function: 80_2_00007FF7E2F638E8	80_2_00007FF7E2F638E8
Source: C:\Users\user\AppData\Local\Temp\_MEI68002\rar.exe	Code function: 80_2_00007FF7E2F60904	80_2_00007FF7E2F60904
Source: C:\Users\user\AppData\Local\Temp\_MEI68002\rar.exe	Code function: 80_2_00007FF7E2F7190C	80_2_00007FF7E2F7190C
Source: C:\Users\user\AppData\Local\Temp\_MEI68002\rar.exe	Code function: 80_2_00007FF7E2F417C8	80_2_00007FF7E2F417C8
Source: C:\Users\user\AppData\Local\Temp\_MEI68002\rar.exe	Code function: 80_2_00007FF7E2F567E0	80_2_00007FF7E2F567E0
Source: C:\Users\user\AppData\Local\Temp\_MEI68002\rar.exe	Code function: 80_2_00007FF7E2F87660	80_2_00007FF7E2F87660
Source: C:\Users\user\AppData\Local\Temp\_MEI68002\rar.exe	Code function: 80_2_00007FF7E2F486C4	80_2_00007FF7E2F486C4
Source: C:\Users\user\AppData\Local\Temp\_MEI68002\rar.exe	Code function: 80_2_00007FF7E2F986D4	80_2_00007FF7E2F986D4
Source: C:\Users\user\AppData\Local\Temp\_MEI68002\rar.exe	Code function: 80_2_00007FF7E2F72700	80_2_00007FF7E2F72700
Source: C:\Users\user\AppData\Local\Temp\_MEI68002\rar.exe	Code function: 80_2_00007FF7E2F6A710	80_2_00007FF7E2F6A710
Source: C:\Users\user\AppData\Local\Temp\_MEI68002\rar.exe	Code function: 80_2_00007FF7E2F70710	80_2_00007FF7E2F70710
Source: C:\Users\user\AppData\Local\Temp\_MEI68002\rar.exe	Code function: 80_2_00007FF7E2F6F59C	80_2_00007FF7E2F6F59C
Source: C:\Users\user\AppData\Local\Temp\_MEI68002\rar.exe	Code function: 80_2_00007FF7E2F48598	80_2_00007FF7E2F48598
Source: C:\Users\user\AppData\Local\Temp\_MEI68002\rar.exe	Code function: 80_2_00007FF7E2F5F5B0	80_2_00007FF7E2F5F5B0
Source: C:\Users\user\AppData\Local\Temp\_MEI68002\rar.exe	Code function: 80_2_00007FF7E2F665FC	80_2_00007FF7E2F665FC
Source: C:\Users\user\AppData\Local\Temp\_MEI68002\rar.exe	Code function: 80_2_00007FF7E2F8260C	80_2_00007FF7E2F8260C
Source: C:\Users\user\AppData\Local\Temp\_MEI68002\rar.exe	Code function: 80_2_00007FF7E2F48C30	80_2_00007FF7E2F48C30
Source: C:\Users\user\AppData\Local\Temp\_MEI68002\rar.exe	Code function: 80_2_00007FF7E2F75C8C	80_2_00007FF7E2F75C8C
Source: C:\Users\user\AppData\Local\Temp\_MEI68002\rar.exe	Code function: 80_2_00007FF7E2F3DD04	80_2_00007FF7E2F3DD04
Source: C:\Users\user\AppData\Local\Temp\_MEI68002\rar.exe	Code function: 80_2_00007FF7E2F59D0C	80_2_00007FF7E2F59D0C
Source: C:\Users\user\AppData\Local\Temp\_MEI68002\rar.exe	Code function: 80_2_00007FF7E2F86D0C	80_2_00007FF7E2F86D0C
Source: C:\Users\user\AppData\Local\Temp\_MEI68002\rar.exe	Code function: 80_2_00007FF7E2F74B38	80_2_00007FF7E2F74B38
Source: C:\Users\user\AppData\Local\Temp\_MEI68002\rar.exe	Code function: 80_2_00007FF7E2F89B98	80_2_00007FF7E2F89B98
Source: C:\Users\user\AppData\Local\Temp\_MEI68002\rar.exe	Code function: 80_2_00007FF7E2F6FA6C	80_2_00007FF7E2F6FA6C
Source: C:\Users\user\AppData\Local\Temp\_MEI68002\rar.exe	Code function: 80_2_00007FF7E2F75A70	80_2_00007FF7E2F75A70
Source: C:\Users\user\AppData\Local\Temp\_MEI68002\rar.exe	Code function: 80_2_00007FF7E2F9AAC0	80_2_00007FF7E2F9AAC0
Source: C:\Users\user\AppData\Local\Temp\_MEI68002\rar.exe	Code function: 80_2_00007FF7E2F3CB14	80_2_00007FF7E2F3CB14
Source: C:\Users\user\AppData\Local\Temp\_MEI68002\rar.exe	Code function: 80_2_00007FF7E2F6D91C	80_2_00007FF7E2F6D91C
Source: C:\Users\user\AppData\Local\Temp\_MEI68002\rar.exe	Code function: 80_2_00007FF7E2F5D97C	80_2_00007FF7E2F5D97C
Source: C:\Users\user\AppData\Local\Temp\_MEI68002\rar.exe	Code function: 80_2_00007FF7E2F349B8	80_2_00007FF7E2F349B8
Source: C:\Users\user\AppData\Local\Temp\_MEI68002\rar.exe	Code function: 80_2_00007FF7E2F769FD	80_2_00007FF7E2F769FD
Source: C:\Users\user\AppData\Local\Temp\_MEI68002\rar.exe	Code function: 80_2_00007FF7E2F43030	80_2_00007FF7E2F43030
Source: C:\Users\user\AppData\Local\Temp\_MEI68002\rar.exe	Code function: 80_2_00007FF7E2F68040	80_2_00007FF7E2F68040
Source: C:\Users\user\AppData\Local\Temp\_MEI68002\rar.exe	Code function: 80_2_00007FF7E2F5C05C	80_2_00007FF7E2F5C05C
Source: C:\Users\user\AppData\Local\Temp\_MEI68002\rar.exe	Code function: 80_2_00007FF7E2F60074	80_2_00007FF7E2F60074
Source: C:\Users\user\AppData\Local\Temp\_MEI68002\rar.exe	Code function: 80_2_00007FF7E2F900F0	80_2_00007FF7E2F900F0
Source: C:\Users\user\AppData\Local\Temp\_MEI68002\rar.exe	Code function: 80_2_00007FF7E2F50104	80_2_00007FF7E2F50104
Source: C:\Users\user\AppData\Local\Temp\_MEI68002\rar.exe	Code function: 80_2_00007FF7E2F65F4C	80_2_00007FF7E2F65F4C
Source: C:\Users\user\AppData\Local\Temp\_MEI68002\rar.exe	Code function: 80_2_00007FF7E2F9AF90	80_2_00007FF7E2F9AF90
Source: C:\Users\user\AppData\Local\Temp\_MEI68002\rar.exe	Code function: 80_2_00007FF7E2F9DFD8	80_2_00007FF7E2F9DFD8
Source: C:\Users\user\AppData\Local\Temp\_MEI68002\rar.exe	Code function: 80_2_00007FF7E2F74FE8	80_2_00007FF7E2F74FE8
Source: C:\Users\user\AppData\Local\Temp\_MEI68002\rar.exe	Code function: 80_2_00007FF7E2F6C00C	80_2_00007FF7E2F6C00C
Source: C:\Users\user\AppData\Local\Temp\_MEI68002\rar.exe	Code function: 80_2_00007FF7E2F7AE50	80_2_00007FF7E2F7AE50
Source: C:\Users\user\AppData\Local\Temp\_MEI68002\rar.exe	Code function: 80_2_00007FF7E2F8FE74	80_2_00007FF7E2F8FE74
Source: C:\Users\user\AppData\Local\Temp\_MEI68002\rar.exe	Code function: 80_2_00007FF7E2F48E68	80_2_00007FF7E2F48E68
Source: C:\Users\user\AppData\Local\Temp\_MEI68002\rar.exe	Code function: 80_2_00007FF7E2F3CE84	80_2_00007FF7E2F3CE84
Source: C:\Users\user\AppData\Local\Temp\_MEI68002\rar.exe	Code function: 80_2_00007FF7E2F7EEA4	80_2_00007FF7E2F7EEA4
Source: C:\Users\user\AppData\Local\Temp\_MEI68002\rar.exe	Code function: 80_2_00007FF7E2F39EFC	80_2_00007FF7E2F39EFC
Source: C:\Users\user\AppData\Local\Temp\_MEI68002\rar.exe	Code function: 80_2_00007FF7E2F6AF0C	80_2_00007FF7E2F6AF0C
Source: C:\Users\user\AppData\Local\Temp\_MEI68002\rar.exe	Code function: 80_2_00007FF7E2F60D20	80_2_00007FF7E2F60D20
Source: C:\Users\user\AppData\Local\Temp\_MEI68002\rar.exe	Code function: 80_2_00007FF7E2F79D74	80_2_00007FF7E2F79D74
Source: C:\Users\user\AppData\Local\Temp\_MEI68002\rar.exe	Code function: 80_2_00007FF7E2F81DCC	80_2_00007FF7E2F81DCC
Source: C:\Users\user\AppData\Local\Temp\_MEI68002\rar.exe	Code function: 80_2_00007FF7E2F41E04	80_2_00007FF7E2F41E04
Source: C:\Users\user\AppData\Local\Temp\_MEI68002\rar.exe	Code function: 80_2_00007FF7E2F3EE08	80_2_00007FF7E2F3EE08

Found potential string decryption / allocating functions

Source: C:\Users\user\AppData\Local\Temp\_MEI68002\rar.exe	Code function: String function: 00007FF7E2F749F4 appears 53 times
Source: C:\Users\user\AppData\Local\Temp\_MEI68002\rar.exe	Code function: String function: 00007FF7E2F48444 appears 48 times
Source: C:\Users\user\Desktop\MoneyChatv1.exe	Code function: String function: 00007FFDFF1C0F90 appears 34 times
Source: C:\Users\user\Desktop\MoneyChatv1.exe	Code function: String function: 00007FFE0041C16F appears 334 times
Source: C:\Users\user\Desktop\MoneyChatv1.exe	Code function: String function: 00007FFE0041C181 appears 1187 times
Source: C:\Users\user\Desktop\MoneyChatv1.exe	Code function: String function: 00007FFE0041C17B appears 38 times
Source: C:\Users\user\Desktop\MoneyChatv1.exe	Code function: String function: 00007FFDFF19A550 appears 165 times
Source: C:\Users\user\Desktop\MoneyChatv1.exe	Code function: String function: 00007FFE0041C931 appears 39 times
Source: C:\Users\user\Desktop\MoneyChatv1.exe	Code function: String function: 00007FFE0041C93D appears 69 times
Source: C:\Users\user\Desktop\MoneyChatv1.exe	Code function: String function: 00007FFE0041C265 appears 48 times
Source: C:\Users\user\Desktop\MoneyChatv1.exe	Code function: String function: 00007FFDFF1994B0 appears 134 times
Source: C:\Users\user\Desktop\MoneyChatv1.exe	Code function: String function: 00007FFE003A1325 appears 517 times
Source: C:\Users\user\Desktop\MoneyChatv1.exe	Code function: String function: 00007FF7ADE52B10 appears 47 times

PE / OLE file has an invalid certificate

Source: MoneyChatv1.exe

Static PE information: invalid certificate

PE file contains executable resources (Code or Archives)

Source: MoneyChatv1.exe	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: rar.exe.0.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: unicodedata.pyd.0.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS

Sample file is different than original file name gathered from version info

Source: MoneyChatv1.exe	Binary or memory string: OriginalFilename vs MoneyChatv1.exe
Source: MoneyChatv1.exe, 00000000.00000003.1624228652.000001D726AE6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameunicodedata.pyd. vs MoneyChatv1.exe
Source: MoneyChatv1.exe, 00000000.00000003.1621762722.000001D726AE4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_socket.pyd. vs MoneyChatv1.exe
Source: MoneyChatv1.exe, 00000000.00000003.1621837390.000001D726AE5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_sqlite3.pyd. vs MoneyChatv1.exe
Source: MoneyChatv1.exe, 00000000.00000003.1621152121.000001D726AE4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_decimal.pyd. vs MoneyChatv1.exe
Source: MoneyChatv1.exe, 00000000.00000003.1621916177.000001D726AE5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_ssl.pyd. vs MoneyChatv1.exe
Source: MoneyChatv1.exe, 00000000.00000003.1621599467.000001D726AE4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_lzma.pyd. vs MoneyChatv1.exe
Source: MoneyChatv1.exe, 00000000.00000003.1621262390.000001D726AE4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_hashlib.pyd. vs MoneyChatv1.exe
Source: MoneyChatv1.exe, 00000000.00000003.1623941850.000001D726AE6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameselect.pyd. vs MoneyChatv1.exe
Source: MoneyChatv1.exe, 00000000.00000003.1621077123.000001D726AE4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_ctypes.pyd. vs MoneyChatv1.exe
Source: MoneyChatv1.exe, 00000000.00000003.1621695445.000001D726AE4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_queue.pyd. vs MoneyChatv1.exe
Source: MoneyChatv1.exe, 00000000.00000003.1624030064.000001D726AE6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamesqlite3.dll0 vs MoneyChatv1.exe
Source: MoneyChatv1.exe, 00000000.00000000.1620646795.00007FF7ADE93000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamewsl.exej% vs MoneyChatv1.exe
Source: MoneyChatv1.exe, 00000000.00000003.1621005623.000001D726AE4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_bz2.pyd. vs MoneyChatv1.exe
Source: MoneyChatv1.exe, 00000000.00000003.1620893036.000001D726AE4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamevcruntime140.dllT vs MoneyChatv1.exe
Source: MoneyChatv1.exe, 00000000.00000003.1623041828.000001D726AE6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamelibsslH vs MoneyChatv1.exe
Source: MoneyChatv1.exe	Binary or memory string: OriginalFilename vs MoneyChatv1.exe
Source: MoneyChatv1.exe, 00000001.00000000.1625289866.00007FF7ADE93000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamewsl.exej% vs MoneyChatv1.exe
Source: MoneyChatv1.exe, 00000001.00000002.1981083697.00007FFDFB89B000.00000004.00000001.01000000.00000004.sdmp	Binary or memory string: OriginalFilenamepython312.dll. vs MoneyChatv1.exe
Source: MoneyChatv1.exe, 00000001.00000002.1981843416.00007FFE11542000.00000004.00000001.01000000.0000000E.sdmp	Binary or memory string: OriginalFilename_ssl.pyd. vs MoneyChatv1.exe
Source: MoneyChatv1.exe, 00000001.00000002.1982717096.00007FFE13393000.00000004.00000001.01000000.00000011.sdmp	Binary or memory string: OriginalFilename_hashlib.pyd. vs MoneyChatv1.exe
Source: MoneyChatv1.exe, 00000001.00000002.1982925936.00007FFE14648000.00000004.00000001.01000000.0000000C.sdmp	Binary or memory string: OriginalFilename_socket.pyd. vs MoneyChatv1.exe
Source: MoneyChatv1.exe, 00000001.00000002.1981640686.00007FFE00468000.00000004.00000001.01000000.00000010.sdmp	Binary or memory string: OriginalFilenamelibsslH vs MoneyChatv1.exe
Source: MoneyChatv1.exe, 00000001.00000002.1981356445.00007FFDFF303000.00000004.00000001.01000000.0000000B.sdmp	Binary or memory string: OriginalFilenamesqlite3.dll0 vs MoneyChatv1.exe
Source: MoneyChatv1.exe, 00000001.00000002.1982012665.00007FFE126F3000.00000004.00000001.01000000.0000000A.sdmp	Binary or memory string: OriginalFilename_sqlite3.pyd. vs MoneyChatv1.exe
Source: MoneyChatv1.exe, 00000001.00000002.1982355164.00007FFE1331C000.00000004.00000001.01000000.00000012.sdmp	Binary or memory string: OriginalFilename_queue.pyd. vs MoneyChatv1.exe
Source: MoneyChatv1.exe, 00000001.00000002.1980270787.00007FFDFB1A0000.00000004.00000001.01000000.0000000F.sdmp	Binary or memory string: OriginalFilenamelibcryptoH vs MoneyChatv1.exe
Source: MoneyChatv1.exe, 00000001.00000002.1982215299.00007FFE1324C000.00000004.00000001.01000000.00000008.sdmp	Binary or memory string: OriginalFilename_lzma.pyd. vs MoneyChatv1.exe
Source: MoneyChatv1.exe, 00000001.00000002.1979233771.00007FFDFAC9A000.00000004.00000001.01000000.00000013.sdmp	Binary or memory string: OriginalFilenameunicodedata.pyd. vs MoneyChatv1.exe
Source: MoneyChatv1.exe, 00000001.00000002.1983243898.00007FFE148E9000.00000002.00000001.01000000.00000005.sdmp	Binary or memory string: OriginalFilenamevcruntime140.dllT vs MoneyChatv1.exe
Source: MoneyChatv1.exe, 00000001.00000002.1982525203.00007FFE13344000.00000004.00000001.01000000.00000006.sdmp	Binary or memory string: OriginalFilename_ctypes.pyd. vs MoneyChatv1.exe
Source: MoneyChatv1.exe, 00000001.00000002.1983533692.00007FFE1A45C000.00000004.00000001.01000000.0000000D.sdmp	Binary or memory string: OriginalFilenameselect.pyd. vs MoneyChatv1.exe
Source: MoneyChatv1.exe, 00000001.00000002.1983068875.00007FFE148C8000.00000004.00000001.01000000.00000009.sdmp	Binary or memory string: OriginalFilename_bz2.pyd. vs MoneyChatv1.exe
Source: MoneyChatv1.exe	Binary or memory string: OriginalFilenamewsl.exej% vs MoneyChatv1.exe

Uses reg.exe to modify the Windows registry

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\reg.exe REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath

Source: libcrypto-3.dll.0.dr	Static PE information: Section: UPX1 ZLIB complexity 0.999059198943662
Source: libssl-3.dll.0.dr	Static PE information: Section: UPX1 ZLIB complexity 0.9916915494109948
Source: python312.dll.0.dr	Static PE information: Section: UPX1 ZLIB complexity 0.9993367065359005
Source: sqlite3.dll.0.dr	Static PE information: Section: UPX1 ZLIB complexity 0.997760029909241
Source: unicodedata.pyd.0.dr	Static PE information: Section: UPX1 ZLIB complexity 0.9951766913082437

Source: classification engine

Classification label: mal100.rans.troj.adwa.spyw.expl.evad.winEXE@161/56@2/2

Source: C:\Users\user\Desktop\MoneyChatv1.exe

Code function: 0_2_00007FF7ADE58770 GetLastError,FormatMessageW,WideCharToMultiByte,

0_2_00007FF7ADE58770

Source: C:\Users\user\AppData\Local\Temp\_MEI68002\rar.exe	Code function: 80_2_00007FF7E2F7B57C GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitWindowsEx,		80_2_00007FF7E2F7B57C
Source: C:\Users\user\AppData\Local\Temp\_MEI68002\rar.exe	Code function: 80_2_00007FF7E2F4EF50 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,		80_2_00007FF7E2F4EF50

Source: C:\Users\user\AppData\Local\Temp\_MEI68002\rar.exe

Code function: 80_2_00007FF7E2F53144 GetDiskFreeSpaceExW,

80_2_00007FF7E2F53144

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7584:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7432:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7992:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8164:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7348:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7732:120:WilError_03
Source: C:\Users\user\Desktop\MoneyChatv1.exe	Mutant created: \Sessions\1\BaseNamedObjects\J
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7936:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6388:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8140:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7904:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3484:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6848:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7496:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7660:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8184:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:8056:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7400:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Windows Analysis Report
MoneyChatv1.exe

Overview

General Information

Detection

Signatures

Classification

Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

Spam, unwanted Advertisements and Ransom Demands

DDoS

System Summary

Windows Analysis Report MoneyChatv1.exe

Overview

General Information

Detection

Signatures

Classification

Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

Spam, unwanted Advertisements and Ransom Demands

DDoS

System Summary

Windows Analysis Report
MoneyChatv1.exe