Edit tour

Windows Analysis Report
photographed.dat.dll

Overview

General Information

Sample Name:	photographed.dat.dll
Analysis ID:	879093
MD5:	2c55c2c1b7fbc68e11f48a6a13a34ec1
SHA1:	725de881de6a04ebbdc7422710daa343af3dfc66
SHA256:	6b157281cbb1af882dc0e88eb4832bb892e8c2e1678e0bcf30050d47f015f77f
Tags:	dll
Infos:

Detection

Qbot

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Yara detected Qbot

Sigma detected: Execute DLL with spoofed extension

Overwrites code with unconditional jumps - possibly settings hooks in foreign process

Writes to foreign memory regions

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Queries memory information (via WMI often done to detect virtual machines)

Allocates memory in foreign processes

Injects a PE file into a foreign processes

Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines)

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

C2 URLs / IPs found in malware configuration

Uses whoami command line tool to query computer and username

Uses ipconfig to lookup or modify the Windows network settings

Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines)

Sample uses string decryption to hide its real strings

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Yara signature match

One or more processes crash

Contains functionality to check if a debugger is running (IsDebuggerPresent)

May sleep (evasive loops) to hinder dynamic analysis

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Uses code obfuscation techniques (call, push, ret)

Found evasive API chain (date check)

Creates files inside the system directory

Internet Provider seen in connection with other malware

Detected potential crypto function

Contains functionality to query CPU information (cpuid)

Found potential string decryption / allocating functions

Sample execution stops while process was sleeping (likely an evasion)

Contains functionality to call native functions

Contains functionality to dynamically determine API calls

IP address seen in connection with other malware

Enables debug privileges

Creates a DirectInput object (often for capturing keystrokes)

AV process strings found (often used to terminate AV products)

Sample file is different than original file name gathered from version info

PE file contains an invalid checksum

Tries to load missing DLLs

Contains functionality to read the PEB

Found evasive API chain checking for process token information

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Detected TCP or UDP traffic on non-standard ports

Checks if the current process is being debugged

Connects to several IPs in different countries

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Creates a process in suspended mode (likely to inject code)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Classification

Process Tree

System is w10x64

loaddll32.exe (PID: 5212 cmdline: loaddll32.exe "C:\Users\user\Desktop\photographed.dat.dll" MD5: 3B4636AE519868037940CA5C4272091B)

conhost.exe (PID: 5728 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cmd.exe (PID: 6888 cmdline: cmd.exe /C rundll32.exe "C:\Users\user\Desktop\photographed.dat.dll",#1 MD5: F3BDBE3BB6F734E357235F4D5898582D)

rundll32.exe (PID: 5684 cmdline: rundll32.exe "C:\Users\user\Desktop\photographed.dat.dll",#1 MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

WerFault.exe (PID: 4964 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 5684 -s 660 MD5: 9E2B8ACAD48ECCA55C0230D63623661B)

rundll32.exe (PID: 7136 cmdline: rundll32.exe C:\Users\user\Desktop\photographed.dat.dll,m?0?$_SpinWait@$00@details@Concurrency@@QAE@P6AXXZ@Z MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

WerFault.exe (PID: 5272 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7136 -s 664 MD5: 9E2B8ACAD48ECCA55C0230D63623661B)

rundll32.exe (PID: 3108 cmdline: rundll32.exe C:\Users\user\Desktop\photographed.dat.dll,m?0?$_SpinWait@$0A@@details@Concurrency@@QAE@P6AXXZ@Z MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

WerFault.exe (PID: 7056 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 3108 -s 652 MD5: 9E2B8ACAD48ECCA55C0230D63623661B)

rundll32.exe (PID: 7216 cmdline: rundll32.exe C:\Users\user\Desktop\photographed.dat.dll,m?0SchedulerPolicy@Concurrency@@QAA@IZZ MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

WerFault.exe (PID: 7248 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7216 -s 648 MD5: 9E2B8ACAD48ECCA55C0230D63623661B)

rundll32.exe (PID: 7332 cmdline: rundll32.exe "C:\Users\user\Desktop\photographed.dat.dll",m?0?$_SpinWait@$00@details@Concurrency@@QAE@P6AXXZ@Z MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

WerFault.exe (PID: 7496 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7332 -s 652 MD5: 9E2B8ACAD48ECCA55C0230D63623661B)

rundll32.exe (PID: 7340 cmdline: rundll32.exe "C:\Users\user\Desktop\photographed.dat.dll",m?0?$_SpinWait@$0A@@details@Concurrency@@QAE@P6AXXZ@Z MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

WerFault.exe (PID: 7504 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7340 -s 652 MD5: 9E2B8ACAD48ECCA55C0230D63623661B)

rundll32.exe (PID: 7348 cmdline: rundll32.exe "C:\Users\user\Desktop\photographed.dat.dll",m?0SchedulerPolicy@Concurrency@@QAA@IZZ MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

WerFault.exe (PID: 7568 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7348 -s 648 MD5: 9E2B8ACAD48ECCA55C0230D63623661B)

rundll32.exe (PID: 7360 cmdline: rundll32.exe "C:\Users\user\Desktop\photographed.dat.dll",next MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

wermgr.exe (PID: 7772 cmdline: C:\Windows\SysWOW64\wermgr.exe MD5: CCF15E662ED5CE77B5FF1A7AAE305233)

ipconfig.exe (PID: 1852 cmdline: ipconfig /all MD5: B0C7423D02A007461C850CD0DFE09318)

conhost.exe (PID: 1708 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

whoami.exe (PID: 2244 cmdline: whoami /all MD5: 2E498B32E15CD7C0177A254E2410559C)

conhost.exe (PID: 7716 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

rundll32.exe (PID: 7380 cmdline: rundll32.exe "C:\Users\user\Desktop\photographed.dat.dll",mwait_for_multiple@event@Concurrency@@SAIPAPAV12@I_NI@Z MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

rundll32.exe (PID: 7416 cmdline: rundll32.exe "C:\Users\user\Desktop\photographed.dat.dll",mwait_for_all@agent@Concurrency@@SAXIPAPAV12@PAW4agent_status@2@I@Z MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

WerFault.exe (PID: 7584 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7416 -s 648 MD5: 9E2B8ACAD48ECCA55C0230D63623661B)

msiexec.exe (PID: 5264 cmdline: C:\Windows\system32\msiexec.exe /V MD5: 4767B71A318E201188A0D0A420C8B608)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
QakBot, qbotQbot	QBot is a modular information stealer also known as Qakbot or Pinkslipbot. It has been active for years since 2007. It has historically been known as a banking Trojan, meaning that it steals financial data from infected systems, and a loader using C2 servers for payload targeting and download.	GOLD CABIN	http://contagiodump.blogspot.com/2010/11/template.html http://www.secureworks.com/research/threat-profiles/gold-lagoon http://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/w32_qakbot_in_detail.pdf https://0xthreatintel.medium.com/reversing-qakbot-tlp-white-d1b8b37ad8e7 https://asec.ahnlab.com/en/44662/	https://malpedia.caad.fkie.fraunhofer.de/details/win.qakbot

Malware Configuration

Threatname: Qbot

{"Bot id": "BB30", "Campaign": "1685526716", "Version": "404.1320", "C2 list": ["198.2.51.242:993", "88.126.94.4:50000", "123.3.240.16:6881", "183.87.163.165:443", "27.99.32.26:2222", "180.151.229.230:2078", "27.109.19.90:2078", "122.184.143.86:443", "105.101.207.3:443", "84.215.202.8:443", "85.231.105.49:2222", "12.172.173.82:995", "184.181.75.148:443", "72.134.124.16:443", "149.74.159.67:2222", "174.4.89.3:443", "200.84.200.20:2222", "223.166.13.95:995", "69.133.162.35:443", "80.12.88.148:2222", "12.172.173.82:20", "90.29.86.138:2222", "124.149.143.189:2222", "70.160.67.203:443", "186.64.67.30:443", "165.120.169.171:2222", "116.74.164.144:443", "92.186.69.229:2222", "95.45.50.93:2222", "84.35.26.14:995", "89.129.109.27:2222", "174.58.146.57:443", "201.143.215.69:443", "12.172.173.82:2087", "213.55.33.103:443", "50.68.204.71:443", "92.239.81.124:443", "64.121.161.102:443", "2.82.8.80:443", "47.34.30.133:443", "147.147.30.126:2222", "94.30.98.134:32100", "188.28.19.84:443", "116.120.145.170:995", "79.77.142.22:2222", "102.159.223.197:443", "147.219.4.194:443", "161.142.103.187:995", "103.42.86.42:995", "65.95.141.84:2222", "205.237.67.69:995", "103.123.223.133:443", "82.127.153.75:2222", "103.139.242.6:443", "117.195.29.126:995", "109.50.149.241:2222", "161.129.37.43:443", "71.38.155.217:443", "58.186.75.42:443", "124.122.47.148:443", "220.240.164.182:443", "59.28.84.65:443", "79.92.15.6:443", "24.234.220.88:990", "96.56.197.26:2083", "78.160.146.127:443", "69.123.4.221:2222", "76.185.109.16:443", "24.234.220.88:465", "76.178.148.107:2222", "122.186.210.254:443", "70.28.50.223:2087", "178.175.187.254:443", "83.110.223.61:443", "125.99.76.102:443", "37.14.229.220:2222", "173.88.135.179:443", "62.35.230.21:995", "199.27.66.213:443", "96.87.28.170:2222", "103.87.128.228:443", "176.142.207.63:443", "12.172.173.82:32101", "76.16.49.134:443", "12.172.173.82:465", "184.182.66.109:443", "70.28.50.223:32100", "78.92.133.215:443", "50.68.204.71:993", "114.143.176.236:443", "70.28.50.223:3389", "50.68.186.195:443", "47.205.25.170:443", "12.172.173.82:993", "76.170.252.153:995", "69.242.31.249:443", "85.104.105.67:443", "79.168.224.165:2222", "75.143.236.149:443", "14.192.241.76:995", "81.229.117.95:2222", "105.184.99.124:995", "98.145.23.67:443", "12.172.173.82:21", "75.109.111.89:443", "76.86.31.59:443", "201.244.108.183:995", "68.203.69.96:443", "103.144.201.56:2078", "151.62.238.176:443", "86.248.228.57:2078", "85.57.212.13:3389", "91.165.188.74:50000", "45.51.102.225:443", "74.136.224.98:443", "47.199.241.39:443", "94.204.232.135:443", "70.49.205.198:2222", "24.234.220.88:995", "70.28.50.223:2083"]}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000013.00000002.409441736.00000000048D0000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Qbot_1	Yara detected Qbot	Joe Security
00000013.00000002.406028423.0000000000CDA000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Qbot_1	Yara detected Qbot	Joe Security
decrypted.memstr	JoeSecurity_Qbot	Yara detected Qbot	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
19.2.rundll32.exe.cf0968.0.raw.unpack	MAL_QakBot_ConfigExtraction_Feb23	QakBot Config Extraction	kevoreilly	0xeb71:$params: 8B 7D 08 8B F1 57 89 55 FC E8 A0 99 FF FF 8D 9E 24 04 00 00 89 03 59 85 C0 75 08 6A FC 58 E9 0xa797:$conf: 5F 5E 5B C9 C3 51 6A 00 E8 C1 44 00 00 59 59 85 C0 75 01 C3
19.2.rundll32.exe.cf0968.0.raw.unpack	JoeSecurity_Qbot_1	Yara detected Qbot	Joe Security
19.2.rundll32.exe.ef0000.1.unpack	MAL_QakBot_ConfigExtraction_Feb23	QakBot Config Extraction	kevoreilly	0xeb71:$params: 8B 7D 08 8B F1 57 89 55 FC E8 A0 99 FF FF 8D 9E 24 04 00 00 89 03 59 85 C0 75 08 6A FC 58 E9 0xa797:$conf: 5F 5E 5B C9 C3 51 6A 00 E8 C1 44 00 00 59 59 85 C0 75 01 C3
19.2.rundll32.exe.ef0000.1.unpack	JoeSecurity_Qbot_1	Yara detected Qbot	Joe Security
19.2.rundll32.exe.cf0968.0.unpack	MAL_QakBot_ConfigExtraction_Feb23	QakBot Config Extraction	kevoreilly	0xdf71:$params: 8B 7D 08 8B F1 57 89 55 FC E8 A0 99 FF FF 8D 9E 24 04 00 00 89 03 59 85 C0 75 08 6A FC 58 E9 0x9b97:$conf: 5F 5E 5B C9 C3 51 6A 00 E8 C1 44 00 00 59 59 85 C0 75 01 C3
19.2.rundll32.exe.cf0968.0.unpack	JoeSecurity_Qbot_1	Yara detected Qbot	Joe Security
Click to see the 1 entries

Sigma Signatures

Data Obfuscation

Sigma detected: Execute DLL with spoofed extension

Source: Process started

Author: Joe Security: Data: Command: cmd.exe /C rundll32.exe "C:\Users\user\Desktop\photographed.dat.dll",#1, CommandLine: cmd.exe /C rundll32.exe "C:\Users\user\Desktop\photographed.dat.dll",#1, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: loaddll32.exe "C:\Users\user\Desktop\photographed.dat.dll", ParentImage: C:\Windows\System32\loaddll32.exe, ParentProcessId: 5212, ParentProcessName: loaddll32.exe, ProcessCommandLine: cmd.exe /C rundll32.exe "C:\Users\user\Desktop\photographed.dat.dll",#1, ProcessId: 6888, ProcessName: cmd.exe

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 00000013.00000002.406028423.0000000000CDA000.00000004.00000020.00020000.00000000.sdmp

Malware Configuration Extractor: Qbot {"Bot id": "BB30", "Campaign": "1685526716", "Version": "404.1320", "C2 list": ["198.2.51.242:993", "88.126.94.4:50000", "123.3.240.16:6881", "183.87.163.165:443", "27.99.32.26:2222", "180.151.229.230:2078", "27.109.19.90:2078", "122.184.143.86:443", "105.101.207.3:443", "84.215.202.8:443", "85.231.105.49:2222", "12.172.173.82:995", "184.181.75.148:443", "72.134.124.16:443", "149.74.159.67:2222", "174.4.89.3:443", "200.84.200.20:2222", "223.166.13.95:995", "69.133.162.35:443", "80.12.88.148:2222", "12.172.173.82:20", "90.29.86.138:2222", "124.149.143.189:2222", "70.160.67.203:443", "186.64.67.30:443", "165.120.169.171:2222", "116.74.164.144:443", "92.186.69.229:2222", "95.45.50.93:2222", "84.35.26.14:995", "89.129.109.27:2222", "174.58.146.57:443", "201.143.215.69:443", "12.172.173.82:2087", "213.55.33.103:443", "50.68.204.71:443", "92.239.81.124:443", "64.121.161.102:443", "2.82.8.80:443", "47.34.30.133:443", "147.147.30.126:2222", "94.30.98.134:32100", "188.28.19.84:443", "116.120.145.170:995", "79.77.142.22:2222", "102.159.223.197:443", "147.219.4.194:443", "161.142.103.187:995", "103.42.86.42:995", "65.95.141.84:2222", "205.237.67.69:995", "103.123.223.133:443", "82.127.153.75:2222", "103.139.242.6:443", "117.195.29.126:995", "109.50.149.241:2222", "161.129.37.43:443", "71.38.155.217:443", "58.186.75.42:443", "124.122.47.148:443", "220.240.164.182:443", "59.28.84.65:443", "79.92.15.6:443", "24.234.220.88:990", "96.56.197.26:2083", "78.160.146.127:443", "69.123.4.221:2222", "76.185.109.16:443", "24.234.220.88:465", "76.178.148.107:2222", "122.186.210.254:443", "70.28.50.223:2087", "178.175.187.254:443", "83.110.223.61:443", "125.99.76.102:443", "37.14.229.220:2222", "173.88.135.179:443", "62.35.230.21:995", "199.27.66.213:443", "96.87.28.170:2222", "103.87.128.228:443", "176.142.207.63:443", "12.172.173.82:32101", "76.16.49.134:443", "12.172.173.82:465", "184.182.66.109:443", "70.28.50.223:32100", "78.92.133.215:443", "50.68.204.71:993", "114.143.176.236:443", "70.28.50.223:3389", "50.68.186.195:443", "47.205.25.170:443", "12.172.173.82:993", "76.170.252.153:995", "69.242.31.249:443", "85.104.105.67:443", "79.168.224.165:2222", "75.143.236.149:443", "14.192.241.76:995", "81.229.117.95:2222", "105.184.99.124:995", "98.145.23.67:443", "12.172.173.82:21", "75.109.111.89:443", "76.86.31.59:443", "201.244.108.183:995", "68.203.69.96:443", "103.144.201.56:2078", "151.62.238.176:443", "86.248.228.57:2078", "85.57.212.13:3389", "91.165.188.74:50000", "45.51.102.225:443", "74.136.224.98:443", "47.199.241.39:443", "94.204.232.135:443", "70.49.205.198:2222", "24.234.220.88:995", "70.28.50.223:2083"]}

Sample uses string decryption to hide its real strings

Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: error res='%s' err=%d len=%u
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: netstat -nao
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: runas
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: ipconfig /all
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: net localgroup
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: nltest /domain_trusts /all_trusts
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: %s %04x.%u %04x.%u res: %s seh_test: %u consts_test: %d vmdetected: %d createprocess: %d
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: Microsoft
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: SELF_TEST_1
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: p%08x
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: Self test FAILED!!!
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: Self test OK.
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: /t5
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: whoami /all
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: cmd
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: microsoft.com,google.com,cisco.com,oracle.com,verisign.com,broadcom.com,yahoo.com,xfinity.com,irs.gov,linkedin.com
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: ERROR: GetModuleFileNameW() failed with error: ERROR_INSUFFICIENT_BUFFER
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: route print
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: .lnk
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: "%s\system32\schtasks.exe" /Create /ST %02u:%02u /RU "NT AUTHORITY\SYSTEM" /SC ONCE /tr "%s" /Z /ET %02u:%02u /tn %s
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: arp -a
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: %s "$%s = \"%s\"; & $%s"
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: net share
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: cmd.exe /c set
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: Self check
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: %u;%u;%u;
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: /c ping.exe -n 6 127.0.0.1 & type "%s\System32\calc.exe" > "%s"
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: ProfileImagePath
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: at.exe %u:%u "%s" /I
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: ProgramData
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: Self check ok!
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: powershell.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: qwinsta
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: net view
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: nslookup -querytype=ALL -timeout=12 _ldap._tcp.dc._msdcs.%s
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: Component_08
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: Start screenshot
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: schtasks.exe /Delete /F /TN %u
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: appidapi.dll
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: %s \"$%s = \\\"%s\\\\; & $%s\"
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: c:\ProgramData
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: Component_07
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: bUdiuy81gYguty@4frdRdpfko(eKmudeuMncueaN
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: powershell.exe -encodedCommand %S
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: ERROR: GetModuleFileNameW() failed with error: %u
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: powershell.exe -encodedCommand
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: SoNuce]ugdiB3c[doMuce2s81*uXmcvP
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: \System32\WindowsPowerShell\v1.0\powershell.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: schtasks.exe /Create /RU "NT AUTHORITY\SYSTEM" /SC ONSTART /TN %u /TR "%s" /NP /F
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: error res='%s' err=%d len=%u
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: netstat -nao
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: runas
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: ipconfig /all
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: Caption,Description,Vendor,Version,InstallDate,InstallSource,PackageName
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: %u.%u.%u.%u.%u.%u.%04x
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: %SystemRoot%\SysWOW64\explorer.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: SystemRoot
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: cscript.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: MBAMService.exe;mbamgui.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: %SystemRoot%\System32\xwizard.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: %SystemRoot%\System32\wermgr.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: AvastSvc.exe;aswEngSrv.exe;aswToolsSvc.exe;afwServ.exe;aswidsagent.exe;AvastUI.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: C:\INTERNAL\__empty
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: .dll
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: Win32_PhysicalMemory
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: ALLUSERSPROFILE
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: image/jpeg
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: LocalLow
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: displayName
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: Mozilla/5.0 (Windows NT 6.1; rv:77.0) Gecko/20100101 Firefox/77.0
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: shlwapi.dll
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: %SystemRoot%\SysWOW64\WerFault.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: CommandLine
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: {%02X%02X%02X%02X-%02X%02X-%02X%02X-%02X%02X-%02X%02X%02X%02X%02X%02X}
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: kernel32.dll
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: SubmitSamplesConsent
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: 1234567890
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: wbj.go
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: %SystemRoot%\SysWOW64\wextract.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: Win32_DiskDrive
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: vkise.exe;isesrv.exe;cmdagent.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: System32
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: Name
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: %SystemRoot%\System32\WerFault.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: WRSA.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: c:\\
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: reg.exe ADD "HKLM\%s" /f /t %s /v "%s" /d "%s"
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: SpyNetReporting
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: FALSE
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: aswhookx.dll
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: Packages
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: SonicWallClientProtectionService.exe;SWDash.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: application/x-shockwave-flash
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: Sophos UI.exe;SophosUI.exe;SAVAdminService.exe;SavService.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: RepUx.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: %SystemRoot%\System32\mspaint.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: coreServiceShell.exe;PccNTMon.exe;NTRTScan.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: Winsta0
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: Caption,Description,DeviceID,Manufacturer,Name,PNPDeviceID,Service,Status
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: CynetEPS.exe;CynetMS.exe;CynetConsole.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: %SystemRoot%\SysWOW64\wermgr.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: %ProgramFiles(x86)%\Internet Explorer\iexplore.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: avp.exe;kavtray.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: root\SecurityCenter2
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: %SystemRoot%\SysWOW64\backgroundTaskHost.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: MsMpEng.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: %SystemRoot%\System32\CertEnrollCtrl.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: userenv.dll
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: csc_ui.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: frida-winjector-helper-32.exe;frida-winjector-helper-64.exe;tcpdump.exe;windump.exe;ethereal.exe;wireshark.exe;ettercap.exe;rtsniff.exe;packetcapture.exe;capturenet.exe;qak_proxy;dumpcap.exe;CFF Explorer.exe;not_rundll32.exe;ProcessHacker.exe;tcpview.exe;filemon.exe;procmon.exe;idaq64.exe;loaddll32.exe;PETools.exe;ImportREC.exe;LordPE.exe;SysInspector.exe;proc_analyzer.exe;sysAnalyzer.exe;sniff_hit.exe;joeboxcontrol.exe;joeboxserver.exe;ResourceHacker.exe;x64dbg.exe;Fiddler.exe;sniff_hit.exe;sysAnalyzer.exe;BehaviorDumper.exe;processdumperx64.exe;anti-virus.EXE;sysinfoX64.exe;sctoolswrapper.exe;sysinfoX64.exe;FakeExplorer.exe;apimonitor-x86.exe;idaq.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: \\.\pipe\
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: pstorec.dll
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: NTUSER.DAT
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: from
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: %SystemRoot%\System32\sethc.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: netapi32.dll
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: %SystemRoot%\System32\Utilman.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: gdi32.dll
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: setupapi.dll
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: SELECT * FROM Win32_Processor
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: iphlpapi.dll
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: Caption
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: CrAmTray.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: ccSvcHst.exe;NortonSecurity.exe;nsWscSvc.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: SOFTWARE\Microsoft\Microsoft AntiMalware\SpyNet
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: Win32_ComputerSystem
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: %SystemRoot%\System32\backgroundTaskHost.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: %ProgramFiles%\Internet Explorer\iexplore.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: SOFTWARE\Microsoft\Microsoft Antimalware\Exclusions\Paths
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: user32.dll
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: xagtnotif.exe;AppUIMonitor.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: %SystemRoot%\System32\dxdiag.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: SentinelServiceHost.exe;SentinelStaticEngine.exe;SentinelAgent.exe;SentinelStaticEngineScanner.exe;SentinelUI.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: \sf2.dll
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: %SystemRoot%\SysWOW64\grpconv.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: egui.exe;ekrn.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: Software\Microsoft
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: %S.%06d
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: bcrypt.dll
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: SELECT * FROM AntiVirusProduct
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: %SystemRoot%\SysWOW64\SndVol.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: %SystemRoot%\explorer.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: %SystemRoot%\SysWOW64\Utilman.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: SOFTWARE\Microsoft\Windows Defender\SpyNet
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: wtsapi32.dll
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: t=%s time=[%02d:%02d:%02d-%02d/%02d/%d]
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: %SystemRoot%\SysWOW64\xwizard.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: shell32.dll
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: TRUE
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: Win32_Bios
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: SELECT * FROM Win32_OperatingSystem
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: %SystemRoot%\SysWOW64\mobsync.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: c:\hiberfil.sysss
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: /
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: %SystemRoot%\SysWOW64\AtBroker.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: abcdefghijklmnopqrstuvwxyz
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: ByteFence.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: type=0x%04X
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: snxhk_border_mywnd
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: ROOT\CIMV2
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: dwengine.exe;dwarkdaemon.exe;dwwatcher.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: https
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: %SystemRoot%\SysWOW64\explorer.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: fshoster32.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: kernelbase.dll
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: regsvr32.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: %s\system32\
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: %SystemRoot%\SysWOW64\dxdiag.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: Content-Type: application/x-www-form-urlencoded
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: Win32_Process
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: rundll32.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: LOCALAPPDATA
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: cmd.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: APPDATA
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: select
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: .exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: SOFTWARE\Wow6432Node\Microsoft AntiMalware\SpyNet
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: mcshield.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: advapi32.dll
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: ws2_32.dll
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: .cfg
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: aabcdeefghiijklmnoopqrstuuvwxyyz
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: Win32_Product
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: WQL
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: wininet.dll
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: LastBootUpTime
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: S:(ML;;NW;;;LW)
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: %SystemRoot%\SysWOW64\CertEnrollCtrl.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: urlmon.dll
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: Create
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: Win32_PnPEntity
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: %SystemRoot%\System32\grpconv.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: Initializing database...
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: %SystemRoot%\System32\SearchIndexer.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: winsta0\default
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: .dat
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: WBJ_IGNORE
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: next
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: %SystemRoot%\System32\AtBroker.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: wpcap.dll
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: aaebcdeeifghiiojklmnooupqrstuuyvwxyyaz
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: %SystemRoot%\SysWOW64\sethc.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Spynet
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: image/pjpeg
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: fmon.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: bdagent.exe;vsserv.exe;vsservppl.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: %SystemRoot%\System32\SndVol.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: vbs
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: aswhooka.dll
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: SysWOW64
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: %SystemRoot%\SysWOW64\mspaint.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: mpr.dll
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: image/gif
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: crypt32.dll
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: avgcsrvx.exe;avgsvcx.exe;avgcsrva.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: ntdll.dll
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: open
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: %SystemRoot%\explorer.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: CSFalconService.exe;CSFalconContainer.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: %SystemRoot%\System32\wextract.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: %SystemRoot%\System32\mobsync.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: %SystemRoot%\SysWOW64\SearchIndexer.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: Caption,Description,Vendor,Version,InstallDate,InstallSource,PackageName
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: Caption,Description,Vendor,Version,InstallDate,InstallSource,PackageName
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: %u.%u.%u.%u.%u.%u.%04x
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: %SystemRoot%\SysWOW64\explorer.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: SystemRoot
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: cscript.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: MBAMService.exe;mbamgui.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: %SystemRoot%\System32\xwizard.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: %SystemRoot%\System32\wermgr.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: AvastSvc.exe;aswEngSrv.exe;aswToolsSvc.exe;afwServ.exe;aswidsagent.exe;AvastUI.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: C:\INTERNAL\__empty
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: .dll
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: Win32_PhysicalMemory
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: ALLUSERSPROFILE
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: image/jpeg
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: LocalLow
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: displayName
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: Mozilla/5.0 (Windows NT 6.1; rv:77.0) Gecko/20100101 Firefox/77.0
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: shlwapi.dll
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: %SystemRoot%\SysWOW64\WerFault.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: CommandLine
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: {%02X%02X%02X%02X-%02X%02X-%02X%02X-%02X%02X-%02X%02X%02X%02X%02X%02X}
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: kernel32.dll
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: SubmitSamplesConsent
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: 1234567890
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: wbj.go
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: %SystemRoot%\SysWOW64\wextract.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: Win32_DiskDrive
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: vkise.exe;isesrv.exe;cmdagent.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: System32
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: Name
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: %SystemRoot%\System32\WerFault.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: WRSA.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: c:\\
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: reg.exe ADD "HKLM\%s" /f /t %s /v "%s" /d "%s"
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: SpyNetReporting
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: FALSE
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: aswhookx.dll
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: Packages
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: SonicWallClientProtectionService.exe;SWDash.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: application/x-shockwave-flash
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: Sophos UI.exe;SophosUI.exe;SAVAdminService.exe;SavService.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: RepUx.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: %SystemRoot%\System32\mspaint.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: coreServiceShell.exe;PccNTMon.exe;NTRTScan.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: Winsta0
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: Caption,Description,DeviceID,Manufacturer,Name,PNPDeviceID,Service,Status
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: CynetEPS.exe;CynetMS.exe;CynetConsole.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: %SystemRoot%\SysWOW64\wermgr.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: %ProgramFiles(x86)%\Internet Explorer\iexplore.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: avp.exe;kavtray.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: root\SecurityCenter2
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: %SystemRoot%\SysWOW64\backgroundTaskHost.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: MsMpEng.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: %SystemRoot%\System32\CertEnrollCtrl.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: userenv.dll
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: csc_ui.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: frida-winjector-helper-32.exe;frida-winjector-helper-64.exe;tcpdump.exe;windump.exe;ethereal.exe;wireshark.exe;ettercap.exe;rtsniff.exe;packetcapture.exe;capturenet.exe;qak_proxy;dumpcap.exe;CFF Explorer.exe;not_rundll32.exe;ProcessHacker.exe;tcpview.exe;filemon.exe;procmon.exe;idaq64.exe;loaddll32.exe;PETools.exe;ImportREC.exe;LordPE.exe;SysInspector.exe;proc_analyzer.exe;sysAnalyzer.exe;sniff_hit.exe;joeboxcontrol.exe;joeboxserver.exe;ResourceHacker.exe;x64dbg.exe;Fiddler.exe;sniff_hit.exe;sysAnalyzer.exe;BehaviorDumper.exe;processdumperx64.exe;anti-virus.EXE;sysinfoX64.exe;sctoolswrapper.exe;sysinfoX64.exe;FakeExplorer.exe;apimonitor-x86.exe;idaq.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: \\.\pipe\
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: pstorec.dll
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: NTUSER.DAT
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: from
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: %SystemRoot%\System32\sethc.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: netapi32.dll
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: %SystemRoot%\System32\Utilman.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: gdi32.dll
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: setupapi.dll
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: SELECT * FROM Win32_Processor
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: iphlpapi.dll
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: Caption
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: CrAmTray.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: ccSvcHst.exe;NortonSecurity.exe;nsWscSvc.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: SOFTWARE\Microsoft\Microsoft AntiMalware\SpyNet
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: Win32_ComputerSystem
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: %SystemRoot%\System32\backgroundTaskHost.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: %ProgramFiles%\Internet Explorer\iexplore.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: SOFTWARE\Microsoft\Microsoft Antimalware\Exclusions\Paths
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: user32.dll
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: xagtnotif.exe;AppUIMonitor.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: %SystemRoot%\System32\dxdiag.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: SentinelServiceHost.exe;SentinelStaticEngine.exe;SentinelAgent.exe;SentinelStaticEngineScanner.exe;SentinelUI.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: \sf2.dll
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: %SystemRoot%\SysWOW64\grpconv.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: egui.exe;ekrn.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: Software\Microsoft
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: %S.%06d
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: bcrypt.dll
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: SELECT * FROM AntiVirusProduct
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: %SystemRoot%\SysWOW64\SndVol.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: %SystemRoot%\explorer.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: %SystemRoot%\SysWOW64\Utilman.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: SOFTWARE\Microsoft\Windows Defender\SpyNet
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: wtsapi32.dll
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: t=%s time=[%02d:%02d:%02d-%02d/%02d/%d]
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: %SystemRoot%\SysWOW64\xwizard.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: shell32.dll
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: TRUE
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: Win32_Bios
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: SELECT * FROM Win32_OperatingSystem
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: %SystemRoot%\SysWOW64\mobsync.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: c:\hiberfil.sysss
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: /
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: %SystemRoot%\SysWOW64\AtBroker.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: abcdefghijklmnopqrstuvwxyz
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: ByteFence.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: type=0x%04X
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: snxhk_border_mywnd
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: ROOT\CIMV2
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: dwengine.exe;dwarkdaemon.exe;dwwatcher.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: https
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: %SystemRoot%\SysWOW64\explorer.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: fshoster32.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: kernelbase.dll
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: regsvr32.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: %s\system32\
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: %SystemRoot%\SysWOW64\dxdiag.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: Content-Type: application/x-www-form-urlencoded
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: Win32_Process
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: rundll32.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: LOCALAPPDATA
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: cmd.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: APPDATA
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: select
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: .exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: SOFTWARE\Wow6432Node\Microsoft AntiMalware\SpyNet
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: mcshield.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: advapi32.dll
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: ws2_32.dll
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: .cfg
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: aabcdeefghiijklmnoopqrstuuvwxyyz
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: Win32_Product
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: WQL
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: wininet.dll
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: LastBootUpTime
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: S:(ML;;NW;;;LW)
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: %SystemRoot%\SysWOW64\CertEnrollCtrl.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: urlmon.dll
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: Create
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: Win32_PnPEntity
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: %SystemRoot%\System32\grpconv.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: Initializing database...
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: %SystemRoot%\System32\SearchIndexer.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: winsta0\default
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: .dat
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: WBJ_IGNORE
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: next
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: %SystemRoot%\System32\AtBroker.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: wpcap.dll
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: aaebcdeeifghiiojklmnooupqrstuuyvwxyyaz
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: %SystemRoot%\SysWOW64\sethc.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Spynet
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: image/pjpeg
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: fmon.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: bdagent.exe;vsserv.exe;vsservppl.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: %SystemRoot%\System32\SndVol.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: vbs
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: aswhooka.dll
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: SysWOW64
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: %SystemRoot%\SysWOW64\mspaint.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: mpr.dll
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: image/gif
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: crypt32.dll
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: avgcsrvx.exe;avgsvcx.exe;avgcsrva.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: ntdll.dll
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: open
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: %SystemRoot%\explorer.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: CSFalconService.exe;CSFalconContainer.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: %SystemRoot%\System32\wextract.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: %SystemRoot%\System32\mobsync.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: %SystemRoot%\SysWOW64\SearchIndexer.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: Caption,Description,Vendor,Version,InstallDate,InstallSource,PackageName

Source: photographed.dat.dll

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE, DLL

Source: photographed.dat.dll

Static PE information: DYNAMIC_BASE, NX_COMPAT, GUARD_CF

Source:

Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\concrt140.i386.pdb source: rundll32.exe, rundll32.exe, 00000003.00000002.392372880.0000000010001000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000004.00000002.392493181.0000000010001000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000A.00000002.392344783.0000000010001000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000D.00000002.392401954.0000000010001000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000010.00000002.401803325.0000000010001000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000011.00000002.401894410.0000000010001000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000012.00000002.403206272.0000000010001000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000013.00000002.409550768.0000000010001000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000015.00000002.394982082.0000000010001000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000017.00000002.403101600.0000000010001000.00000020.00000001.01000000.00000003.sdmp, photographed.dat.dll

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 19_2_00EF9DA8 FindFirstFileW,FindNextFileW,

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	IPs: 198.2.51.242:993
Source: Malware configuration extractor	IPs: 88.126.94.4:50000
Source: Malware configuration extractor	IPs: 123.3.240.16:6881
Source: Malware configuration extractor	IPs: 183.87.163.165:443
Source: Malware configuration extractor	IPs: 27.99.32.26:2222
Source: Malware configuration extractor	IPs: 180.151.229.230:2078
Source: Malware configuration extractor	IPs: 27.109.19.90:2078
Source: Malware configuration extractor	IPs: 122.184.143.86:443
Source: Malware configuration extractor	IPs: 105.101.207.3:443
Source: Malware configuration extractor	IPs: 84.215.202.8:443
Source: Malware configuration extractor	IPs: 85.231.105.49:2222
Source: Malware configuration extractor	IPs: 12.172.173.82:995
Source: Malware configuration extractor	IPs: 184.181.75.148:443
Source: Malware configuration extractor	IPs: 72.134.124.16:443
Source: Malware configuration extractor	IPs: 149.74.159.67:2222
Source: Malware configuration extractor	IPs: 174.4.89.3:443
Source: Malware configuration extractor	IPs: 200.84.200.20:2222
Source: Malware configuration extractor	IPs: 223.166.13.95:995
Source: Malware configuration extractor	IPs: 69.133.162.35:443
Source: Malware configuration extractor	IPs: 80.12.88.148:2222
Source: Malware configuration extractor	IPs: 12.172.173.82:20
Source: Malware configuration extractor	IPs: 90.29.86.138:2222
Source: Malware configuration extractor	IPs: 124.149.143.189:2222
Source: Malware configuration extractor	IPs: 70.160.67.203:443
Source: Malware configuration extractor	IPs: 186.64.67.30:443
Source: Malware configuration extractor	IPs: 165.120.169.171:2222
Source: Malware configuration extractor	IPs: 116.74.164.144:443
Source: Malware configuration extractor	IPs: 92.186.69.229:2222
Source: Malware configuration extractor	IPs: 95.45.50.93:2222
Source: Malware configuration extractor	IPs: 84.35.26.14:995
Source: Malware configuration extractor	IPs: 89.129.109.27:2222
Source: Malware configuration extractor	IPs: 174.58.146.57:443
Source: Malware configuration extractor	IPs: 201.143.215.69:443
Source: Malware configuration extractor	IPs: 12.172.173.82:2087
Source: Malware configuration extractor	IPs: 213.55.33.103:443
Source: Malware configuration extractor	IPs: 50.68.204.71:443
Source: Malware configuration extractor	IPs: 92.239.81.124:443
Source: Malware configuration extractor	IPs: 64.121.161.102:443
Source: Malware configuration extractor	IPs: 2.82.8.80:443
Source: Malware configuration extractor	IPs: 47.34.30.133:443
Source: Malware configuration extractor	IPs: 147.147.30.126:2222
Source: Malware configuration extractor	IPs: 94.30.98.134:32100
Source: Malware configuration extractor	IPs: 188.28.19.84:443
Source: Malware configuration extractor	IPs: 116.120.145.170:995
Source: Malware configuration extractor	IPs: 79.77.142.22:2222
Source: Malware configuration extractor	IPs: 102.159.223.197:443
Source: Malware configuration extractor	IPs: 147.219.4.194:443
Source: Malware configuration extractor	IPs: 161.142.103.187:995
Source: Malware configuration extractor	IPs: 103.42.86.42:995
Source: Malware configuration extractor	IPs: 65.95.141.84:2222
Source: Malware configuration extractor	IPs: 205.237.67.69:995
Source: Malware configuration extractor	IPs: 103.123.223.133:443
Source: Malware configuration extractor	IPs: 82.127.153.75:2222
Source: Malware configuration extractor	IPs: 103.139.242.6:443
Source: Malware configuration extractor	IPs: 117.195.29.126:995
Source: Malware configuration extractor	IPs: 109.50.149.241:2222
Source: Malware configuration extractor	IPs: 161.129.37.43:443
Source: Malware configuration extractor	IPs: 71.38.155.217:443
Source: Malware configuration extractor	IPs: 58.186.75.42:443
Source: Malware configuration extractor	IPs: 124.122.47.148:443
Source: Malware configuration extractor	IPs: 220.240.164.182:443
Source: Malware configuration extractor	IPs: 59.28.84.65:443
Source: Malware configuration extractor	IPs: 79.92.15.6:443
Source: Malware configuration extractor	IPs: 24.234.220.88:990
Source: Malware configuration extractor	IPs: 96.56.197.26:2083
Source: Malware configuration extractor	IPs: 78.160.146.127:443
Source: Malware configuration extractor	IPs: 69.123.4.221:2222
Source: Malware configuration extractor	IPs: 76.185.109.16:443
Source: Malware configuration extractor	IPs: 24.234.220.88:465
Source: Malware configuration extractor	IPs: 76.178.148.107:2222
Source: Malware configuration extractor	IPs: 122.186.210.254:443
Source: Malware configuration extractor	IPs: 70.28.50.223:2087
Source: Malware configuration extractor	IPs: 178.175.187.254:443
Source: Malware configuration extractor	IPs: 83.110.223.61:443
Source: Malware configuration extractor	IPs: 125.99.76.102:443
Source: Malware configuration extractor	IPs: 37.14.229.220:2222
Source: Malware configuration extractor	IPs: 173.88.135.179:443
Source: Malware configuration extractor	IPs: 62.35.230.21:995
Source: Malware configuration extractor	IPs: 199.27.66.213:443
Source: Malware configuration extractor	IPs: 96.87.28.170:2222
Source: Malware configuration extractor	IPs: 103.87.128.228:443
Source: Malware configuration extractor	IPs: 176.142.207.63:443
Source: Malware configuration extractor	IPs: 12.172.173.82:32101
Source: Malware configuration extractor	IPs: 76.16.49.134:443
Source: Malware configuration extractor	IPs: 12.172.173.82:465
Source: Malware configuration extractor	IPs: 184.182.66.109:443
Source: Malware configuration extractor	IPs: 70.28.50.223:32100
Source: Malware configuration extractor	IPs: 78.92.133.215:443
Source: Malware configuration extractor	IPs: 50.68.204.71:993
Source: Malware configuration extractor	IPs: 114.143.176.236:443
Source: Malware configuration extractor	IPs: 70.28.50.223:3389
Source: Malware configuration extractor	IPs: 50.68.186.195:443
Source: Malware configuration extractor	IPs: 47.205.25.170:443
Source: Malware configuration extractor	IPs: 12.172.173.82:993
Source: Malware configuration extractor	IPs: 76.170.252.153:995
Source: Malware configuration extractor	IPs: 69.242.31.249:443
Source: Malware configuration extractor	IPs: 85.104.105.67:443
Source: Malware configuration extractor	IPs: 79.168.224.165:2222
Source: Malware configuration extractor	IPs: 75.143.236.149:443
Source: Malware configuration extractor	IPs: 14.192.241.76:995
Source: Malware configuration extractor	IPs: 81.229.117.95:2222
Source: Malware configuration extractor	IPs: 105.184.99.124:995
Source: Malware configuration extractor	IPs: 98.145.23.67:443
Source: Malware configuration extractor	IPs: 12.172.173.82:21
Source: Malware configuration extractor	IPs: 75.109.111.89:443
Source: Malware configuration extractor	IPs: 76.86.31.59:443
Source: Malware configuration extractor	IPs: 201.244.108.183:995
Source: Malware configuration extractor	IPs: 68.203.69.96:443
Source: Malware configuration extractor	IPs: 103.144.201.56:2078
Source: Malware configuration extractor	IPs: 151.62.238.176:443
Source: Malware configuration extractor	IPs: 86.248.228.57:2078
Source: Malware configuration extractor	IPs: 85.57.212.13:3389
Source: Malware configuration extractor	IPs: 91.165.188.74:50000
Source: Malware configuration extractor	IPs: 45.51.102.225:443
Source: Malware configuration extractor	IPs: 74.136.224.98:443
Source: Malware configuration extractor	IPs: 47.199.241.39:443
Source: Malware configuration extractor	IPs: 94.204.232.135:443
Source: Malware configuration extractor	IPs: 70.49.205.198:2222
Source: Malware configuration extractor	IPs: 24.234.220.88:995
Source: Malware configuration extractor	IPs: 70.28.50.223:2083

Source: Joe Sandbox View

ASN Name: PROXADFR PROXADFR

Source: Joe Sandbox View

IP Address: 91.165.188.74 91.165.188.74

Source: global traffic

TCP traffic: 192.168.2.3:49736 -> 200.84.200.20:2222

Source: unknown

Network traffic detected: IP country count 28

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724

Source: unknown	TCP traffic detected without corresponding DNS query: 213.55.33.103
Source: unknown	TCP traffic detected without corresponding DNS query: 213.55.33.103
Source: unknown	TCP traffic detected without corresponding DNS query: 213.55.33.103
Source: unknown	TCP traffic detected without corresponding DNS query: 213.55.33.103
Source: unknown	TCP traffic detected without corresponding DNS query: 213.55.33.103
Source: unknown	TCP traffic detected without corresponding DNS query: 213.55.33.103
Source: unknown	TCP traffic detected without corresponding DNS query: 213.55.33.103
Source: unknown	TCP traffic detected without corresponding DNS query: 213.55.33.103
Source: unknown	TCP traffic detected without corresponding DNS query: 213.55.33.103
Source: unknown	TCP traffic detected without corresponding DNS query: 213.55.33.103
Source: unknown	TCP traffic detected without corresponding DNS query: 213.55.33.103
Source: unknown	TCP traffic detected without corresponding DNS query: 213.55.33.103
Source: unknown	TCP traffic detected without corresponding DNS query: 213.55.33.103
Source: unknown	TCP traffic detected without corresponding DNS query: 213.55.33.103
Source: unknown	TCP traffic detected without corresponding DNS query: 213.55.33.103
Source: unknown	TCP traffic detected without corresponding DNS query: 213.55.33.103
Source: unknown	TCP traffic detected without corresponding DNS query: 213.55.33.103
Source: unknown	TCP traffic detected without corresponding DNS query: 213.55.33.103
Source: unknown	TCP traffic detected without corresponding DNS query: 213.55.33.103
Source: unknown	TCP traffic detected without corresponding DNS query: 213.55.33.103
Source: unknown	TCP traffic detected without corresponding DNS query: 213.55.33.103
Source: unknown	TCP traffic detected without corresponding DNS query: 213.55.33.103
Source: unknown	TCP traffic detected without corresponding DNS query: 213.55.33.103
Source: unknown	TCP traffic detected without corresponding DNS query: 213.55.33.103
Source: unknown	TCP traffic detected without corresponding DNS query: 213.55.33.103
Source: unknown	TCP traffic detected without corresponding DNS query: 213.55.33.103
Source: unknown	TCP traffic detected without corresponding DNS query: 213.55.33.103
Source: unknown	TCP traffic detected without corresponding DNS query: 213.55.33.103
Source: unknown	TCP traffic detected without corresponding DNS query: 213.55.33.103
Source: unknown	TCP traffic detected without corresponding DNS query: 213.55.33.103
Source: unknown	TCP traffic detected without corresponding DNS query: 213.55.33.103
Source: unknown	TCP traffic detected without corresponding DNS query: 213.55.33.103
Source: unknown	TCP traffic detected without corresponding DNS query: 213.55.33.103
Source: unknown	TCP traffic detected without corresponding DNS query: 213.55.33.103
Source: unknown	TCP traffic detected without corresponding DNS query: 213.55.33.103
Source: unknown	TCP traffic detected without corresponding DNS query: 213.55.33.103
Source: unknown	TCP traffic detected without corresponding DNS query: 213.55.33.103
Source: unknown	TCP traffic detected without corresponding DNS query: 213.55.33.103
Source: unknown	TCP traffic detected without corresponding DNS query: 213.55.33.103
Source: unknown	TCP traffic detected without corresponding DNS query: 213.55.33.103
Source: unknown	TCP traffic detected without corresponding DNS query: 200.84.200.20
Source: unknown	TCP traffic detected without corresponding DNS query: 200.84.200.20
Source: unknown	TCP traffic detected without corresponding DNS query: 200.84.200.20
Source: unknown	TCP traffic detected without corresponding DNS query: 200.84.200.20
Source: unknown	TCP traffic detected without corresponding DNS query: 200.84.200.20
Source: unknown	TCP traffic detected without corresponding DNS query: 200.84.200.20
Source: unknown	TCP traffic detected without corresponding DNS query: 200.84.200.20
Source: unknown	TCP traffic detected without corresponding DNS query: 200.84.200.20
Source: unknown	TCP traffic detected without corresponding DNS query: 200.84.200.20
Source: unknown	TCP traffic detected without corresponding DNS query: 200.84.200.20

Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="font-sans text-[14px] text-black-a60 font-bold leading-[1.25] visited:text-black-a60 hover:visited:text-blue-70" href="https://www.linkedin.com/company/linkedin/jobs?trk=homepage-basic_directory_careersUrl" data-tracking-control-name="homepage-basic_directory_careersUrl" data-tracking-will-navigate> equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="font-sans text-[14px] text-black-a60 font-bold leading-[1.25] visited:text-black-a60 hover:visited:text-blue-70" href="https://www.linkedin.com/directory/advice?trk=homepage-basic_directory_adviceDirectoryUrl" data-tracking-control-name="homepage-basic_directory_adviceDirectoryUrl" data-tracking-will-navigate> equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="font-sans text-[14px] text-black-a60 font-bold leading-[1.25] visited:text-black-a60 hover:visited:text-blue-70" href="https://www.linkedin.com/directory/articles?trk=homepage-basic_directory_articlesDirectoryUrl" data-tracking-control-name="homepage-basic_directory_articlesDirectoryUrl" data-tracking-will-navigate> equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="font-sans text-[14px] text-black-a60 font-bold leading-[1.25] visited:text-black-a60 hover:visited:text-blue-70" href="https://www.linkedin.com/directory/companies?trk=homepage-basic_directory_companyDirectoryUrl" data-tracking-control-name="homepage-basic_directory_companyDirectoryUrl" data-tracking-will-navigate> equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="font-sans text-[14px] text-black-a60 font-bold leading-[1.25] visited:text-black-a60 hover:visited:text-blue-70" href="https://www.linkedin.com/directory/featured?trk=homepage-basic_directory_featuredDirectoryUrl" data-tracking-control-name="homepage-basic_directory_featuredDirectoryUrl" data-tracking-will-navigate> equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="font-sans text-[14px] text-black-a60 font-bold leading-[1.25] visited:text-black-a60 hover:visited:text-blue-70" href="https://www.linkedin.com/directory/jobs?trk=homepage-basic_directory_jobSearchDirectoryUrl" data-tracking-control-name="homepage-basic_directory_jobSearchDirectoryUrl" data-tracking-will-navigate> equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="font-sans text-[14px] text-black-a60 font-bold leading-[1.25] visited:text-black-a60 hover:visited:text-blue-70" href="https://www.linkedin.com/directory/learning?trk=homepage-basic_directory_learningDirectoryUrl" data-tracking-control-name="homepage-basic_directory_learningDirectoryUrl" data-tracking-will-navigate> equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="font-sans text-[14px] text-black-a60 font-bold leading-[1.25] visited:text-black-a60 hover:visited:text-blue-70" href="https://www.linkedin.com/directory/news?trk=homepage-basic_directory_newsDirectoryUrl" data-tracking-control-name="homepage-basic_directory_newsDirectoryUrl" data-tracking-will-navigate> equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="font-sans text-[14px] text-black-a60 font-bold leading-[1.25] visited:text-black-a60 hover:visited:text-blue-70" href="https://www.linkedin.com/directory/newsletters?trk=homepage-basic_directory_newslettersDirectoryUrl" data-tracking-control-name="homepage-basic_directory_newslettersDirectoryUrl" data-tracking-will-navigate> equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="font-sans text-[14px] text-black-a60 font-bold leading-[1.25] visited:text-black-a60 hover:visited:text-blue-70" href="https://www.linkedin.com/directory/people-search?trk=homepage-basic_directory_peopleSearchDirectoryUrl" data-tracking-control-name="homepage-basic_directory_peopleSearchDirectoryUrl" data-tracking-will-navigate> equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="font-sans text-[14px] text-black-a60 font-bold leading-[1.25] visited:text-black-a60 hover:visited:text-blue-70" href="https://www.linkedin.com/directory/people?trk=homepage-basic_directory_peopleDirectoryUrl" data-tracking-control-name="homepage-basic_directory_peopleDirectoryUrl" data-tracking-will-navigate> equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="font-sans text-[14px] text-black-a60 font-bold leading-[1.25] visited:text-black-a60 hover:visited:text-blue-70" href="https://www.linkedin.com/directory/posts?trk=homepage-basic_directory_postsDirectoryUrl" data-tracking-control-name="homepage-basic_directory_postsDirectoryUrl" data-tracking-will-navigate> equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="font-sans text-[14px] text-black-a60 font-bold leading-[1.25] visited:text-black-a60 hover:visited:text-blue-70" href="https://www.linkedin.com/directory/products?trk=homepage-basic_directory_productsDirectoryUrl" data-tracking-control-name="homepage-basic_directory_productsDirectoryUrl" data-tracking-will-navigate> equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="font-sans text-[14px] text-black-a60 font-bold leading-[1.25] visited:text-black-a60 hover:visited:text-blue-70" href="https://www.linkedin.com/directory/schools?trk=homepage-basic_directory_schoolsDirectoryUrl" data-tracking-control-name="homepage-basic_directory_schoolsDirectoryUrl" data-tracking-will-navigate> equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="font-sans text-[14px] text-black-a60 font-bold leading-[1.25] visited:text-black-a60 hover:visited:text-blue-70" href="https://www.linkedin.com/directory/services?trk=homepage-basic_directory_servicesDirectoryUrl" data-tracking-control-name="homepage-basic_directory_servicesDirectoryUrl" data-tracking-will-navigate> equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="font-sans text-[14px] text-black-a60 font-bold leading-[1.25] visited:text-black-a60 hover:visited:text-blue-70" href="https://www.linkedin.com/help/linkedin?lang=en&trk=homepage-basic_directory_helpCenterUrl" data-tracking-control-name="homepage-basic_directory_helpCenterUrl" data-tracking-will-navigate> equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="font-sans text-[14px] text-black-a60 font-bold leading-[1.25] visited:text-black-a60 hover:visited:text-blue-70" href="https://www.linkedin.com/jobs?trk=homepage-basic_directory_jobsHomeUrl" data-tracking-control-name="homepage-basic_directory_jobsHomeUrl" data-tracking-will-navigate> equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="font-sans text-[14px] text-black-a60 font-bold leading-[1.25] visited:text-black-a60 hover:visited:text-blue-70" href="https://www.linkedin.com/learning/?trk=homepage-basic_directory_learningHomeUrl" data-tracking-control-name="homepage-basic_directory_learningHomeUrl" data-tracking-will-navigate> equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="font-sans text-[14px] text-black-a60 font-bold leading-[1.25] visited:text-black-a60 hover:visited:text-blue-70" href="https://www.linkedin.com/products?trk=homepage-basic_directory_productsHomeUrl" data-tracking-control-name="homepage-basic_directory_productsHomeUrl" data-tracking-will-navigate> equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="font-sans text-[14px] text-black-a60 font-bold leading-[1.25] visited:text-black-a60 hover:visited:text-blue-70" href="https://www.linkedin.com/salary/?trk=homepage-basic_directory_salaryHomeUrl" data-tracking-control-name="homepage-basic_directory_salaryHomeUrl" data-tracking-will-navigate> equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="font-sans text-[14px] text-black-a60 font-bold leading-[1.25] visited:text-black-a60 hover:visited:text-blue-70" href="https://www.linkedin.com/services?trk=homepage-basic_directory_servicesHomeUrl" data-tracking-control-name="homepage-basic_directory_servicesHomeUrl" data-tracking-will-navigate> equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="font-sans text-[14px] text-black-a60 font-bold leading-[1.25] visited:text-black-a60 hover:visited:text-blue-70" href="https://www.linkedin.com/signup?trk=guest_homepage-basic_directory" data-tracking-control-name="guest_homepage-basic_directory" data-tracking-will-navigate> equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="flex flex-col text-black-a90 hover:text-blue-70 hover:visited:text-blue-70" data-tracking-control-name="homepage-basic_learning-cta" data-tracking-will-navigate href="https://www.linkedin.com/learning/topics/aec?trk=homepage-basic_learning-cta"> equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="flex flex-col text-black-a90 hover:text-blue-70 hover:visited:text-blue-70" data-tracking-control-name="homepage-basic_learning-cta" data-tracking-will-navigate href="https://www.linkedin.com/learning/topics/animation-and-illustration?trk=homepage-basic_learning-cta"> equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="flex flex-col text-black-a90 hover:text-blue-70 hover:visited:text-blue-70" data-tracking-control-name="homepage-basic_learning-cta" data-tracking-will-navigate href="https://www.linkedin.com/learning/topics/artificial-intelligence?trk=homepage-basic_learning-cta"> equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="flex flex-col text-black-a90 hover:text-blue-70 hover:visited:text-blue-70" data-tracking-control-name="homepage-basic_learning-cta" data-tracking-will-navigate href="https://www.linkedin.com/learning/topics/audio-and-music?trk=homepage-basic_learning-cta"> equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="flex flex-col text-black-a90 hover:text-blue-70 hover:visited:text-blue-70" data-tracking-control-name="homepage-basic_learning-cta" data-tracking-will-navigate href="https://www.linkedin.com/learning/topics/business-analysis-and-strategy?trk=homepage-basic_learning-cta"> equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="flex flex-col text-black-a90 hover:text-blue-70 hover:visited:text-blue-70" data-tracking-control-name="homepage-basic_learning-cta" data-tracking-will-navigate href="https://www.linkedin.com/learning/topics/business-software-and-tools?trk=homepage-basic_learning-cta"> equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="flex flex-col text-black-a90 hover:text-blue-70 hover:visited:text-blue-70" data-tracking-control-name="homepage-basic_learning-cta" data-tracking-will-navigate href="https://www.linkedin.com/learning/topics/career-development-5?trk=homepage-basic_learning-cta"> equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="flex flex-col text-black-a90 hover:text-blue-70 hover:visited:text-blue-70" data-tracking-control-name="homepage-basic_learning-cta" data-tracking-will-navigate href="https://www.linkedin.com/learning/topics/cloud-computing-5?trk=homepage-basic_learning-cta"> equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="flex flex-col text-black-a90 hover:text-blue-70 hover:visited:text-blue-70" data-tracking-control-name="homepage-basic_learning-cta" data-tracking-will-navigate href="https://www.linkedin.com/learning/topics/customer-service-3?trk=homepage-basic_learning-cta"> equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="flex flex-col text-black-a90 hover:text-blue-70 hover:visited:text-blue-70" data-tracking-control-name="homepage-basic_learning-cta" data-tracking-will-navigate href="https://www.linkedin.com/learning/topics/data-science?trk=homepage-basic_learning-cta"> equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="flex flex-col text-black-a90 hover:text-blue-70 hover:visited:text-blue-70" data-tracking-control-name="homepage-basic_learning-cta" data-tracking-will-navigate href="https://www.linkedin.com/learning/topics/database-management?trk=homepage-basic_learning-cta"> equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="flex flex-col text-black-a90 hover:text-blue-70 hover:visited:text-blue-70" data-tracking-control-name="homepage-basic_learning-cta" data-tracking-will-navigate href="https://www.linkedin.com/learning/topics/devops?trk=homepage-basic_learning-cta"> equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="flex flex-col text-black-a90 hover:text-blue-70 hover:visited:text-blue-70" data-tracking-control-name="homepage-basic_learning-cta" data-tracking-will-navigate href="https://www.linkedin.com/learning/topics/diversity-equity-and-inclusion-dei?trk=homepage-basic_learning-cta"> equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="flex flex-col text-black-a90 hover:text-blue-70 hover:visited:text-blue-70" data-tracking-control-name="homepage-basic_learning-cta" data-tracking-will-navigate href="https://www.linkedin.com/learning/topics/finance-and-accounting?trk=homepage-basic_learning-cta"> equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="flex flex-col text-black-a90 hover:text-blue-70 hover:visited:text-blue-70" data-tracking-control-name="homepage-basic_learning-cta" data-tracking-will-navigate href="https://www.linkedin.com/learning/topics/graphic-design?trk=homepage-basic_learning-cta"> equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="flex flex-col text-black-a90 hover:text-blue-70 hover:visited:text-blue-70" data-tracking-control-name="homepage-basic_learning-cta" data-tracking-will-navigate href="https://www.linkedin.com/learning/topics/human-resources-3?trk=homepage-basic_learning-cta"> equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="flex flex-col text-black-a90 hover:text-blue-70 hover:visited:text-blue-70" data-tracking-control-name="homepage-basic_learning-cta" data-tracking-will-navigate href="https://www.linkedin.com/learning/topics/it-help-desk-5?trk=homepage-basic_learning-cta"> equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="flex flex-col text-black-a90 hover:text-blue-70 hover:visited:text-blue-70" data-tracking-control-name="homepage-basic_learning-cta" data-tracking-will-navigate href="https://www.linkedin.com/learning/topics/leadership-and-management?trk=homepage-basic_learning-cta"> equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="flex flex-col text-black-a90 hover:text-blue-70 hover:visited:text-blue-70" data-tracking-control-name="homepage-basic_learning-cta" data-tracking-will-navigate href="https://www.linkedin.com/learning/topics/marketing-2?trk=homepage-basic_learning-cta"> equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="flex flex-col text-black-a90 hover:text-blue-70 hover:visited:text-blue-70" data-tracking-control-name="homepage-basic_learning-cta" data-tracking-will-navigate href="https://www.linkedin.com/learning/topics/mobile-development?trk=homepage-basic_learning-cta"> equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="flex flex-col text-black-a90 hover:text-blue-70 hover:visited:text-blue-70" data-tracking-control-name="homepage-basic_learning-cta" data-tracking-will-navigate href="https://www.linkedin.com/learning/topics/motion-graphics-and-vfx?trk=homepage-basic_learning-cta"> equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="flex flex-col text-black-a90 hover:text-blue-70 hover:visited:text-blue-70" data-tracking-control-name="homepage-basic_learning-cta" data-tracking-will-navigate href="https://www.linkedin.com/learning/topics/network-and-system-administration?trk=homepage-basic_learning-cta"> equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="flex flex-col text-black-a90 hover:text-blue-70 hover:visited:text-blue-70" data-tracking-control-name="homepage-basic_learning-cta" data-tracking-will-navigate href="https://www.linkedin.com/learning/topics/photography-2?trk=homepage-basic_learning-cta"> equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="flex flex-col text-black-a90 hover:text-blue-70 hover:visited:text-blue-70" data-tracking-control-name="homepage-basic_learning-cta" data-tracking-will-navigate href="https://www.linkedin.com/learning/topics/product-and-manufacturing?trk=homepage-basic_learning-cta"> equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="flex flex-col text-black-a90 hover:text-blue-70 hover:visited:text-blue-70" data-tracking-control-name="homepage-basic_learning-cta" data-tracking-will-navigate href="https://www.linkedin.com/learning/topics/professional-development?trk=homepage-basic_learning-cta"> equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="flex flex-col text-black-a90 hover:text-blue-70 hover:visited:text-blue-70" data-tracking-control-name="homepage-basic_learning-cta" data-tracking-will-navigate href="https://www.linkedin.com/learning/topics/project-management?trk=homepage-basic_learning-cta"> equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="flex flex-col text-black-a90 hover:text-blue-70 hover:visited:text-blue-70" data-tracking-control-name="homepage-basic_learning-cta" data-tracking-will-navigate href="https://www.linkedin.com/learning/topics/sales-3?trk=homepage-basic_learning-cta"> equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="flex flex-col text-black-a90 hover:text-blue-70 hover:visited:text-blue-70" data-tracking-control-name="homepage-basic_learning-cta" data-tracking-will-navigate href="https://www.linkedin.com/learning/topics/security-3?trk=homepage-basic_learning-cta"> equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="flex flex-col text-black-a90 hover:text-blue-70 hover:visited:text-blue-70" data-tracking-control-name="homepage-basic_learning-cta" data-tracking-will-navigate href="https://www.linkedin.com/learning/topics/small-business-and-entrepreneurship?trk=homepage-basic_learning-cta"> equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="flex flex-col text-black-a90 hover:text-blue-70 hover:visited:text-blue-70" data-tracking-control-name="homepage-basic_learning-cta" data-tracking-will-navigate href="https://www.linkedin.com/learning/topics/software-development?trk=homepage-basic_learning-cta"> equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="flex flex-col text-black-a90 hover:text-blue-70 hover:visited:text-blue-70" data-tracking-control-name="homepage-basic_learning-cta" data-tracking-will-navigate href="https://www.linkedin.com/learning/topics/training-and-education?trk=homepage-basic_learning-cta"> equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="flex flex-col text-black-a90 hover:text-blue-70 hover:visited:text-blue-70" data-tracking-control-name="homepage-basic_learning-cta" data-tracking-will-navigate href="https://www.linkedin.com/learning/topics/user-experience?trk=homepage-basic_learning-cta"> equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="flex flex-col text-black-a90 hover:text-blue-70 hover:visited:text-blue-70" data-tracking-control-name="homepage-basic_learning-cta" data-tracking-will-navigate href="https://www.linkedin.com/learning/topics/video-2?trk=homepage-basic_learning-cta"> equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="flex flex-col text-black-a90 hover:text-blue-70 hover:visited:text-blue-70" data-tracking-control-name="homepage-basic_learning-cta" data-tracking-will-navigate href="https://www.linkedin.com/learning/topics/visualization-and-real-time?trk=homepage-basic_learning-cta"> equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="flex flex-col text-black-a90 hover:text-blue-70 hover:visited:text-blue-70" data-tracking-control-name="homepage-basic_learning-cta" data-tracking-will-navigate href="https://www.linkedin.com/learning/topics/web-design?trk=homepage-basic_learning-cta"> equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="flex flex-col text-black-a90 hover:text-blue-70 hover:visited:text-blue-70" data-tracking-control-name="homepage-basic_learning-cta" data-tracking-will-navigate href="https://www.linkedin.com/learning/topics/web-development?trk=homepage-basic_learning-cta"> equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="nav__button-tertiary btn-md btn-tertiary" href="https://www.linkedin.com/signup?trk=guest_homepage-basic_nav-header-join" data-tracking-control-name="guest_homepage-basic_nav-header-join" data-tracking-will-navigate> equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <p>LinkedIn and 3rd parties use essential and non-essential cookies to provide, secure, analyze and improve our Services, and to show you relevant ads (including <b>professional and job ads</b>) on and off LinkedIn. Learn more in our <a href="https://www.linkedin.com/legal/cookie-policy">Cookie Policy</a>.</p><p>Select Accept to consent or Reject to decline non-essential cookies for this use. You can update your choices at any time in your <a href="https://www.linkedin.com/mypreferences/g/guest-cookies">settings</a>.</p> equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: As of July 1, LinkedIn will no longer support the Internet Explorer 11 browser. LinkedIn recommends the new browser from Microsoft. <u data-control-name="ga.ie11.v1" data-tracking-control-name="ga.ie11.v1"><a href="https://www.microsoft.com/edge?form=MY01K8&OCID=MY01K8">Download now</a></u> equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: hover:text-color-text hover:bg-[#e1dad0]" data-tracking-control-name="homepage-basic_brand-discovery_intent-module-firstBtn" data-tracking-will-navigate href="https://www.linkedin.com/pub/dir/+/+?trk=homepage-basic_brand-discovery_intent-module-firstBtn"> equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: hover:text-color-text hover:bg-[#e1dad0]" data-tracking-control-name="homepage-basic_brand-discovery_intent-module-secondBtn" data-tracking-will-navigate href="https://www.linkedin.com/jobs/jobs-in-h equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: hover:text-color-text hover:bg-[#e1dad0]" data-tracking-control-name="homepage-basic_brand-discovery_intent-module-thirdBtn" data-tracking-will-navigate href="https://www.linkedin.com/learning/search?trk=homepage-basic_brand-discovery_intent-module-thirdBtn"> equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="sign-in-form__join-cta btn-md btn-secondary w-column babybear:w-full block mb-3" href="https://www.linkedin.com/signup" data-test-id="sign-in-join-cta" data-tracking-control-name="homepage-basic_sign-in-form_join-cta" data-tracking-will-navigate> equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <link rel="alternate" hreflang="x-default" href="https://www.linkedin.com/"> equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: sign-in-form__forgot-password--full-width" href="https://www.linkedin.com/uas/request-password-reset?trk=homepage-basic_forgot_password" data-tracking-control-name="homepage-basic_forgot_password" data-tracking-will-navigate>Forgot password?</a> equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <link rel="alternate" hreflang="en" href="https://www.linkedin.com/"> equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <link rel="alternate" hreflang="en-US" href="https://www.linkedin.com/"> equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="btn-md mb-1.5 mr-[6px] flex items-center w-max float-left btn-primary" data-tracking-control-name="homepage-basic_join-cta" data-tracking-will-navigate href="https://www.linkedin.com/signup?trk=homepage-basic_join-cta" aria-describedby="bottom-cta-section__header"> equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="btn-md mb-1.5 mr-[6px] flex items-center w-max float-left btn-secondary" data-tracking-control-name="homepage-basic" data-tracking-will-navigate href="https://www.linkedin.com/pub/dir/+/+?trk=homepage-basic"> equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="btn-md mb-1.5 mr-[6px] flex items-center w-max float-left btn-secondary" data-tracking-control-name="homepage-basic_explore-content_topic-pill" data-tracking-will-navigate href="https://www.linkedin.com/pulse/topics/business-administration-s50111/"> equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="btn-md mb-1.5 mr-[6px] flex items-center w-max float-left btn-secondary" data-tracking-control-name="homepage-basic_explore-content_topic-pill" data-tracking-will-navigate href="https://www.linkedin.com/pulse/topics/construction-management-s831/"> equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="btn-md mb-1.5 mr-[6px] flex items-center w-max float-left btn-secondary" data-tracking-control-name="homepage-basic_explore-content_topic-pill" data-tracking-will-navigate href="https://www.linkedin.com/pulse/topics/engineering-s166/"> equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="btn-md mb-1.5 mr-[6px] flex items-center w-max float-left btn-secondary" data-tracking-control-name="homepage-basic_explore-content_topic-pill" data-tracking-will-navigate href="https://www.linkedin.com/pulse/topics/healthcare-s282/"> equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="btn-md mb-1.5 mr-[6px] flex items-center w-max float-left btn-secondary" data-tracking-control-name="homepage-basic_explore-content_topic-pill" data-tracking-will-navigate href="https://www.linkedin.com/pulse/topics/it-services-s57547/"> equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="btn-md mb-1.5 mr-[6px] flex items-center w-max float-left btn-secondary" data-tracking-control-name="homepage-basic_explore-content_topic-pill" data-tracking-will-navigate href="https://www.linkedin.com/pulse/topics/marketing-s2461/"> equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="btn-md mb-1.5 mr-[6px] flex items-center w-max float-left btn-secondary" data-tracking-control-name="homepage-basic_explore-content_topic-pill" data-tracking-will-navigate href="https://www.linkedin.com/pulse/topics/public-administration-s3697/"> equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="btn-md mb-1.5 mr-[6px] flex items-center w-max float-left btn-secondary" data-tracking-control-name="homepage-basic_explore-content_topic-pill" data-tracking-will-navigate href="https://www.linkedin.com/pulse/topics/sustainability-s932/"> equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="btn-md mb-1.5 mr-[6px] flex items-center w-max float-left btn-secondary" data-tracking-control-name="homepage-basic_explore-content_topic-pill" data-tracking-will-navigate href="https://www.linkedin.com/pulse/topics/telecommunications-s314/"> equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="btn-md mb-1.5 mr-[6px] flex items-center w-max float-left btn-secondary" data-tracking-control-name="homepage-basic_suggested-search" data-tracking-will-navigate href="https://www.linkedin.com/jobs/accounting-jobs-h equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="btn-md mb-1.5 mr-[6px] flex items-center w-max float-left btn-secondary" data-tracking-control-name="homepage-basic_suggested-search" data-tracking-will-navigate href="https://www.linkedin.com/jobs/administrative-assistant-jobs-h equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="btn-md mb-1.5 mr-[6px] flex items-center w-max float-left btn-secondary" data-tracking-control-name="homepage-basic_suggested-search" data-tracking-will-navigate href="https://www.linkedin.com/jobs/administrative-jobs-h equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="btn-md mb-1.5 mr-[6px] flex items-center w-max float-left btn-secondary" data-tracking-control-name="homepage-basic_suggested-search" data-tracking-will-navigate href="https://www.linkedin.com/jobs/arts-and-design-jobs-h equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="btn-md mb-1.5 mr-[6px] flex items-center w-max float-left btn-secondary" data-tracking-control-name="homepage-basic_suggested-search" data-tracking-will-navigate href="https://www.linkedin.com/jobs/business-development-jobs-h equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="btn-md mb-1.5 mr-[6px] flex items-center w-max float-left btn-secondary" data-tracking-control-name="homepage-basic_suggested-search" data-tracking-will-navigate href="https://www.linkedin.com/jobs/community-and-social-services-jobs-h equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="btn-md mb-1.5 mr-[6px] flex items-center w-max float-left btn-secondary" data-tracking-control-name="homepage-basic_suggested-search" data-tracking-will-navigate href="https://www.linkedin.com/jobs/consulting-jobs-h equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="btn-md mb-1.5 mr-[6px] flex items-center w-max float-left btn-secondary" data-tracking-control-name="homepage-basic_suggested-search" data-tracking-will-navigate href="https://www.linkedin.com/jobs/customer-service-jobs-h equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="btn-md mb-1.5 mr-[6px] flex items-center w-max float-left btn-secondary" data-tracking-control-name="homepage-basic_suggested-search" data-tracking-will-navigate href="https://www.linkedin.com/jobs/education-jobs-h equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="btn-md mb-1.5 mr-[6px] flex items-center w-max float-left btn-secondary" data-tracking-control-name="homepage-basic_suggested-search" data-tracking-will-navigate href="https://www.linkedin.com/jobs/engineering-jobs-h equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="btn-md mb-1.5 mr-[6px] flex items-center w-max float-left btn-secondary" data-tracking-control-name="homepage-basic_suggested-search" data-tracking-will-navigate href="https://www.linkedin.com/jobs/entrepreneurship-jobs-h equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="btn-md mb-1.5 mr-[6px] flex items-center w-max float-left btn-secondary" data-tracking-control-name="homepage-basic_suggested-search" data-tracking-will-navigate href="https://www.linkedin.com/jobs/finance-jobs-h equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="btn-md mb-1.5 mr-[6px] flex items-center w-max float-left btn-secondary" data-tracking-control-name="homepage-basic_suggested-search" data-tracking-will-navigate href="https://www.linkedin.com/jobs/healthcare-services-jobs-h equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="btn-md mb-1.5 mr-[6px] flex items-center w-max float-left btn-secondary" data-tracking-control-name="homepage-basic_suggested-search" data-tracking-will-navigate href="https://www.linkedin.com/jobs/human-resources-jobs-h equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="btn-md mb-1.5 mr-[6px] flex items-center w-max float-left btn-secondary" data-tracking-control-name="homepage-basic_suggested-search" data-tracking-will-navigate href="https://www.linkedin.com/jobs/information-technology-jobs-h equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="btn-md mb-1.5 mr-[6px] flex items-center w-max float-left btn-secondary" data-tracking-control-name="homepage-basic_suggested-search" data-tracking-will-navigate href="https://www.linkedin.com/jobs/legal-jobs-h equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="btn-md mb-1.5 mr-[6px] flex items-center w-max float-left btn-secondary" data-tracking-control-name="homepage-basic_suggested-search" data-tracking-will-navigate href="https://www.linkedin.com/jobs/marketing-jobs-h equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="btn-md mb-1.5 mr-[6px] flex items-center w-max float-left btn-secondary" data-tracking-control-name="homepage-basic_suggested-search" data-tracking-will-navigate href="https://www.linkedin.com/jobs/media-and-communications-jobs-h equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="btn-md mb-1.5 mr-[6px] flex items-center w-max float-left btn-secondary" data-tracking-control-name="homepage-basic_suggested-search" data-tracking-will-navigate href="https://www.linkedin.com/jobs/military-and-protective-services-jobs-h equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="btn-md mb-1.5 mr-[6px] flex items-center w-max float-left btn-secondary" data-tracking-control-name="homepage-basic_suggested-search" data-tracking-will-navigate href="https://www.linkedin.com/jobs/operations-jobs-h equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="btn-md mb-1.5 mr-[6px] flex items-center w-max float-left btn-secondary" data-tracking-control-name="homepage-basic_suggested-search" data-tracking-will-navigate href="https://www.linkedin.com/jobs/product-management-jobs-h equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="btn-md mb-1.5 mr-[6px] flex items-center w-max float-left btn-secondary" data-tracking-control-name="homepage-basic_suggested-search" data-tracking-will-navigate href="https://www.linkedin.com/jobs/program-and-project-management-jobs-h equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="btn-md mb-1.5 mr-[6px] flex items-center w-max float-left btn-secondary" data-tracking-control-name="homepage-basic_suggested-search" data-tracking-will-navigate href="https://www.linkedin.com/jobs/purchasing-jobs-h equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="btn-md mb-1.5 mr-[6px] flex items-center w-max float-left btn-secondary" data-tracking-control-name="homepage-basic_suggested-search" data-tracking-will-navigate href="https://www.linkedin.com/jobs/quality-assurance-jobs-h equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="btn-md mb-1.5 mr-[6px] flex items-center w-max float-left btn-secondary" data-tracking-control-name="homepage-basic_suggested-search" data-tracking-will-navigate href="https://www.linkedin.com/jobs/real-estate-jobs-h equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="btn-md mb-1.5 mr-[6px] flex items-center w-max float-left btn-secondary" data-tracking-control-name="homepage-basic_suggested-search" data-tracking-will-navigate href="https://www.linkedin.com/jobs/research-jobs-h equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="btn-md mb-1.5 mr-[6px] flex items-center w-max float-left btn-secondary" data-tracking-control-name="homepage-basic_suggested-search" data-tracking-will-navigate href="https://www.linkedin.com/jobs/retail-associate-jobs-h equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="btn-md mb-1.5 mr-[6px] flex items-center w-max float-left btn-secondary" data-tracking-control-name="homepage-basic_suggested-search" data-tracking-will-navigate href="https://www.linkedin.com/jobs/sales-jobs-h equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="btn-md mb-1.5 mr-[6px] flex items-center w-max float-left btn-secondary" data-tracking-control-name="homepage-basic_suggested-search" data-tracking-will-navigate href="https://www.linkedin.com/jobs/support-jobs-h equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="btn-md mb-1.5 mr-[6px] flex items-center w-max float-left btn-secondary-emphasis flex-shrink babybear:my-auto babybear:mx-[0px]" data-tracking-control-name="homepage-basic_talent-finder-cta" data-tracking-will-navigate href="https://www.linkedin.com/talent/post-a-job?trk=homepage-basic_talent-finder-cta"> equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="btn-md mb-1.5 mr-[6px] flex items-center w-max float-left btn-secondary-emphasis" data-tracking-control-name="homepage-basic_explore-content_topic-pill" data-tracking-will-navigate href="https://www.linkedin.com/pulse/topics/home/"> equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="li-footer__item-link flex items-center font-sans text-xs font-bold text-color-text-low-emphasis hover:text-color-link-hover focus:text-color-link-focus" href="https://www.linkedin.com/accessibility?trk=homepage-basic_footer-accessibility" data-tracking-control-name="homepage-basic_footer-accessibility" data-tracking-will-navigate> equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="li-footer__item-link flex items-center font-sans text-xs font-bold text-color-text-low-emphasis hover:text-color-link-hover focus:text-color-link-focus" href="https://www.linkedin.com/legal/cookie-policy?trk=homepage-basic_footer-cookie-policy" data-tracking-control-name="homepage-basic_footer-cookie-policy" data-tracking-will-navigate> equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="li-footer__item-link flex items-center font-sans text-xs font-bold text-color-text-low-emphasis hover:text-color-link-hover focus:text-color-link-focus" href="https://www.linkedin.com/legal/copyright-policy?trk=homepage-basic_footer-copyright-policy" data-tracking-control-name="homepage-basic_footer-copyright-policy" data-tracking-will-navigate> equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="li-footer__item-link flex items-center font-sans text-xs font-bold text-color-text-low-emphasis hover:text-color-link-hover focus:text-color-link-focus" href="https://www.linkedin.com/legal/privacy-policy?trk=homepage-basic_footer-privacy-policy" data-tracking-control-name="homepage-basic_footer-privacy-policy" data-tracking-will-navigate> equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="li-footer__item-link flex items-center font-sans text-xs font-bold text-color-text-low-emphasis hover:text-color-link-hover focus:text-color-link-focus" href="https://www.linkedin.com/legal/professional-community-policies?trk=homepage-basic_footer-community-guide" data-tracking-control-name="homepage-basic_footer-community-guide" data-tracking-will-navigate> equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="li-footer__item-link flex items-center font-sans text-xs font-bold text-color-text-low-emphasis hover:text-color-link-hover focus:text-color-link-focus" href="https://www.linkedin.com/legal/user-agreement?trk=homepage-basic_footer-user-agreement" data-tracking-control-name="homepage-basic_footer-user-agreement" data-tracking-will-navigate> equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="li-footer__item-link flex items-center font-sans text-xs font-bold text-color-text-low-emphasis hover:text-color-link-hover focus:text-color-link-focus" href="https://www.linkedin.com/psettings/guest-controls?trk=homepage-basic_footer-guest-controls" data-tracking-control-name="homepage-basic_footer-guest-controls" data-tracking-will-navigate> equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <link rel="canonical" href="https://www.linkedin.com/"> equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="nav__button-secondary btn-md btn-secondary-emphasis" href="https://www.linkedin.com/login?fromSignIn=true&trk=guest_homepage-basic_nav-header-signin" data-tracking-control-name="guest_homepage-basic_nav-header-signin" data-tracking-will-navigate> equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a href="https://www.linkedin.com/jobs/search?trk=guest_homepage-basic_guest_nav_menu_jobs" data-tracking-control-name="guest_homepage-basic_guest_nav_menu_jobs" data-tracking-will-navigate class="top-nav-link flex justify-center items-center h-[52px] hover:text-color-text visited:hover:text-color-text hover:no-underline equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a href="https://www.linkedin.com/learning/search?trk=guest_homepage-basic_guest_nav_menu_learning" data-tracking-control-name="guest_homepage-basic_guest_nav_menu_learning" data-tracking-will-navigate class="top-nav-link flex justify-center items-center h-[52px] hover:text-color-text visited:hover:text-color-text hover:no-underline equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a href="https://www.linkedin.com/pub/dir/+/+?trk=guest_homepage-basic_guest_nav_menu_people" data-tracking-control-name="guest_homepage-basic_guest_nav_menu_people" data-tracking-will-navigate class="top-nav-link flex justify-center items-center h-[52px] hover:text-color-text visited:hover:text-color-text hover:no-underline equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a href="https://www.linkedin.com/pulse/topics/home/?trk=guest_homepage-basic_guest_nav_menu_articles" data-tracking-control-name="guest_homepage-basic_guest_nav_menu_articles" data-tracking-will-navigate class="top-nav-link flex justify-center items-center h-[52px] hover:text-color-text visited:hover:text-color-text hover:no-underline equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <form class="google-one-tap" action="https://www.linkedin.com/uas/login-submit" method="post"> equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <form class="google-sign-in-cta-widget" action="https://www.linkedin.com/uas/login-submit" method="post" novalidate> equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <form data-id="sign-in-form" action="https://www.linkedin.com/uas/login-submit" method="post" novalidate data-js-module-id="d2l-sign-in-form"> equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <meta property="og:url" content="https://www.linkedin.com/"> equals www.linkedin.com (Linkedin)

Source: 77EC63BDA74BD0D0E0426DC8F80085060.31.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: Amcache.hve.9.dr	String found in binary or memory: http://upx.sf.net
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://about.linkedin.com/?trk=homepage-basic_directory_aboutUrl
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://about.linkedin.com?trk=homepage-basic_footer-about
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://ae.linkedin.com/
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://ar.linkedin.com/
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://at.linkedin.com/
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://au.linkedin.com/
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://blog.linkedin.com/?trk=homepage-basic_directory_blogMicrositeUrl
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://bo.linkedin.com/
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://br.linkedin.com/
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://brand.linkedin.com/policies?trk=homepage-basic_footer-brand-policy
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://business.linkedin.com/marketing-solutions?src=li-footer&utm_source=linkedin&utm_medi
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://business.linkedin.com/sales-solutions?src=li-footer&utm_source=linkedin&utm_medium=f
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://business.linkedin.com/talent-solutions?src=li-footer&utm_source=linkedin&utm_medium=
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://ca.linkedin.com/
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://ch.linkedin.com/
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://cl.linkedin.com/
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://cn.linkedin.com/
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://co.linkedin.com/
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://cr.linkedin.com/
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://cz.linkedin.com/
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://de.linkedin.com/
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://developer.linkedin.com/?trk=homepage-basic_directory_developerMicrositeUrl
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://dk.linkedin.com/
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://do.linkedin.com/
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://ec.linkedin.com/
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://es.linkedin.com/
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://fr.linkedin.com/
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://gh.linkedin.com/
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://gt.linkedin.com/
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://hk.linkedin.com/
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://id.linkedin.com/
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://ie.linkedin.com/
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://il.linkedin.com/
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://in.linkedin.com/
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://it.linkedin.com/
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://jm.linkedin.com/
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://jp.linkedin.com/
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://ke.linkedin.com/
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://kr.linkedin.com/
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://learning.linkedin.com/?src=li-footer&trk=homepage-basic_directory_learningMicrositeUrl
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://lu.linkedin.com/
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://mobile.linkedin.com/?trk=homepage-basic_directory_mobileMicrositeUrl
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://mx.linkedin.com/
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://my.linkedin.com/
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://ng.linkedin.com/
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://nl.linkedin.com/
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://no.linkedin.com/
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://nz.linkedin.com/
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://pa.linkedin.com/
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://pe.linkedin.com/
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://ph.linkedin.com/
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://pk.linkedin.com/
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://pl.linkedin.com/
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://pr.linkedin.com/
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://press.linkedin.com/?trk=homepage-basic_directory_pressMicrositeUrl
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://pt.linkedin.com/
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://ro.linkedin.com/
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://ru.linkedin.com/
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://se.linkedin.com/
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://sg.linkedin.com/
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://static.licdn.com/aero-v1/sc/h/292yd0en6qdvkbezeuj71yu4y
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://static.licdn.com/aero-v1/sc/h/2r8kd5zqpi905lkzsshdlvvn5
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://static.licdn.com/aero-v1/sc/h/36lpn9v7fqsm6i7t6ny8bgacs
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://static.licdn.com/aero-v1/sc/h/3l4csbmaa6sv4gtsledhbu9lq
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://static.licdn.com/aero-v1/sc/h/4chtt12k98xwnba1nimld2oyg
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://static.licdn.com/aero-v1/sc/h/51t74mlo1ty7vakn3a80a9jcp
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://static.licdn.com/aero-v1/sc/h/5mic7em4akle2l5km6kwwo2hf
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://static.licdn.com/aero-v1/sc/h/6ulnj3n2ijcmhej768y6oj1hr
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://static.licdn.com/aero-v1/sc/h/75y9ng27ydl2d46fam5nanne5
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://static.licdn.com/aero-v1/sc/h/7asbl4deqijhoy3z2ivveispv
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://static.licdn.com/aero-v1/sc/h/7kb6sn3tm4cx918cx9a5jlb0
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://static.licdn.com/aero-v1/sc/h/8fkga714vy9b2wk5auqo5reeb
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://static.licdn.com/aero-v1/sc/h/8vttiljf33oqe5y4btpnhov3u
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://static.licdn.com/aero-v1/sc/h/8wykgzgbqy0t3fnkgborvz54u
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://static.licdn.com/aero-v1/sc/h/92eb1xekc34eklevj0io6x4ki
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://static.licdn.com/aero-v1/sc/h/98lptr8kagfxge22q7k1fps8
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://static.licdn.com/aero-v1/sc/h/al2o9zrvru7aqj8e1x2rzsrca
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://static.licdn.com/aero-v1/sc/h/ann24vsq7r0ux3vipqa1n90gg
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://static.licdn.com/aero-v1/sc/h/b0sinzszgdrksde0dzc0leckm
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://static.licdn.com/aero-v1/sc/h/b1fxwht7hdbeusleja7ciftsj
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://static.licdn.com/aero-v1/sc/h/c9dcz2pyrbwi3sr6xwxigmvlz
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://static.licdn.com/aero-v1/sc/h/cyolgscd0imw2ldqppkrb84vo
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://static.licdn.com/aero-v1/sc/h/dbvmk0tsk0o0hd59fi64z3own
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://static.licdn.com/aero-v1/sc/h/ddi43qwelxeqjxdd45pe3fvs1
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://static.licdn.com/aero-v1/sc/h/dkfub4sc7jgzg3o31flfr91rv
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://static.licdn.com/aero-v1/sc/h/dxf91zhqd2z6b0bwg85ktm5s4
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://static.licdn.com/aero-v1/sc/h/e12h2cd8ac580qen9qdd0qks8
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://static.licdn.com/aero-v1/sc/h/e5ka7p8s9n5r0z9p6kpmm3hig
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://static.licdn.com/aero-v1/sc/h/etkd25e7kzp2lrg1w9y0kixlu
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://static.licdn.com/scds/common/u/images/logos/favicons/v1/favicon.ico
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://sv.linkedin.com/
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://th.linkedin.com/
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://tr.linkedin.com/
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://tt.linkedin.com/
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://tw.linkedin.com/
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://uk.linkedin.com/
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://uy.linkedin.com/
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://ve.linkedin.com/
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/accessibility?trk=homepage-basic_footer-accessibility
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/company/linkedin/jobs?trk=homepage-basic_directory_careersUrl
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/directory/advice?trk=homepage-basic_directory_adviceDirectoryUrl
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/directory/articles?trk=homepage-basic_directory_articlesDirectoryUrl
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/directory/companies?trk=homepage-basic_directory_companyDirectoryUrl
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/directory/featured?trk=homepage-basic_directory_featuredDirectoryUrl
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/directory/jobs?trk=homepage-basic_directory_jobSearchDirectoryUrl
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/directory/learning?trk=homepage-basic_directory_learningDirectoryUrl
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/directory/news?trk=homepage-basic_directory_newsDirectoryUrl
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/directory/newsletters?trk=homepage-basic_directory_newslettersDirectoryUrl
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/directory/people-search?trk=homepage-basic_directory_peopleSearchDirectoryU
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/directory/people?trk=homepage-basic_directory_peopleDirectoryUrl
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/directory/posts?trk=homepage-basic_directory_postsDirectoryUrl
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/directory/products?trk=homepage-basic_directory_productsDirectoryUrl
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/directory/schools?trk=homepage-basic_directory_schoolsDirectoryUrl
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/directory/services?trk=homepage-basic_directory_servicesDirectoryUrl
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/help/linkedin?lang=en&trk=homepage-basic_directory_helpCenterUrl
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/jobs/accounting-jobs-h
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/jobs/administrative-assistant-jobs-h
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/jobs/administrative-jobs-h
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/jobs/arts-and-design-jobs-h
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/jobs/business-development-jobs-h
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/jobs/community-and-social-services-jobs-h
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/jobs/consulting-jobs-h
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/jobs/customer-service-jobs-h
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/jobs/education-jobs-h
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/jobs/engineering-jobs-h
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/jobs/entrepreneurship-jobs-h
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/jobs/finance-jobs-h
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/jobs/healthcare-services-jobs-h
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/jobs/human-resources-jobs-h
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/jobs/information-technology-jobs-h
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/jobs/jobs-in-h
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/jobs/legal-jobs-h
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/jobs/marketing-jobs-h
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/jobs/media-and-communications-jobs-h
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/jobs/military-and-protective-services-jobs-h
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/jobs/operations-jobs-h
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/jobs/product-management-jobs-h
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/jobs/program-and-project-management-jobs-h
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/jobs/purchasing-jobs-h
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/jobs/quality-assurance-jobs-h
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/jobs/real-estate-jobs-h
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/jobs/research-jobs-h
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/jobs/retail-associate-jobs-h
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/jobs/sales-jobs-h
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/jobs/search?trk=guest_homepage-basic_guest_nav_menu_jobs
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/jobs/support-jobs-h
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/jobs?trk=homepage-basic_directory_jobsHomeUrl
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/learning/?trk=homepage-basic_directory_learningHomeUrl
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/learning/search?trk=guest_homepage-basic_guest_nav_menu_learning
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/learning/search?trk=homepage-basic_brand-discovery_intent-module-thirdBtn
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/learning/topics/aec?trk=homepage-basic_learning-cta
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/learning/topics/animation-and-illustration?trk=homepage-basic_learning-cta
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/learning/topics/artificial-intelligence?trk=homepage-basic_learning-cta
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/learning/topics/audio-and-music?trk=homepage-basic_learning-cta
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/learning/topics/business-analysis-and-strategy?trk=homepage-basic_learning-
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/learning/topics/business-software-and-tools?trk=homepage-basic_learning-cta
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/learning/topics/career-development-5?trk=homepage-basic_learning-cta
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/learning/topics/cloud-computing-5?trk=homepage-basic_learning-cta
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/learning/topics/customer-service-3?trk=homepage-basic_learning-cta
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/learning/topics/data-science?trk=homepage-basic_learning-cta
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/learning/topics/database-management?trk=homepage-basic_learning-cta
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/learning/topics/devops?trk=homepage-basic_learning-cta
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/learning/topics/diversity-equity-and-inclusion-dei?trk=homepage-basic_learn
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/learning/topics/finance-and-accounting?trk=homepage-basic_learning-cta
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/learning/topics/graphic-design?trk=homepage-basic_learning-cta
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/learning/topics/human-resources-3?trk=homepage-basic_learning-cta
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/learning/topics/it-help-desk-5?trk=homepage-basic_learning-cta
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/learning/topics/leadership-and-management?trk=homepage-basic_learning-cta
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/learning/topics/marketing-2?trk=homepage-basic_learning-cta
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/learning/topics/mobile-development?trk=homepage-basic_learning-cta
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/learning/topics/motion-graphics-and-vfx?trk=homepage-basic_learning-cta
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/learning/topics/network-and-system-administration?trk=homepage-basic_learni
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/learning/topics/photography-2?trk=homepage-basic_learning-cta
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/learning/topics/product-and-manufacturing?trk=homepage-basic_learning-cta
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/learning/topics/professional-development?trk=homepage-basic_learning-cta
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/learning/topics/project-management?trk=homepage-basic_learning-cta
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/learning/topics/sales-3?trk=homepage-basic_learning-cta
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/learning/topics/security-3?trk=homepage-basic_learning-cta
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/learning/topics/small-business-and-entrepreneurship?trk=homepage-basic_lear
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/learning/topics/software-development?trk=homepage-basic_learning-cta
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/learning/topics/training-and-education?trk=homepage-basic_learning-cta
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/learning/topics/user-experience?trk=homepage-basic_learning-cta
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/learning/topics/video-2?trk=homepage-basic_learning-cta
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/learning/topics/visualization-and-real-time?trk=homepage-basic_learning-cta
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/learning/topics/web-design?trk=homepage-basic_learning-cta
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/learning/topics/web-development?trk=homepage-basic_learning-cta
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/legal/cookie-policy
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/legal/cookie-policy?trk=homepage-basic_footer-cookie-policy
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/legal/copyright-policy?trk=homepage-basic_footer-copyright-policy
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/legal/privacy-policy?trk=homepage-basic_footer-privacy-policy
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/legal/professional-community-policies?trk=homepage-basic_footer-community-g
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/legal/user-agreement?trk=homepage-basic_footer-user-agreement
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/login?fromSignIn=true&trk=guest_homepage-basic_nav-header-signin
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/mypreferences/g/guest-cookies
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/products?trk=homepage-basic_directory_productsHomeUrl
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/psettings/guest-controls?trk=homepage-basic_footer-guest-controls
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/pub/dir/
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/pulse/topics/business-administration-s50111/
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/pulse/topics/construction-management-s831/
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/pulse/topics/engineering-s166/
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/pulse/topics/healthcare-s282/
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/pulse/topics/home/
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/pulse/topics/home/?trk=guest_homepage-basic_guest_nav_menu_articles
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/pulse/topics/it-services-s57547/
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/pulse/topics/marketing-s2461/
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/pulse/topics/public-administration-s3697/
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/pulse/topics/sustainability-s932/
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/pulse/topics/telecommunications-s314/
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/salary/?trk=homepage-basic_directory_salaryHomeUrl
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/services?trk=homepage-basic_directory_servicesHomeUrl
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/signup
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/signup?trk=guest_homepage-basic_directory
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/signup?trk=guest_homepage-basic_nav-header-join
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/signup?trk=homepage-basic_join-cta
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/talent/post-a-job?trk=homepage-basic_talent-finder-cta
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/uas/login-submit
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/uas/request-password-reset?trk=homepage-basic_forgot_password
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://za.linkedin.com/
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://zw.linkedin.com/

Source: unknown

DNS traffic detected: queries for: linkedin.com

Source: loaddll32.exe, 00000000.00000002.393798325.0000000000CCB000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

Source: photographed.dat.dll

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE, DLL

Source: 19.2.rundll32.exe.cf0968.0.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_QakBot_ConfigExtraction_Feb23 cape_options = bp0=$params+23,action0=setdump:eax::ecx,bp1=$c2list1+40,bp1=$c2list2+38,action1=dump,bp2=$conf+13,action2=dump,count=1,typestring=QakBot Config, date = 2023-02-17, author = kevoreilly, description = QakBot Config Extraction, reference = https://github.com/kevoreilly/CAPEv2/blob/master/analyzer/windows/data/yara/QakBot.yar, license = https://github.com/kevoreilly/CAPEv2/blob/master/LICENSE, packed = f084d87078a1e4b0ee208539c53e4853a52b5698e98f0578d7c12948e3831a68
Source: 19.2.rundll32.exe.ef0000.1.unpack, type: UNPACKEDPE	Matched rule: MAL_QakBot_ConfigExtraction_Feb23 cape_options = bp0=$params+23,action0=setdump:eax::ecx,bp1=$c2list1+40,bp1=$c2list2+38,action1=dump,bp2=$conf+13,action2=dump,count=1,typestring=QakBot Config, date = 2023-02-17, author = kevoreilly, description = QakBot Config Extraction, reference = https://github.com/kevoreilly/CAPEv2/blob/master/analyzer/windows/data/yara/QakBot.yar, license = https://github.com/kevoreilly/CAPEv2/blob/master/LICENSE, packed = f084d87078a1e4b0ee208539c53e4853a52b5698e98f0578d7c12948e3831a68
Source: 19.2.rundll32.exe.cf0968.0.unpack, type: UNPACKEDPE	Matched rule: MAL_QakBot_ConfigExtraction_Feb23 cape_options = bp0=$params+23,action0=setdump:eax::ecx,bp1=$c2list1+40,bp1=$c2list2+38,action1=dump,bp2=$conf+13,action2=dump,count=1,typestring=QakBot Config, date = 2023-02-17, author = kevoreilly, description = QakBot Config Extraction, reference = https://github.com/kevoreilly/CAPEv2/blob/master/analyzer/windows/data/yara/QakBot.yar, license = https://github.com/kevoreilly/CAPEv2/blob/master/LICENSE, packed = f084d87078a1e4b0ee208539c53e4853a52b5698e98f0578d7c12948e3831a68

Source: C:\Windows\SysWOW64\rundll32.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5684 -s 660

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\Windows\AppCompat\Programs\Amcache.hve.tmp

Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_1001F0A7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_10001556
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_1001B611
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_1001861E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_10018E04
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_00F071FF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_00F08D30
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_00F04A6F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_00EF3A40
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_00F06E40
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_00F0320D

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: String function: 10028D98 appears 138 times
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: String function: 10028D18 appears 37 times
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: String function: 10007CBB appears 66 times

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_00EFA823 GetThreadContext,NtProtectVirtualMemory,NtWriteVirtualMemory,NtProtectVirtualMemory,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_00EFA412 NtAllocateVirtualMemory,NtWriteVirtualMemory,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_00EFCA0F NtAllocateVirtualMemory,NtWriteVirtualMemory,NtProtectVirtualMemory,NtFreeVirtualMemory,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_00F043F4 NtProtectVirtualMemory,NtProtectVirtualMemory,

Source: photographed.dat.dll

Binary or memory string: OriginalFilenameconcrt140.dll^ vs photographed.dat.dll

Source: C:\Windows\SysWOW64\wermgr.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\SysWOW64\wermgr.exe	Section loaded: winhttp.dll
Source: C:\Windows\SysWOW64\wermgr.exe	Section loaded: mswsock.dll
Source: C:\Windows\SysWOW64\wermgr.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\SysWOW64\wermgr.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\SysWOW64\wermgr.exe	Section loaded: schannel.dll
Source: C:\Windows\SysWOW64\wermgr.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\SysWOW64\wermgr.exe	Section loaded: ncrypt.dll
Source: C:\Windows\SysWOW64\wermgr.exe	Section loaded: ntasn1.dll
Source: C:\Windows\SysWOW64\wermgr.exe	Section loaded: dpapi.dll
Source: C:\Windows\SysWOW64\wermgr.exe	Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\wermgr.exe	Section loaded: rsaenh.dll
Source: C:\Windows\SysWOW64\wermgr.exe	Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\wermgr.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\SysWOW64\wermgr.exe	Section loaded: cryptnet.dll
Source: C:\Windows\SysWOW64\wermgr.exe	Section loaded: webio.dll
Source: C:\Windows\SysWOW64\wermgr.exe	Section loaded: cabinet.dll
Source: C:\Windows\SysWOW64\wermgr.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll

Source: photographed.dat.dll

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\loaddll32.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: unknown	Process created: C:\Windows\System32\loaddll32.exe loaddll32.exe "C:\Users\user\Desktop\photographed.dat.dll"
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\photographed.dat.dll",#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\photographed.dat.dll,m?0?$_SpinWait@$00@details@Concurrency@@QAE@P6AXXZ@Z
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\photographed.dat.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5684 -s 660
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7136 -s 664
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\photographed.dat.dll,m?0?$_SpinWait@$0A@@details@Concurrency@@QAE@P6AXXZ@Z
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 3108 -s 652
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\photographed.dat.dll,m?0SchedulerPolicy@Concurrency@@QAA@IZZ
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7216 -s 648
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\photographed.dat.dll",m?0?$_SpinWait@$00@details@Concurrency@@QAE@P6AXXZ@Z
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\photographed.dat.dll",m?0?$_SpinWait@$0A@@details@Concurrency@@QAE@P6AXXZ@Z
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\photographed.dat.dll",m?0SchedulerPolicy@Concurrency@@QAA@IZZ
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\photographed.dat.dll",next
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\photographed.dat.dll",mwait_for_multiple@event@Concurrency@@SAIPAPAV12@I_NI@Z
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\photographed.dat.dll",mwait_for_all@agent@Concurrency@@SAXIPAPAV12@PAW4agent_status@2@I@Z
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7332 -s 652
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7340 -s 652
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7348 -s 648
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7416 -s 648
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\wermgr.exe C:\Windows\SysWOW64\wermgr.exe
Source: C:\Windows\SysWOW64\wermgr.exe	Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /all
Source: C:\Windows\SysWOW64\ipconfig.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\wermgr.exe	Process created: C:\Windows\SysWOW64\whoami.exe whoami /all
Source: C:\Windows\SysWOW64\whoami.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\photographed.dat.dll",#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\photographed.dat.dll,m?0?$_SpinWait@$00@details@Concurrency@@QAE@P6AXXZ@Z
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\photographed.dat.dll,m?0?$_SpinWait@$0A@@details@Concurrency@@QAE@P6AXXZ@Z
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\photographed.dat.dll,m?0SchedulerPolicy@Concurrency@@QAA@IZZ
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\photographed.dat.dll",m?0?$_SpinWait@$00@details@Concurrency@@QAE@P6AXXZ@Z
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\photographed.dat.dll",m?0?$_SpinWait@$0A@@details@Concurrency@@QAE@P6AXXZ@Z
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\photographed.dat.dll",m?0SchedulerPolicy@Concurrency@@QAA@IZZ
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\photographed.dat.dll",next
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\photographed.dat.dll",mwait_for_multiple@event@Concurrency@@SAIPAPAV12@I_NI@Z
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\photographed.dat.dll",mwait_for_all@agent@Concurrency@@SAXIPAPAV12@PAW4agent_status@2@I@Z
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\photographed.dat.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\wermgr.exe C:\Windows\SysWOW64\wermgr.exe
Source: C:\Windows\SysWOW64\wermgr.exe	Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /all
Source: C:\Windows\SysWOW64\wermgr.exe	Process created: C:\Windows\SysWOW64\whoami.exe whoami /all

Source: C:\Windows\SysWOW64\wermgr.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Processor

Source: C:\Windows\SysWOW64\wermgr.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Hzieoyw

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\WERB3A.tmp

Jump to behavior

Source: classification engine

Classification label: mal100.troj.evad.winDLL@41/40@2/100

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 19_2_00EFD213 CoInitializeEx,CoInitializeSecurity,CoCreateInstance,SysAllocString,CoSetProxyBlanket,

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 19_2_00EFC71C CreateToolhelp32Snapshot,Process32First,FindCloseChangeNotification,

Source: C:\Windows\System32\loaddll32.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\photographed.dat.dll,m?0?$_SpinWait@$00@details@Concurrency@@QAE@P6AXXZ@Z

Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7340
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5728:120:WilError_01
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7332
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7716:120:WilError_01
Source: C:\Windows\SysWOW64\wermgr.exe	Mutant created: \Sessions\1\BaseNamedObjects\{016655F6-264F-4E93-A1D9-EE4A14235942}
Source: C:\Windows\SysWOW64\wermgr.exe	Mutant created: \Sessions\1\BaseNamedObjects\{0A87EE2C-EEEA-4776-9B9D-42DC07D139F4}
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess3108
Source: C:\Windows\SysWOW64\wermgr.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\{016655F6-264F-4E93-A1D9-EE4A14235942}
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1708:120:WilError_01
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess5684
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7216
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7348
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7136
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7416

Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\SysWOW64\wermgr.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\SysWOW64\wermgr.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\SysWOW64\wermgr.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\SysWOW64\wermgr.exe	File read: C:\Windows\System32\drivers\etc\hosts

Source: photographed.dat.dll

Static PE information: More than 290 > 100 exports found

Source: photographed.dat.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: photographed.dat.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: photographed.dat.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: photographed.dat.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: photographed.dat.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: photographed.dat.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: photographed.dat.dll

Static PE information: DYNAMIC_BASE, NX_COMPAT, GUARD_CF

Source: photographed.dat.dll

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_1002C376 push esp; ret
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_10028D61 push ecx; ret
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_10028EF6 push ecx; ret
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_1002CF5F push esp; iretd
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_0329D398 push ebp; iretd
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_0329C8F6 push es; retf
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_0329C7D8 push ebp; iretd
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_0329C6DC pushfd ; ret
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 10_2_00C3C0D8 push eax; ret
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 10_2_00C3C9D6 push eax; retf
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 10_2_00C3F1F5 push F26800E7h; ret
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 10_2_00C3BFAC push eax; ret
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 10_2_00C3BF4C push eax; ret
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 10_2_00C3E571 push E63000FEh; ret
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 17_2_001ECAD0 push eax; retf
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 17_2_001EC378 pushfd ; ret
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 17_2_001ECA34 push esp; retf
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 17_2_001EBFEC pushfd ; retn 001Eh
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 18_2_0079C2A0 push esp; ret

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_10026F63 LoadLibraryExW,GetLastError,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

Source: photographed.dat.dll

Static PE information: real checksum: 0x5e44f should be: 0x609ae

Persistence and Installation Behavior

Uses ipconfig to lookup or modify the Windows network settings

Source: C:\Windows\SysWOW64\wermgr.exe

Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /all

Boot Survival

Uses whoami command line tool to query computer and username

Source: C:\Windows\SysWOW64\wermgr.exe	Process created: C:\Windows\SysWOW64\whoami.exe whoami /all
Source: C:\Windows\SysWOW64\wermgr.exe	Process created: C:\Windows\SysWOW64\whoami.exe whoami /all

Hooking and other Techniques for Hiding and Protection

Overwrites code with unconditional jumps - possibly settings hooks in foreign process

Source: C:\Windows\SysWOW64\rundll32.exe

Memory written: PID: 7772 base: 13A3C50 value: E9 63 D7 05 FF

Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wermgr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wermgr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wermgr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wermgr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\whoami.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\whoami.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: wermgr.exe, 0000001F.00000003.449587478.0000000000E0F000.00000004.00000020.00020000.00000000.sdmp, wermgr.exe, 0000001F.00000003.449523620.0000000000E0F000.00000004.00000020.00020000.00000000.sdmp, wermgr.exe, 0000001F.00000003.415271951.0000000000E0F000.00000004.00000020.00020000.00000000.sdmp, wermgr.exe, 0000001F.00000003.415299958.0000000000E0F000.00000004.00000020.00020000.00000000.sdmp, wermgr.exe, 0000001F.00000003.415255086.0000000000E0F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: FRIDA-WINJECTOR-HELPER-32.EXEZ)
Source: wermgr.exe, 0000001F.00000003.449523620.0000000000E13000.00000004.00000020.00020000.00000000.sdmp, wermgr.exe, 0000001F.00000003.449587478.0000000000E13000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SYSANALYZER.EXEU*QL
Source: wermgr.exe, 0000001F.00000003.449523620.0000000000E13000.00000004.00000020.00020000.00000000.sdmp, wermgr.exe, 0000001F.00000003.449587478.0000000000E13000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SNIFF_HIT.EXEK*[L
Source: wermgr.exe, 0000001F.00000003.449587478.0000000000E0F000.00000004.00000020.00020000.00000000.sdmp, wermgr.exe, 0000001F.00000003.449523620.0000000000E0F000.00000004.00000020.00020000.00000000.sdmp, wermgr.exe, 0000001F.00000003.415271951.0000000000E0F000.00000004.00000020.00020000.00000000.sdmp, wermgr.exe, 0000001F.00000003.415299958.0000000000E0F000.00000004.00000020.00020000.00000000.sdmp, wermgr.exe, 0000001F.00000003.415255086.0000000000E0F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: FRIDA-WINJECTOR-HELPER-64.EXE
Source: wermgr.exe, 0000001F.00000003.449523620.0000000000E13000.00000004.00000020.00020000.00000000.sdmp, wermgr.exe, 0000001F.00000003.449587478.0000000000E13000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SNIFF_HIT.EXEL*XL
Source: wermgr.exe, 0000001F.00000003.415271951.0000000000E13000.00000004.00000020.00020000.00000000.sdmp, wermgr.exe, 0000001F.00000003.415255086.0000000000E13000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: IDAQ.EXED*@L
Source: wermgr.exe, 0000001F.00000003.449523620.0000000000E13000.00000004.00000020.00020000.00000000.sdmp, wermgr.exe, 0000001F.00000003.415271951.0000000000E13000.00000004.00000020.00020000.00000000.sdmp, wermgr.exe, 0000001F.00000003.415255086.0000000000E13000.00000004.00000020.00020000.00000000.sdmp, wermgr.exe, 0000001F.00000003.449587478.0000000000E13000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: IMPORTREC.EXE
Source: wermgr.exe, 0000001F.00000003.415271951.0000000000E13000.00000004.00000020.00020000.00000000.sdmp, wermgr.exe, 0000001F.00000003.415255086.0000000000E13000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: PROCMON.EXEG*'L
Source: wermgr.exe, 0000001F.00000003.449523620.0000000000E13000.00000004.00000020.00020000.00000000.sdmp, wermgr.exe, 0000001F.00000003.415271951.0000000000E13000.00000004.00000020.00020000.00000000.sdmp, wermgr.exe, 0000001F.00000003.415255086.0000000000E13000.00000004.00000020.00020000.00000000.sdmp, wermgr.exe, 0000001F.00000003.449587478.0000000000E13000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: WINDUMP.EXE
Source: wermgr.exe, 0000001F.00000003.449523620.0000000000E13000.00000004.00000020.00020000.00000000.sdmp, wermgr.exe, 0000001F.00000003.415271951.0000000000E13000.00000004.00000020.00020000.00000000.sdmp, wermgr.exe, 0000001F.00000003.415255086.0000000000E13000.00000004.00000020.00020000.00000000.sdmp, wermgr.exe, 0000001F.00000003.449587478.0000000000E13000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: IDAQ.EXE
Source: wermgr.exe, 0000001F.00000003.449523620.0000000000E13000.00000004.00000020.00020000.00000000.sdmp, wermgr.exe, 0000001F.00000003.415271951.0000000000E13000.00000004.00000020.00020000.00000000.sdmp, wermgr.exe, 0000001F.00000003.415255086.0000000000E13000.00000004.00000020.00020000.00000000.sdmp, wermgr.exe, 0000001F.00000003.449587478.0000000000E13000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SYSANALYZER.EXE
Source: wermgr.exe, 0000001F.00000003.449523620.0000000000E13000.00000004.00000020.00020000.00000000.sdmp, wermgr.exe, 0000001F.00000003.415271951.0000000000E13000.00000004.00000020.00020000.00000000.sdmp, wermgr.exe, 0000001F.00000003.415255086.0000000000E13000.00000004.00000020.00020000.00000000.sdmp, wermgr.exe, 0000001F.00000003.449587478.0000000000E13000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: FILEMON.EXE
Source: wermgr.exe, 0000001F.00000003.449523620.0000000000E13000.00000004.00000020.00020000.00000000.sdmp, wermgr.exe, 0000001F.00000003.415271951.0000000000E13000.00000004.00000020.00020000.00000000.sdmp, wermgr.exe, 0000001F.00000003.415255086.0000000000E13000.00000004.00000020.00020000.00000000.sdmp, wermgr.exe, 0000001F.00000003.449587478.0000000000E13000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: PROCMON.EXE
Source: wermgr.exe, 0000001F.00000003.449587478.0000000000E0F000.00000004.00000020.00020000.00000000.sdmp, wermgr.exe, 0000001F.00000003.449523620.0000000000E0F000.00000004.00000020.00020000.00000000.sdmp, wermgr.exe, 0000001F.00000003.415271951.0000000000E0F000.00000004.00000020.00020000.00000000.sdmp, wermgr.exe, 0000001F.00000003.415299958.0000000000E0F000.00000004.00000020.00020000.00000000.sdmp, wermgr.exe, 0000001F.00000003.415255086.0000000000E0F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: FRIDA-WINJECTOR-HELPER-32.EXE
Source: wermgr.exe, 0000001F.00000003.449523620.0000000000E13000.00000004.00000020.00020000.00000000.sdmp, wermgr.exe, 0000001F.00000003.415271951.0000000000E13000.00000004.00000020.00020000.00000000.sdmp, wermgr.exe, 0000001F.00000003.415255086.0000000000E13000.00000004.00000020.00020000.00000000.sdmp, wermgr.exe, 0000001F.00000003.449587478.0000000000E13000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: BEHAVIORDUMPER.EXE
Source: wermgr.exe, 0000001F.00000003.449523620.0000000000E13000.00000004.00000020.00020000.00000000.sdmp, wermgr.exe, 0000001F.00000003.449587478.0000000000E13000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: FILEMON.EXEM*YL
Source: wermgr.exe, 0000001F.00000003.415271951.0000000000E13000.00000004.00000020.00020000.00000000.sdmp, wermgr.exe, 0000001F.00000003.415255086.0000000000E13000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: PETOOLS.EXEK*[L
Source: wermgr.exe, 0000001F.00000003.449523620.0000000000E13000.00000004.00000020.00020000.00000000.sdmp, wermgr.exe, 0000001F.00000003.449587478.0000000000E13000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: PETOOLS.EXEB*"L
Source: wermgr.exe, 0000001F.00000003.449523620.0000000000E13000.00000004.00000020.00020000.00000000.sdmp, wermgr.exe, 0000001F.00000003.415271951.0000000000E13000.00000004.00000020.00020000.00000000.sdmp, wermgr.exe, 0000001F.00000003.415255086.0000000000E13000.00000004.00000020.00020000.00000000.sdmp, wermgr.exe, 0000001F.00000003.449587478.0000000000E13000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: PETOOLS.EXE
Source: wermgr.exe, 0000001F.00000003.415271951.0000000000E13000.00000004.00000020.00020000.00000000.sdmp, wermgr.exe, 0000001F.00000003.415255086.0000000000E13000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SYSANALYZER.EXEB*"L
Source: wermgr.exe, 0000001F.00000003.449523620.0000000000E13000.00000004.00000020.00020000.00000000.sdmp, wermgr.exe, 0000001F.00000003.415271951.0000000000E13000.00000004.00000020.00020000.00000000.sdmp, wermgr.exe, 0000001F.00000003.415255086.0000000000E13000.00000004.00000020.00020000.00000000.sdmp, wermgr.exe, 0000001F.00000003.449587478.0000000000E13000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: TCPDUMP.EXE
Source: wermgr.exe, 0000001F.00000003.449523620.0000000000E13000.00000004.00000020.00020000.00000000.sdmp, wermgr.exe, 0000001F.00000003.415271951.0000000000E13000.00000004.00000020.00020000.00000000.sdmp, wermgr.exe, 0000001F.00000003.415255086.0000000000E13000.00000004.00000020.00020000.00000000.sdmp, wermgr.exe, 0000001F.00000003.449587478.0000000000E13000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: PROC_ANALYZER.EXE
Source: wermgr.exe, 0000001F.00000003.449523620.0000000000E13000.00000004.00000020.00020000.00000000.sdmp, wermgr.exe, 0000001F.00000003.415271951.0000000000E13000.00000004.00000020.00020000.00000000.sdmp, wermgr.exe, 0000001F.00000003.415255086.0000000000E13000.00000004.00000020.00020000.00000000.sdmp, wermgr.exe, 0000001F.00000003.449587478.0000000000E13000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SNIFF_HIT.EXE
Source: wermgr.exe, 0000001F.00000003.415271951.0000000000E13000.00000004.00000020.00020000.00000000.sdmp, wermgr.exe, 0000001F.00000003.415255086.0000000000E13000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: FILEMON.EXEL*XL
Source: wermgr.exe, 0000001F.00000003.449523620.0000000000E13000.00000004.00000020.00020000.00000000.sdmp, wermgr.exe, 0000001F.00000003.415271951.0000000000E13000.00000004.00000020.00020000.00000000.sdmp, wermgr.exe, 0000001F.00000003.415255086.0000000000E13000.00000004.00000020.00020000.00000000.sdmp, wermgr.exe, 0000001F.00000003.449587478.0000000000E13000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: DUMPCAP.EXE
Source: wermgr.exe, 0000001F.00000003.449523620.0000000000E13000.00000004.00000020.00020000.00000000.sdmp, wermgr.exe, 0000001F.00000003.415271951.0000000000E13000.00000004.00000020.00020000.00000000.sdmp, wermgr.exe, 0000001F.00000003.415255086.0000000000E13000.00000004.00000020.00020000.00000000.sdmp, wermgr.exe, 0000001F.00000003.449587478.0000000000E13000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: WIRESHARK.EXE

Queries memory information (via WMI often done to detect virtual machines)

Source: C:\Windows\SysWOW64\wermgr.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : select * from Win32_PhysicalMemory

Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines)

Source: C:\Windows\SysWOW64\wermgr.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : select * from Win32_PhysicalMemory

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Windows\SysWOW64\wermgr.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : select * from Win32_DiskDrive

Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines)

Source: C:\Windows\SysWOW64\wermgr.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : select Caption,Description,DeviceID,Manufacturer,Name,PNPDeviceID,Service,Status from Win32_PnPEntity

Source: C:\Windows\SysWOW64\rundll32.exe TID: 7364

Thread sleep count: 193 > 30

Source: C:\Windows\SysWOW64\rundll32.exe

Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Windows\SysWOW64\rundll32.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

Source: C:\Windows\SysWOW64\wermgr.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Processor

Source: C:\Windows\SysWOW64\wermgr.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : select * from Win32_ComputerSystem

Source: C:\Windows\SysWOW64\wermgr.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : select * from Win32_Bios

Source: C:\Windows\SysWOW64\wermgr.exe

Process information queried: ProcessInformation

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 19_2_00EFB883 GetSystemInfo,

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 19_2_00EF9DA8 FindFirstFileW,FindNextFileW,

Source: C:\Windows\System32\loaddll32.exe

Thread delayed: delay time: 120000

Source: Amcache.hve.9.dr	Binary or memory string: VMware
Source: Amcache.hve.9.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/5&1ec51bf7&0&000000
Source: Amcache.hve.9.dr	Binary or memory string: @scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/5&280b647&0&000000
Source: Amcache.hve.9.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.9.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.9.dr	Binary or memory string: VMware Virtual disk SCSI Disk Devicehbin
Source: Amcache.hve.9.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.9.dr	Binary or memory string: VMware7,1
Source: Amcache.hve.9.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.9.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.9.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.9.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.9.dr	Binary or memory string: VMware, Inc.me
Source: Amcache.hve.9.dr	Binary or memory string: VMware-42 35 d8 20 48 cb c7 ff-aa 5e d0 37 a0 49 53 d7
Source: Amcache.hve.9.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/5&280b647&0&000000
Source: Amcache.hve.9.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW71.00V.18227214.B64.2106252220,BiosReleaseDate:06/25/2021,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware7,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.9.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/5&1ec51bf7&0&000000

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_10029B40 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_10026F63 LoadLibraryExW,GetLastError,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

Source: C:\Windows\SysWOW64\whoami.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\whoami.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\whoami.exe	Process token adjusted: Debug

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_10017DF9 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_3_00EE2297 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_00EF1015 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_00EF21CD mov eax, dword ptr fs:[00000030h]

Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 10_2_00C3F744 LdrInitializeThunk,

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_10029845 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_10029B40 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

HIPS / PFW / Operating System Protection Evasion

Writes to foreign memory regions

Source: C:\Windows\SysWOW64\rundll32.exe	Memory written: C:\Windows\SysWOW64\wermgr.exe base: 430000
Source: C:\Windows\SysWOW64\rundll32.exe	Memory written: C:\Windows\SysWOW64\wermgr.exe base: 400000
Source: C:\Windows\SysWOW64\rundll32.exe	Memory written: C:\Windows\SysWOW64\wermgr.exe base: 13A3C50

Allocates memory in foreign processes

Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: C:\Windows\SysWOW64\wermgr.exe base: 400000 protect: page execute and read and write
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: C:\Windows\SysWOW64\wermgr.exe base: 430000 protect: page read and write

Injects a PE file into a foreign processes

Source: C:\Windows\SysWOW64\rundll32.exe

Memory written: C:\Windows\SysWOW64\wermgr.exe base: 400000 value starts with: 4D5A

Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\photographed.dat.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\wermgr.exe C:\Windows\SysWOW64\wermgr.exe
Source: C:\Windows\SysWOW64\wermgr.exe	Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /all
Source: C:\Windows\SysWOW64\wermgr.exe	Process created: C:\Windows\SysWOW64\whoami.exe whoami /all

Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\wermgr.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\wermgr.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_1002999D cpuid

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_10029C62 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_1001B34C GetVersionExW,Concurrency::details::platform::InitializeSystemFunctionPointers,Concurrency::details::WinRT::Initialize,m?0unsupported_os@Concurrency@@QAE@XZ,

Source: C:\Windows\SysWOW64\wermgr.exe

WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Source: rundll32.exe, 00000013.00000003.393597691.000000000494F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: bdagent.exe
Source: rundll32.exe, 00000013.00000003.393597691.000000000494F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vsserv.exe
Source: rundll32.exe, 00000013.00000003.393597691.000000000494F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: avp.exe
Source: Amcache.hve.9.dr	Binary or memory string: c:\users\user\desktop\procexp.exe
Source: Amcache.hve.9.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: rundll32.exe, 00000013.00000003.393597691.000000000494F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: avgcsrvx.exe
Source: rundll32.exe, 00000013.00000003.393597691.000000000494F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: mcshield.exe
Source: Amcache.hve.9.dr	Binary or memory string: procexp.exe
Source: rundll32.exe, 00000013.00000003.393597691.000000000494F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information

Yara detected Qbot

Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: 19.2.rundll32.exe.cf0968.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.rundll32.exe.ef0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.rundll32.exe.cf0968.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000013.00000002.409441736.00000000048D0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.406028423.0000000000CDA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY

Remote Access Functionality

Yara detected Qbot

Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: 19.2.rundll32.exe.cf0968.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.rundll32.exe.ef0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.rundll32.exe.cf0968.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000013.00000002.409441736.00000000048D0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.406028423.0000000000CDA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_10015049 mEnableTracing@Concurrency@@YAJXZ,Concurrency::details::SchedulerBase::GetInternalContext,mEnableTracing@Concurrency@@YAJXZ,Concurrency::details::WorkItem::ResolveToken,Concurrency::details::WorkItem::BindTo,Concurrency::details::SchedulerBase::ReleaseInternalContext,Concurrency::details::SchedulerBase::GetInternalContext,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_10015D00 mEnableTracing@Concurrency@@YAJXZ,Concurrency::details::ContextBase::TraceContextEvent,Concurrency::details::InternalContextBase::SwitchOut,mEnableTracing@Concurrency@@YAJXZ,Concurrency::details::SchedulerBase::GetInternalContext,mEnableTracing@Concurrency@@YAJXZ,Concurrency::details::WorkItem::ResolveToken,Concurrency::details::WorkItem::BindTo,Concurrency::details::SchedulerBase::ReleaseInternalContext,Concurrency::details::InternalContextBase::SwitchTo,Concurrency::details::SchedulerBase::ReleaseInternalContext,mEnableTracing@Concurrency@@YAJXZ,

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	341 Windows Management Instrumentation	1 DLL Side-Loading	311 Process Injection	11 Masquerading	1 Credential API Hooking	1 System Time Discovery	Remote Services	1 Credential API Hooking	Exfiltration Over Other Network Medium	12 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	3 Native API	Boot or Logon Initialization Scripts	1 DLL Side-Loading	341 Virtualization/Sandbox Evasion	1 Input Capture	561 Security Software Discovery	Remote Desktop Protocol	1 Input Capture	Exfiltration Over Bluetooth	1 Non-Standard Port	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	311 Process Injection	Security Account Manager	341 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	1 Archive Collected Data	Automated Exfiltration	1 Non-Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	1 Deobfuscate/Decode Files or Information	NTDS	2 Process Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	12 Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	2 Obfuscated Files or Information	LSA Secrets	1 Remote System Discovery	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	1 Rundll32	Cached Domain Credentials	1 System Network Configuration Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	1 File and Directory Discovery	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	345 System Information Discovery	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
photographed.dat.dll	5%	ReversingLabs
photographed.dat.dll	3%	Virustotal		Browse

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
linkedin.com	13.107.42.14	true	false		high
www.linkedin.com	unknown	unknown	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://www.linkedin.com/talent/post-a-job?trk=homepage-basic_talent-finder-cta	GM1SFAFG.htm.31.dr	false	high
https://sg.linkedin.com/	GM1SFAFG.htm.31.dr	false	high
https://nz.linkedin.com/	GM1SFAFG.htm.31.dr	false	high
https://www.linkedin.com/jobs/quality-assurance-jobs-h	GM1SFAFG.htm.31.dr	false	high
https://www.linkedin.com/pulse/topics/marketing-s2461/	GM1SFAFG.htm.31.dr	false	high
https://bo.linkedin.com/	GM1SFAFG.htm.31.dr	false	high
https://cn.linkedin.com/	GM1SFAFG.htm.31.dr	false	high
https://kr.linkedin.com/	GM1SFAFG.htm.31.dr	false	high
https://sv.linkedin.com/	GM1SFAFG.htm.31.dr	false	high
https://www.linkedin.com/signup?trk=guest_homepage-basic_directory	GM1SFAFG.htm.31.dr	false	high
https://www.linkedin.com/legal/copyright-policy?trk=homepage-basic_footer-copyright-policy	GM1SFAFG.htm.31.dr	false	high
https://static.licdn.com/aero-v1/sc/h/e12h2cd8ac580qen9qdd0qks8	GM1SFAFG.htm.31.dr	false	high
https://about.linkedin.com/?trk=homepage-basic_directory_aboutUrl	GM1SFAFG.htm.31.dr	false	high
https://www.linkedin.com/jobs/search?trk=guest_homepage-basic_guest_nav_menu_jobs	GM1SFAFG.htm.31.dr	false	high
https://ec.linkedin.com/	GM1SFAFG.htm.31.dr	false	high
https://about.linkedin.com?trk=homepage-basic_footer-about	GM1SFAFG.htm.31.dr	false	high
https://ie.linkedin.com/	GM1SFAFG.htm.31.dr	false	high
https://www.linkedin.com/learning/topics/business-software-and-tools?trk=homepage-basic_learning-cta	GM1SFAFG.htm.31.dr	false	high
https://ae.linkedin.com/	GM1SFAFG.htm.31.dr	false	high
https://uk.linkedin.com/	GM1SFAFG.htm.31.dr	false	high
https://www.linkedin.com/salary/?trk=homepage-basic_directory_salaryHomeUrl	GM1SFAFG.htm.31.dr	false	high
https://static.licdn.com/aero-v1/sc/h/75y9ng27ydl2d46fam5nanne5	GM1SFAFG.htm.31.dr	false	high
https://developer.linkedin.com/?trk=homepage-basic_directory_developerMicrositeUrl	GM1SFAFG.htm.31.dr	false	high
https://www.linkedin.com/directory/posts?trk=homepage-basic_directory_postsDirectoryUrl	GM1SFAFG.htm.31.dr	false	high
https://www.linkedin.com/jobs/operations-jobs-h	GM1SFAFG.htm.31.dr	false	high
https://www.linkedin.com/learning/topics/artificial-intelligence?trk=homepage-basic_learning-cta	GM1SFAFG.htm.31.dr	false	high
https://www.linkedin.com/pulse/topics/healthcare-s282/	GM1SFAFG.htm.31.dr	false	high
https://in.linkedin.com/	GM1SFAFG.htm.31.dr	false	high
https://www.linkedin.com/directory/featured?trk=homepage-basic_directory_featuredDirectoryUrl	GM1SFAFG.htm.31.dr	false	high
https://www.linkedin.com/learning/topics/audio-and-music?trk=homepage-basic_learning-cta	GM1SFAFG.htm.31.dr	false	high
https://www.linkedin.com/learning/topics/training-and-education?trk=homepage-basic_learning-cta	GM1SFAFG.htm.31.dr	false	high
https://hk.linkedin.com/	GM1SFAFG.htm.31.dr	false	high
https://www.linkedin.com/learning/topics/visualization-and-real-time?trk=homepage-basic_learning-cta	GM1SFAFG.htm.31.dr	false	high
https://at.linkedin.com/	GM1SFAFG.htm.31.dr	false	high
https://www.linkedin.com/pulse/topics/construction-management-s831/	GM1SFAFG.htm.31.dr	false	high
https://www.linkedin.com/jobs/education-jobs-h	GM1SFAFG.htm.31.dr	false	high
https://www.linkedin.com/learning/topics/project-management?trk=homepage-basic_learning-cta	GM1SFAFG.htm.31.dr	false	high
https://www.linkedin.com/directory/articles?trk=homepage-basic_directory_articlesDirectoryUrl	GM1SFAFG.htm.31.dr	false	high
https://www.linkedin.com/pulse/topics/public-administration-s3697/	GM1SFAFG.htm.31.dr	false	high
https://za.linkedin.com/	GM1SFAFG.htm.31.dr	false	high
https://www.linkedin.com/directory/services?trk=homepage-basic_directory_servicesDirectoryUrl	GM1SFAFG.htm.31.dr	false	high
https://jm.linkedin.com/	GM1SFAFG.htm.31.dr	false	high
https://no.linkedin.com/	GM1SFAFG.htm.31.dr	false	high
https://www.linkedin.com/directory/learning?trk=homepage-basic_directory_learningDirectoryUrl	GM1SFAFG.htm.31.dr	false	high
https://www.linkedin.com/jobs/entrepreneurship-jobs-h	GM1SFAFG.htm.31.dr	false	high
https://pe.linkedin.com/	GM1SFAFG.htm.31.dr	false	high
https://www.linkedin.com/directory/advice?trk=homepage-basic_directory_adviceDirectoryUrl	GM1SFAFG.htm.31.dr	false	high
https://au.linkedin.com/	GM1SFAFG.htm.31.dr	false	high
https://static.licdn.com/aero-v1/sc/h/ddi43qwelxeqjxdd45pe3fvs1	GM1SFAFG.htm.31.dr	false	high
https://www.linkedin.com/jobs/administrative-assistant-jobs-h	GM1SFAFG.htm.31.dr	false	high
https://www.linkedin.com/legal/professional-community-policies?trk=homepage-basic_footer-community-g	GM1SFAFG.htm.31.dr	false	high
https://www.linkedin.com/legal/cookie-policy?trk=homepage-basic_footer-cookie-policy	GM1SFAFG.htm.31.dr	false	high
https://www.linkedin.com/signup?trk=guest_homepage-basic_nav-header-join	GM1SFAFG.htm.31.dr	false	high
https://www.linkedin.com/signup?trk=homepage-basic_join-cta	GM1SFAFG.htm.31.dr	false	high
https://www.linkedin.com/learning/topics/sales-3?trk=homepage-basic_learning-cta	GM1SFAFG.htm.31.dr	false	high
https://www.linkedin.com/legal/cookie-policy	GM1SFAFG.htm.31.dr	false	high
https://static.licdn.com/aero-v1/sc/h/51t74mlo1ty7vakn3a80a9jcp	GM1SFAFG.htm.31.dr	false	high
https://static.licdn.com/aero-v1/sc/h/8fkga714vy9b2wk5auqo5reeb	GM1SFAFG.htm.31.dr	false	high
https://www.linkedin.com/learning/topics/data-science?trk=homepage-basic_learning-cta	GM1SFAFG.htm.31.dr	false	high
https://cr.linkedin.com/	GM1SFAFG.htm.31.dr	false	high
https://www.linkedin.com/learning/topics/mobile-development?trk=homepage-basic_learning-cta	GM1SFAFG.htm.31.dr	false	high
https://gt.linkedin.com/	GM1SFAFG.htm.31.dr	false	high
https://ph.linkedin.com/	GM1SFAFG.htm.31.dr	false	high
https://www.linkedin.com/learning/topics/leadership-and-management?trk=homepage-basic_learning-cta	GM1SFAFG.htm.31.dr	false	high
https://www.linkedin.com/learning/topics/network-and-system-administration?trk=homepage-basic_learni	GM1SFAFG.htm.31.dr	false	high
https://www.linkedin.com/learning/search?trk=guest_homepage-basic_guest_nav_menu_learning	GM1SFAFG.htm.31.dr	false	high
https://www.linkedin.com/learning/topics/customer-service-3?trk=homepage-basic_learning-cta	GM1SFAFG.htm.31.dr	false	high
https://www.linkedin.com/jobs/jobs-in-h	GM1SFAFG.htm.31.dr	false	high
https://fr.linkedin.com/	GM1SFAFG.htm.31.dr	false	high
https://mobile.linkedin.com/?trk=homepage-basic_directory_mobileMicrositeUrl	GM1SFAFG.htm.31.dr	false	high
https://www.linkedin.com/jobs/purchasing-jobs-h	GM1SFAFG.htm.31.dr	false	high
https://www.linkedin.com/learning/topics/security-3?trk=homepage-basic_learning-cta	GM1SFAFG.htm.31.dr	false	high
https://www.linkedin.com/learning/search?trk=homepage-basic_brand-discovery_intent-module-thirdBtn	GM1SFAFG.htm.31.dr	false	high
https://www.linkedin.com/learning/topics/it-help-desk-5?trk=homepage-basic_learning-cta	GM1SFAFG.htm.31.dr	false	high
https://www.linkedin.com/jobs/arts-and-design-jobs-h	GM1SFAFG.htm.31.dr	false	high
https://www.linkedin.com/directory/products?trk=homepage-basic_directory_productsDirectoryUrl	GM1SFAFG.htm.31.dr	false	high
https://business.linkedin.com/talent-solutions?src=li-footer&utm_source=linkedin&utm_medium=	GM1SFAFG.htm.31.dr	false	high
https://www.linkedin.com/directory/news?trk=homepage-basic_directory_newsDirectoryUrl	GM1SFAFG.htm.31.dr	false	high
https://zw.linkedin.com/	GM1SFAFG.htm.31.dr	false	high
https://co.linkedin.com/	GM1SFAFG.htm.31.dr	false	high
https://ru.linkedin.com/	GM1SFAFG.htm.31.dr	false	high
https://ca.linkedin.com/	GM1SFAFG.htm.31.dr	false	high
https://ke.linkedin.com/	GM1SFAFG.htm.31.dr	false	high
https://www.linkedin.com/learning/topics/career-development-5?trk=homepage-basic_learning-cta	GM1SFAFG.htm.31.dr	false	high
https://www.linkedin.com/mypreferences/g/guest-cookies	GM1SFAFG.htm.31.dr	false	high
https://www.linkedin.com/products?trk=homepage-basic_directory_productsHomeUrl	GM1SFAFG.htm.31.dr	false	high
https://static.licdn.com/aero-v1/sc/h/7kb6sn3tm4cx918cx9a5jlb0	GM1SFAFG.htm.31.dr	false	high
https://static.licdn.com/aero-v1/sc/h/8wykgzgbqy0t3fnkgborvz54u	GM1SFAFG.htm.31.dr	false	high
https://de.linkedin.com/	GM1SFAFG.htm.31.dr	false	high
https://static.licdn.com/aero-v1/sc/h/2r8kd5zqpi905lkzsshdlvvn5	GM1SFAFG.htm.31.dr	false	high
https://www.linkedin.com/jobs/retail-associate-jobs-h	GM1SFAFG.htm.31.dr	false	high
https://www.linkedin.com/learning/topics/product-and-manufacturing?trk=homepage-basic_learning-cta	GM1SFAFG.htm.31.dr	false	high
https://www.linkedin.com/psettings/guest-controls?trk=homepage-basic_footer-guest-controls	GM1SFAFG.htm.31.dr	false	high
https://business.linkedin.com/marketing-solutions?src=li-footer&utm_source=linkedin&utm_medi	GM1SFAFG.htm.31.dr	false	high
https://www.linkedin.com/help/linkedin?lang=en&trk=homepage-basic_directory_helpCenterUrl	GM1SFAFG.htm.31.dr	false	high
https://pk.linkedin.com/	GM1SFAFG.htm.31.dr	false	high
https://jp.linkedin.com/	GM1SFAFG.htm.31.dr	false	high
https://www.linkedin.com/learning/topics/human-resources-3?trk=homepage-basic_learning-cta	GM1SFAFG.htm.31.dr	false	high
https://static.licdn.com/aero-v1/sc/h/al2o9zrvru7aqj8e1x2rzsrca	GM1SFAFG.htm.31.dr	false	high
https://www.linkedin.com/jobs/real-estate-jobs-h	GM1SFAFG.htm.31.dr	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
91.165.188.74	unknown	France	12322	PROXADFR	true
2.82.8.80	unknown	Portugal	3243	MEO-RESIDENCIALPT	true
70.160.67.203	unknown	United States	22773	ASN-CXA-ALL-CCI-22773-RDCUS	true
75.143.236.149	unknown	United States	20115	CHARTER-20115US	true
83.110.223.61	unknown	United Arab Emirates	5384	EMIRATES-INTERNETEmiratesInternetAE	true
84.215.202.8	unknown	Norway	41164	GET-NOGETNorwayNO	true
184.182.66.109	unknown	United States	22773	ASN-CXA-ALL-CCI-22773-RDCUS	true
161.129.37.43	unknown	United States	64271	RIXCLOUD-INCUS	true
92.186.69.229	unknown	France	12479	UNI2-ASES	true
174.4.89.3	unknown	Canada	6327	SHAWCA	true
161.142.103.187	unknown	Malaysia	9930	TTNET-MYTIMEdotComBerhadMY	true
116.74.164.144	unknown	India	17488	HATHWAY-NET-APHathwayIPOverCableInternetIN	true
76.185.109.16	unknown	United States	11427	TWC-11427-TEXASUS	true
114.143.176.236	unknown	India	17762	HTIL-TTML-IN-APTataTeleservicesMaharashtraLtdIN	true
24.234.220.88	unknown	United States	22773	ASN-CXA-ALL-CCI-22773-RDCUS	true
14.192.241.76	unknown	Malaysia	9534	MAXIS-AS1-APBinariangBerhadMY	true
123.3.240.16	unknown	Australia	9443	VOCUS-RETAIL-AUVocusRetailAU	true
173.88.135.179	unknown	United States	10796	TWC-10796-MIDWESTUS	true
47.34.30.133	unknown	United States	20115	CHARTER-20115US	true
183.87.163.165	unknown	India	132220	JPRDIGITAL-INJPRDigitalPvtLtdIN	true
184.181.75.148	unknown	United States	22773	ASN-CXA-ALL-CCI-22773-RDCUS	true
124.149.143.189	unknown	Australia	7545	TPG-INTERNET-APTPGTelecomLimitedAU	true
70.49.205.198	unknown	Canada	577	BACOMCA	true
84.35.26.14	unknown	Netherlands	21221	INFOPACT-ASTheNetherlandsNL	true
37.14.229.220	unknown	Spain	12479	UNI2-ASES	true
102.159.223.197	unknown	Tunisia	37705	TOPNETTN	true
165.120.169.171	unknown	United States	2856	BT-UK-ASBTnetUKRegionalnetworkGB	true
79.92.15.6	unknown	France	15557	LDCOMNETFR	true
68.203.69.96	unknown	United States	11427	TWC-11427-TEXASUS	true
64.121.161.102	unknown	United States	6079	RCN-ASUS	true
96.56.197.26	unknown	United States	6128	CABLE-NET-1US	true
178.175.187.254	unknown	Moldova Republic of	43289	TRABIAMD	true
186.64.67.30	unknown	Argentina	27953	NODOSUDSAAR	true
188.28.19.84	unknown	United Kingdom	206067	H3GUKGB	true
125.99.76.102	unknown	India	17488	HATHWAY-NET-APHathwayIPOverCableInternetIN	true
103.87.128.228	unknown	India	55947	BBNL-INBangaloreBroadbandNetworkPvtLtdIN	true
86.248.228.57	unknown	France	3215	FranceTelecom-OrangeFR	true
59.28.84.65	unknown	Korea Republic of	4766	KIXS-AS-KRKoreaTelecomKR	true
76.86.31.59	unknown	United States	20001	TWC-20001-PACWESTUS	true
147.147.30.126	unknown	United Kingdom	6871	PLUSNETUKInternetServiceProviderGB	true
96.87.28.170	unknown	United States	7922	COMCAST-7922US	true
75.109.111.89	unknown	United States	19108	SUDDENLINK-COMMUNICATIONSUS	true
78.92.133.215	unknown	Hungary	5483	MAGYAR-TELEKOM-MAIN-ASMagyarTelekomNyrtHU	true
88.126.94.4	unknown	France	12322	PROXADFR	true
124.122.47.148	unknown	Thailand	17552	TRUE-AS-APTrueInternetCoLtdTH	true
85.57.212.13	unknown	Spain	12479	UNI2-ASES	true
47.205.25.170	unknown	United States	5650	FRONTIER-FRTRUS	true
95.45.50.93	unknown	Ireland	5466	EIRCOMInternetHouseIE	true
80.12.88.148	unknown	France	3215	FranceTelecom-OrangeFR	true
69.133.162.35	unknown	United States	11426	TWC-11426-CAROLINASUS	true
151.62.238.176	unknown	Italy	1267	ASN-WINDTREIUNETEU	true
205.237.67.69	unknown	Canada	11290	CC-3272CA	true
201.143.215.69	unknown	Mexico	8151	UninetSAdeCVMX	true
94.30.98.134	unknown	United Kingdom	5413	AS5413GB	true
76.178.148.107	unknown	United States	10838	OCEANIC-INTERNET-RRUS	true
69.242.31.249	unknown	United States	7922	COMCAST-7922US	true
85.104.105.67	unknown	Turkey	9121	TTNETTR	true
92.239.81.124	unknown	United Kingdom	5089	NTLGB	true
76.16.49.134	unknown	United States	7922	COMCAST-7922US	true
201.244.108.183	unknown	Colombia	19429	ETB-ColombiaCO	true
103.42.86.42	unknown	India	133660	EDIGITAL-ASE-InfrastructureandEntertainmentIndiaPvtLt	true
103.144.201.56	unknown	unknown	139762	MSSOLUTION-AS-APSolutionBD	true
116.120.145.170	unknown	Korea Republic of	9318	SKB-ASSKBroadbandCoLtdKR	true
103.139.242.6	unknown	India	138798	MUTINY-AS-INMutinySystemsPrivateLimitedIN	true
70.28.50.223	unknown	Canada	577	BACOMCA	true
98.145.23.67	unknown	United States	20001	TWC-20001-PACWESTUS	true
81.229.117.95	unknown	Sweden	3301	TELIANET-SWEDENTeliaCompanySE	true
89.129.109.27	unknown	Spain	12479	UNI2-ASES	true
45.51.102.225	unknown	United States	20001	TWC-20001-PACWESTUS	true
27.109.19.90	unknown	India	17625	BLAZENET-IN-APBlazeNetsNetworkIN	true
122.186.210.254	unknown	India	9498	BBIL-APBHARTIAirtelLtdIN	true
79.77.142.22	unknown	United Kingdom	9105	TISCALI-UKTalkTalkCommunicationsLimitedGB	true
122.184.143.86	unknown	India	9498	BBIL-APBHARTIAirtelLtdIN	true
50.68.186.195	unknown	Canada	6327	SHAWCA	true
213.55.33.103	unknown	France	49902	SRR-ASFR	true
180.151.229.230	unknown	India	10029	SHYAMSPECTRA-ASSHYAMSPECTRAPVTLTDIN	true
12.172.173.82	unknown	United States	2386	INS-ASUS	true
47.199.241.39	unknown	United States	5650	FRONTIER-FRTRUS	true
79.168.224.165	unknown	Portugal	2860	NOS_COMUNICACOESPT	true
199.27.66.213	unknown	United States	40608	HCTNEBRASKAUS	true
176.142.207.63	unknown	France	5410	BOUYGTEL-ISPFR	true
90.29.86.138	unknown	France	3215	FranceTelecom-OrangeFR	true
149.74.159.67	unknown	United States	12479	UNI2-ASES	true
174.58.146.57	unknown	United States	7922	COMCAST-7922US	true
78.160.146.127	unknown	Turkey	9121	TTNETTR	true
223.166.13.95	unknown	China	17621	CNCGROUP-SHChinaUnicomShanghainetworkCN	true
58.186.75.42	unknown	Viet Nam	18403	FPT-AS-APTheCorporationforFinancingPromotingTechnolo	true
65.95.141.84	unknown	Canada	577	BACOMCA	true
50.68.204.71	unknown	Canada	6327	SHAWCA	true
71.38.155.217	unknown	United States	209	CENTURYLINK-US-LEGACY-QWESTUS	true
117.195.29.126	unknown	India	9829	BSNL-NIBNationalInternetBackboneIN	true
220.240.164.182	unknown	Australia	7545	TPG-INTERNET-APTPGTelecomLimitedAU	true
103.123.223.133	unknown	India	138329	KWS-AS-APKenstarWebSolutionsPrivateLimitedIN	true
198.2.51.242	unknown	United States	20001	TWC-20001-PACWESTUS	true
27.99.32.26	unknown	Australia	4804	MPX-ASMicroplexPTYLTDAU	true
94.204.232.135	unknown	United Arab Emirates	15802	DU-AS1AE	true
109.50.149.241	unknown	Portugal	2860	NOS_COMUNICACOESPT	true
69.123.4.221	unknown	United States	6128	CABLE-NET-1US	true
74.136.224.98	unknown	United States	10796	TWC-10796-MIDWESTUS	true
200.84.200.20	unknown	Venezuela	8048	CANTVServiciosVenezuelaVE	true

General Information

Joe Sandbox Version:	37.1.0 Beryl
Analysis ID:	879093
Start date and time:	2023-05-31 14:22:15 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 13m 19s
Hypervisor based Inspection enabled:	false
Report type:	light
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	42
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample file name:	photographed.dat.dll
Detection:	MAL
Classification:	mal100.troj.evad.winDLL@41/40@2/100
EGA Information:	Successful, ratio: 12.5%
HDC Information:	Successful, ratio: 18.5% (good quality ratio 17.2%) Quality average: 71.9% Quality standard deviation: 29.2%
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .dll Override analysis time to 240s for rundll32

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, WerFault.exe, WMIADAP.exe, conhost.exe, WmiPrvSE.exe, svchost.exe
TCP Packets have been reduced to 100
Excluded IPs from analysis (whitelisted): 20.189.173.22, 52.182.143.212, 13.107.42.14, 8.250.157.254, 8.238.85.254, 8.248.131.254, 8.248.141.254, 8.238.85.126
Excluded domains from analysis (whitelisted): www-linkedin-com.l-0005.l-msedge.net, l-0005.l-msedge.net, fg.download.windowsupdate.com.c.footprint.net, onedsblobprdcus15.centralus.cloudapp.azure.com, login.live.com, blobcollector.events.data.trafficmanager.net, onedsblobprdwus17.westus.cloudapp.azure.com, ctldl.windowsupdate.com, watson.telemetry.microsoft.com, wu-bg-shim.trafficmanager.net
Execution Graph export aborted for target rundll32.exe, PID 3108 because there are no executed function
Execution Graph export aborted for target rundll32.exe, PID 5684 because there are no executed function
Execution Graph export aborted for target rundll32.exe, PID 7136 because there are no executed function
Execution Graph export aborted for target rundll32.exe, PID 7216 because there are no executed function
Execution Graph export aborted for target rundll32.exe, PID 7332 because there are no executed function
Execution Graph export aborted for target rundll32.exe, PID 7340 because there are no executed function
Execution Graph export aborted for target rundll32.exe, PID 7348 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.

Simulations

Behavior and APIs

Time	Type	Description
14:23:23	API Interceptor	8x Sleep call for process: WerFault.exe modified
14:23:24	API Interceptor	1x Sleep call for process: loaddll32.exe modified
14:23:36	API Interceptor	9x Sleep call for process: wermgr.exe modified

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_34d063e1f8b4a0a973e2832d9ca94882ab2137_82810a17_1c1229dd\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9156252570439176
Encrypted:	false
SSDEEP:	192:ESsij0oXFfH4DmIwspjed+I/u7swS274It7c:0i9XFf4Dm9spjet/u7swX4It7c
MD5:	3D45E77052765A0325ED24F5C32FE837
SHA1:	3554301E099465233A13FB6A15B70FFD259E2AC0
SHA-256:	1A71042032C4DCCE12C32842FD14E08FCB8BBF8E36E1D0BEB14A03E5D092855D
SHA-512:	6F2C075626B13FF6272097F64206815F6FCC5EE7F0629B21077A844C214FE177BEFA8B216AD0AB9D93FC67D251659B22F57AB77CFE16F9B10EE75571063A0CBD
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.3.0.0.4.1.8.0.1.5.6.0.5.8.6.5.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.3.0.0.4.1.8.0.2.6.0.7.4.7.7.7.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.e.2.1.d.7.1.b.0.-.9.c.8.c.-.4.3.f.7.-.b.e.1.3.-.f.a.4.f.2.3.5.7.d.9.7.2.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.6.d.4.5.0.1.d.b.-.6.1.0.7.-.4.7.d.0.-.b.3.9.6.-.7.e.0.1.f.6.d.4.e.1.3.7.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.r.u.n.d.l.l.3.2...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.R.U.N.D.L.L.3.2...E.X.E.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.c.3.0.-.0.0.0.1.-.0.0.1.f.-.4.8.f.5.-.e.1.1.f.0.6.9.4.d.9.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.b.c.c.5.d.c.3.2.2.2.0.3.4.d.3.f.2.5.7.f.1.f.d.3.5.8.8.9.e.5.b.e.9.0.f.0.9.b.5.f.!.r.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_34d063e1f8b4a0a973e2832d9ca94882ab2137_82810a17_1dd23bb0\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9161324687019822
Encrypted:	false
SSDEEP:	192:oZiy60oX4fH4DmIwspjed+I/u7swS274It7cW:CiysX4f4Dm9spjet/u7swX4It7cW
MD5:	C48F622A9257877736F21E30193E05F4
SHA1:	5972F9BDB9702E145B10A8787664745F348DA61C
SHA-256:	220664EA5E28581FE9DA5CCB5ADE0DE61335563B8080D42214B58F5DB1EA2652
SHA-512:	FD8EC429D4A13D85E619E6AEF99AFF66F0BBB7CA599F9B4895AF2BB8EA7B0D73A903393A76B28C8FFE431108E99946891F4084FF84A245DECDB73A199B1EAC3D
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.3.0.0.4.1.8.0.5.6.6.5.4.8.2.5.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.3.0.0.4.1.8.0.7.6.0.2.9.8.4.4.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.0.9.d.7.8.c.6.8.-.0.9.f.1.-.4.5.0.5.-.9.b.2.1.-.8.b.4.5.f.6.0.0.4.2.9.7.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.7.3.5.0.c.7.5.0.-.9.8.1.c.-.4.9.d.9.-.b.2.8.9.-.1.1.0.b.7.a.b.a.1.7.f.8.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.r.u.n.d.l.l.3.2...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.R.U.N.D.L.L.3.2...E.X.E.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.c.b.4.-.0.0.0.1.-.0.0.1.f.-.4.e.8.5.-.d.0.2.1.0.6.9.4.d.9.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.b.c.c.5.d.c.3.2.2.2.0.3.4.d.3.f.2.5.7.f.1.f.d.3.5.8.8.9.e.5.b.e.9.0.f.0.9.b.5.f.!.r.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_34d063e1f8b4a0a973e2832d9ca94882ab2137_82810a17_1de23ba0\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9154605880972915
Encrypted:	false
SSDEEP:	192:qTBiz0oXtfH4DmIwspjed+I/u7swS274It7c:EitXtf4Dm9spjet/u7swX4It7c
MD5:	21515BB58173D099A814E9F5E66F2C78
SHA1:	BE0AFD5BA961AEA34A888A9DD76D308C161E1E5C
SHA-256:	0A5219F561E16627A3B39785FE5A47FB45BA9084250C8D84EF84F24CFEE73FA4
SHA-512:	AE40DF57B8EC1E0F55F9A9489E0A3425B71F9561D6A5DE34DD8BD2EE399C2E0322C86DE3BDA68F0512072716F839E8F0797DFBBDF3A3DB30492E9AB74CFED8FB
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.3.0.0.4.1.8.0.5.7.1.6.0.4.4.2.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.3.0.0.4.1.8.0.7.5.5.9.7.8.3.2.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.a.b.4.1.7.5.4.8.-.3.6.5.a.-.4.1.2.0.-.8.d.8.e.-.f.9.3.c.1.e.d.0.a.0.f.e.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.f.1.1.0.e.d.1.a.-.3.2.d.c.-.4.6.d.9.-.9.d.6.7.-.9.7.1.3.2.1.3.6.6.6.9.4.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.r.u.n.d.l.l.3.2...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.R.U.N.D.L.L.3.2...E.X.E.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.c.f.8.-.0.0.0.1.-.0.0.1.f.-.b.1.e.8.-.f.2.2.1.0.6.9.4.d.9.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.b.c.c.5.d.c.3.2.2.2.0.3.4.d.3.f.2.5.7.f.1.f.d.3.5.8.8.9.e.5.b.e.9.0.f.0.9.b.5.f.!.r.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_fce87c8f307b30dca7c45f44ed2a364c18519efd_82810a17_13262a0c\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.908530639512352
Encrypted:	false
SSDEEP:	192:ngi30oXXHBUZMX4jed+I/u7swS274ItWc:giJX3BUZMX4jet/u7swX4ItWc
MD5:	AFF88FC1F8E83A4CA04E968C04C7C688
SHA1:	9C02424C4FA96C2942820A9F6BC69C8264E6A6E7
SHA-256:	D810573F12FD6CC6B46CEE201CACB72E17AEE7A90D3DF35714D961FBB8F66AFB
SHA-512:	A3E5FD2CD1E3B8435B483342F6816BBB2FB3136854F5317808D4BAFB161BEB0698945E4E034D0E5A5292E7E8A0E152C7C694AFA0B87337AA1A3958F5CA241358
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.3.0.0.4.1.7.9.6.0.0.8.4.0.3.0.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.3.0.0.4.1.7.9.7.1.0.2.1.3.4.2.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.6.e.1.d.f.2.6.0.-.e.1.8.9.-.4.6.1.4.-.8.b.f.5.-.e.3.4.3.d.c.e.0.7.2.0.f.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.7.d.1.6.d.c.9.5.-.8.6.4.a.-.4.a.1.d.-.8.f.1.8.-.8.0.d.5.4.7.b.e.0.e.7.c.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.r.u.n.d.l.l.3.2...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.R.U.N.D.L.L.3.2...E.X.E.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.6.3.4.-.0.0.0.1.-.0.0.1.f.-.9.3.d.5.-.4.4.1.c.0.6.9.4.d.9.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.b.c.c.5.d.c.3.2.2.2.0.3.4.d.3.f.2.5.7.f.1.f.d.3.5.8.8.9.e.5.b.e.9.0.f.0.9.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_fce87c8f307b30dca7c45f44ed2a364c18519efd_82810a17_14da29be\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9082374025654678
Encrypted:	false
SSDEEP:	192:b/5id0oXDHBUZMX4jed+I/u7swS274ItWc:z5izXDBUZMX4jet/u7swX4ItWc
MD5:	80000179D3804BCA9479555468130CBF
SHA1:	8BCDD408DD45994FE6C82ABA71909F035FF53A26
SHA-256:	1DBFA8588B1D7B9A74073D6F7E91C4069068B694CF412674CBF015484ADB3209
SHA-512:	7F17AB6E8A4FBB9CD73B60473D40A2867E4BA22C8B1C5051AAF811A1ABB377488D8F4150733BFFD9E3BF5776D3A452A36F82331D2B09B444BDB83846543C356D
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.3.0.0.4.1.7.9.6.0.8.1.3.0.2.3.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.3.0.0.4.1.7.9.7.0.8.1.3.0.3.6.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.f.4.4.4.b.3.4.e.-.3.b.3.3.-.4.d.5.2.-.8.f.d.2.-.3.9.a.0.2.c.b.e.4.3.4.5.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.3.1.7.0.6.d.0.9.-.9.a.d.7.-.4.7.e.c.-.b.4.9.e.-.9.4.e.9.b.c.3.c.9.1.3.e.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.r.u.n.d.l.l.3.2...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.R.U.N.D.L.L.3.2...E.X.E.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.b.e.0.-.0.0.0.1.-.0.0.1.f.-.0.7.f.3.-.4.1.1.c.0.6.9.4.d.9.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.b.c.c.5.d.c.3.2.2.2.0.3.4.d.3.f.2.5.7.f.1.f.d.3.5.8.8.9.e.5.b.e.9.0.f.0.9.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_fce87c8f307b30dca7c45f44ed2a364c18519efd_82810a17_1bd22a0c\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9083995569837817
Encrypted:	false
SSDEEP:	192:7uNiR0oX9HBUZMX4jed+I/u7swS274ItWc:0ifXNBUZMX4jet/u7swX4ItWc
MD5:	1C21B603083C8496D299D9351BCE1C09
SHA1:	02D160491DF413BB172B9DDB5BFA4299D5CEB376
SHA-256:	023249F52922A560432552F5204272B52FD3EA6A7F65FB5D7AD9CA01057B22E4
SHA-512:	5AD09C14201518B016167C5772FBE122DBD5B578013472E64B3E85EE3C5E4CD70BB0A637CDDD22D707B1587E3CD1142B884F60C48F0FDC23B74E976CBA0167B0
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.3.0.0.4.1.7.9.8.4.5.3.3.9.0.0.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.3.0.0.4.1.7.9.9.2.0.3.3.9.1.1.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.8.e.c.d.f.3.5.6.-.8.8.d.5.-.4.9.0.a.-.8.5.5.8.-.7.f.e.2.2.c.6.e.b.a.b.1.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.1.1.c.4.4.0.5.b.-.f.8.a.5.-.4.1.2.1.-.b.1.5.6.-.8.9.d.8.9.f.d.d.9.c.4.6.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.r.u.n.d.l.l.3.2...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.R.U.N.D.L.L.3.2...E.X.E.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.c.2.4.-.0.0.0.1.-.0.0.1.f.-.a.f.1.0.-.1.1.1.e.0.6.9.4.d.9.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.b.c.c.5.d.c.3.2.2.2.0.3.4.d.3.f.2.5.7.f.1.f.d.3.5.8.8.9.e.5.b.e.9.0.f.0.9.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_fce87c8f307b30dca7c45f44ed2a364c18519efd_82810a17_1d0a3a87\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9083026550103219
Encrypted:	false
SSDEEP:	192:ELU/iz0oXRHBUZMX4jed+I/u7swS274ItWc:6aitXhBUZMX4jet/u7swX4ItWc
MD5:	A55A4307CA041E65E0CC83DCB7E7DBA4
SHA1:	18203487EFEFE079BA417BFBA73412A2AD3EF1DC
SHA-256:	5D99A362204076D7E5D940656F414D4C9DC91CF20E499066A7D9D6CAD39AEB63
SHA-512:	089DC4C76028B601CCDEE77E6AF30C012D9974EDBE9EB363102F729BD6EE54EF9EC9DC6A0058A74F856A3089CB30E132BFF9C125FDECA64053E25B5DAF07323A
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.3.0.0.4.1.8.0.5.3.1.4.3.1.5.7.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.3.0.0.4.1.8.0.7.1.2.6.8.0.3.2.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.d.8.5.2.e.4.3.a.-.0.b.0.b.-.4.9.9.9.-.8.0.9.0.-.f.0.d.2.0.c.b.b.7.7.9.6.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.4.7.a.7.c.9.7.c.-.6.0.5.1.-.4.3.7.c.-.a.3.d.4.-.d.f.1.4.e.1.a.2.6.6.f.4.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.r.u.n.d.l.l.3.2...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.R.U.N.D.L.L.3.2...E.X.E.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.c.a.4.-.0.0.0.1.-.0.0.1.f.-.e.f.8.3.-.b.3.2.1.0.6.9.4.d.9.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.b.c.c.5.d.c.3.2.2.2.0.3.4.d.3.f.2.5.7.f.1.f.d.3.5.8.8.9.e.5.b.e.9.0.f.0.9.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_fce87c8f307b30dca7c45f44ed2a364c18519efd_82810a17_1d123b42\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9087383303164102
Encrypted:	false
SSDEEP:	192:USim0oXdHBUZMX4jed+I/u7swS274ItWc:1iAXtBUZMX4jet/u7swX4ItWc
MD5:	8C0815AACCC143F390B40C4106559201
SHA1:	326FEF62100B752B1E3FE1D0A219A84E43400DA2
SHA-256:	2634F39AE4D661C8BFA08C30E70CB2BD9561112731ADE4C1027A4294754701BC
SHA-512:	974BFF9F25E23BA75B6C5853C2AD16ECEB1325AAE745F6A959433E8BE3DC49B1260EFDE744C6DACC5F6C09165142AA10CC6714003E11A8D641E67B80238CC37D
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.3.0.0.4.1.8.0.5.3.5.3.5.9.0.5.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.3.0.0.4.1.8.0.7.2.5.9.8.3.2.9.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.8.5.0.4.d.b.9.c.-.7.9.2.9.-.4.1.c.2.-.9.8.b.1.-.6.5.e.0.0.c.2.2.6.4.5.c.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.2.e.d.d.a.b.d.b.-.8.0.1.9.-.4.0.1.d.-.b.d.f.4.-.d.4.b.0.9.f.f.5.e.0.d.9.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.r.u.n.d.l.l.3.2...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.R.U.N.D.L.L.3.2...E.X.E.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.c.a.c.-.0.0.0.1.-.0.0.1.f.-.3.0.f.f.-.b.b.2.1.0.6.9.4.d.9.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.b.c.c.5.d.c.3.2.2.2.0.3.4.d.3.f.2.5.7.f.1.f.d.3.5.8.8.9.e.5.b.e.9.0.f.0.9.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER14BF.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Wed May 31 21:23:18 2023, 0x1205a4 type
Category:	dropped
Size (bytes):	38458
Entropy (8bit):	2.2192292639701816
Encrypted:	false
SSDEEP:	192:efWZgZ53+J+3Frsocz2UNVO5SkbZSEloKv2MhqEEbnE9pzv/a:iC+vcz2I45LbZpoohonUb/a
MD5:	97D3693B4EF44350F4A4F951A7433B16
SHA1:	270CAC659A0FF9705F9D1FB039AFD15BBFF69E83
SHA-256:	4A2E5CF3D9E6B72D150612F6E36D97F9759B6DD47E1BB6CC5721775F344D2388
SHA-512:	54CEAA2BE6AE7A1160DC5D5196D80C816232800091B1154B29825270C00013C707DAA75F2EC52D67B70BBCC69741A5767F42DBC110DA5F76E8BEB95BB339D195
Malicious:	false
Preview:	MDMP....... ........wd............d...............l............)..........T.......8...........T...............:\|...........................................................................................U...........B..............GenuineIntelW...........T.......$....wd.............................0..=...............P.a.c.i.f.i.c. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................P.a.c.i.f.i.c. .D.a.y.l.i.g.h.t. .T.i.m.e...........................................1.7.1.3.4...1...x.8.6.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.....................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER15E9.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8270
Entropy (8bit):	3.6871479945127534
Encrypted:	false
SSDEEP:	192:Rrl7r3GLNi/f6b6YOa6HgmfTASSFCprM89bFBsf8v3m:RrlsNin6b6YD6HgmfTAShF6f5
MD5:	6EB4319F74AA71819345385C3BA9511C
SHA1:	1FCAAB5E01BF906D6C375EA37E0F19D77B43D128
SHA-256:	F9980AF05A859147FBE616E0F25B7415CE050286917D0A4D896ED47EE4A90FE2
SHA-512:	83F999262CD5D776E1C846DD52DB0BD392408C46BFE7AD2E5A816BCC3430A1997758DC7D9236032E1E360927BEDE9CB5ECD3CF0925DBCB00486474462D9101DB
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.7.1.3.4.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.7.1.3.4...1...a.m.d.6.4.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.1.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.1.0.3.3.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.3.1.0.8.<./.P.i.d.>.......

C:\ProgramData\Microsoft\Windows\WER\Temp\WER1657.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4654
Entropy (8bit):	4.457347400273625
Encrypted:	false
SSDEEP:	48:cvIwSD8zsyJgtWI9DeyWgc8sqYjq8fm8M4JCds63xFl+q8/13lx4SrSgd:uITfAMeTgrsqYDJA5QHDWgd
MD5:	A3432F01334F5EF7CB059C7383899A06
SHA1:	8F25130D11BC31E6E94AA93CC336C83394D7AD52
SHA-256:	4C4519B86EE0E27E3B928F82AB2262B2F885A6DF3292306844AA6223B0180235
SHA-512:	0F3A8A639A84DC2351C0EE5415AC3B00E1679295B78F36BE5C846B23BE7A3B363A19A50F3FB630A79211AB920FEACEC1C478B94C92CA1C8F0DB471ACBF34C2D6
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="17134" />.. <arg nm="vercsdbld" val="1" />.. <arg nm="verqfe" val="1" />.. <arg nm="csdbld" val="1" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="1033" />.. <arg nm="geoid" val="244" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="2065353" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.1.17134.0-11.0.47" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="4096" />..

C:\ProgramData\Microsoft\Windows\WER\Temp\WER20E4.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Wed May 31 21:23:21 2023, 0x1205a4 type
Category:	dropped
Size (bytes):	286994
Entropy (8bit):	1.5482379144780642
Encrypted:	false
SSDEEP:	384:vC+qo5LbMUXH0baggLjrgEaw1ULlOAqCUQJyluW+xFQlKTIS+FjTDbD21HErYJSn:v3Vb9g6zA3X4AlndxGRZXZLNR6xa
MD5:	9701ABDFD4E12B24533BCCFB444F04B4
SHA1:	D37308BCF7FC7EAA1A781A5F91A4B071787BB8DC
SHA-256:	4F45A10DF6125E329F8EAABEF6B5D27B444D689BDFEB903AFFAF7D74B7AE1CC7
SHA-512:	7B243854BB39E74091093F59F598EE11EECD41B6B6A29F99B8CF093EF5E7F389C35791C55D3BD0E3D347F3383615196614AC301A6868383D3B5C1859BF7F8EAD
Malicious:	false
Preview:	MDMP....... ........wd............d...............l............)..........T.......8...........T...............bG...........................................................................................U...........B..............GenuineIntelW...........T.......0....wd.............................0..=...............P.a.c.i.f.i.c. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................P.a.c.i.f.i.c. .D.a.y.l.i.g.h.t. .T.i.m.e...........................................1.7.1.3.4...1...x.8.6.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.....................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2337.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8352
Entropy (8bit):	3.688879934283288
Encrypted:	false
SSDEEP:	192:Rrl7r3GLNivb6B9e6YOW63gmf8f1SNcI4FCpDt89bMlsfpEm:RrlsNiT6y6Y/63gmf8f1SNcNM+fP
MD5:	E4F90668EF767D406BA2E33378CCA53F
SHA1:	D735A712402F7727EE62AC08FDB11BCAA99DED6C
SHA-256:	5E6EFAB0482803BE62EB78616E159F38DB5CC976B4ADD3EA929DBBA2427ABC51
SHA-512:	C4AE8243DB7482A043346D08C98954DCF33AF20E2C266A57626647DFD462C53C45C90311866FCE40B3CFE8EDF23733B14BBCC605254C9F39A1A8825735220DA9
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.7.1.3.4.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.7.1.3.4...1...a.m.d.6.4.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.1.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.1.0.3.3.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.2.1.6.<./.P.i.d.>.......

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2396.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4771
Entropy (8bit):	4.4740653873145195
Encrypted:	false
SSDEEP:	48:cvIwSD8zszJgtWI9DeyWgc8sqYjc8fm8M4JCdsO5FVx+q8vjsOj4SrSUd:uITfNMeTgrsqYFJQxKPDWUd
MD5:	1253C18472C784AC18DF110CF2552D73
SHA1:	EF97B2AA024D333E5D159DE06D51608A836CAEE1
SHA-256:	26D22EA7FAE19F339BE28FA9BD7CDF07872901651E9A0A13C6651FB5E6508658
SHA-512:	3F94A7CB243E2E2E14F75F12EA77482FD49312A2F2ADD777E4BB5949B4EDA4F1F3D2726524BE673C0F5989784226050533E05DA0433F272515D3B889AD7AF43E
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="17134" />.. <arg nm="vercsdbld" val="1" />.. <arg nm="verqfe" val="1" />.. <arg nm="csdbld" val="1" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="1033" />.. <arg nm="geoid" val="244" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="2065354" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.1.17134.0-11.0.47" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="4096" />..

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2F8A.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Wed May 31 21:23:25 2023, 0x1205a4 type
Category:	dropped
Size (bytes):	37618
Entropy (8bit):	2.2520075972177924
Encrypted:	false
SSDEEP:	192:pSdhgZ53+J+lfFp3JqlfO5Skb9CDtOpSEih7EJF4CHqv7:jC+l8lW5Lb9Cyu9EJF4z7
MD5:	5684750C419CF9D198095CF397598E2C
SHA1:	889F1CD946931A7750A4885BF86F42DFCB048913
SHA-256:	D27522FD4F037EF6F848827AC1CCE3CBC2D1D703B73CC391DA3BE3BDC38205A2
SHA-512:	4A8F501F0DA1C41C7323C207924305DBDA155C2FBA8FB43D683234A25F34E6B6DCA2082DF6DED7254CBE246D88F3E4CD6BF243B76BFF96A554C6AE40207B203D
Malicious:	false
Preview:	MDMP....... ........wd............d...............l............)..........T.......8...........T................x...........................................................................................U...........B..............GenuineIntelW...........T............wd.............................0..=...............P.a.c.i.f.i.c. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................P.a.c.i.f.i.c. .D.a.y.l.i.g.h.t. .T.i.m.e...........................................1.7.1.3.4...1...x.8.6.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.....................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2FB9.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Wed May 31 21:23:25 2023, 0x1205a4 type
Category:	dropped
Size (bytes):	43946
Entropy (8bit):	2.0878729830638556
Encrypted:	false
SSDEEP:	192:pb9w0RAvrGO5SkbFPaV8SJOugPO8Csi/Ubjfi:HRWR5LbF95u78Csr
MD5:	FFF04828DBA0C4436887867974CCE77C
SHA1:	AF40D46804B4875BDC45294D923C4EEDA5DEA748
SHA-256:	17F1E913321E82709042926185354777C100BFC3AB3E1CC2ECF81F0A0CFE20BA
SHA-512:	E5305E99C7BC9EF16E4245B72D2D6BAF1C3A6227373E8F44B4DF97556D578E630C7A10792F3C7F945CFCC45349FA0C20D4E38036D8395F3E3A3B05A856C78581
Malicious:	false
Preview:	MDMP....... ........wd.........................................,..........T.......8...........T...........................0................................................................................U...........B..............GenuineIntelW...........T............wd.............................0..=...............P.a.c.i.f.i.c. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................P.a.c.i.f.i.c. .D.a.y.l.i.g.h.t. .T.i.m.e...........................................1.7.1.3.4...1...x.8.6.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.....................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER30F2.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Wed May 31 21:23:26 2023, 0x1205a4 type
Category:	dropped
Size (bytes):	286006
Entropy (8bit):	1.5054328929082812
Encrypted:	false
SSDEEP:	768:ACVbAY5VCW3ZGrxQqJM+YnxMv9qquh4UQ7L9t/x:2Y5JZGrxQqJM+Ynx8uh4UQ7Lj/x
MD5:	053F03EE70FE89AD7F0A365770B3CFDA
SHA1:	8E605A9CE2D6E49BC3DC45D5171DEA3F968BE044
SHA-256:	072040A9407BD29732C7F9741C53EC2A3364F900E1A8E82B0F92EF6FC07F2DBC
SHA-512:	DE677A7B482DC733E309E75FE6B0AE8B8118B6B90E52E0C9EFBAE00D78BC92953FAA2AF2C138975AD5E27BD1D9BBAC6DDB6DB40867C374B721679C88BCA7AB2F
Malicious:	false
Preview:	MDMP....... ........wd............d...............l............)..........T.......8...........T................C...........................................................................................U...........B..............GenuineIntelW...........T............wd.............................0..=...............P.a.c.i.f.i.c. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................P.a.c.i.f.i.c. .D.a.y.l.i.g.h.t. .T.i.m.e...........................................1.7.1.3.4...1...x.8.6.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.....................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3121.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Wed May 31 21:23:26 2023, 0x1205a4 type
Category:	dropped
Size (bytes):	288698
Entropy (8bit):	1.5320134708347204
Encrypted:	false
SSDEEP:	384:l1hC+Cl5LbH1uycQYj+I0Dk+6fe+kDEs1v6a7n9yapeZLVsB/jFTBUwwsBH1VIGl:l1hGVbH1p1tfcKJjNEli8sx40d8TPEe6
MD5:	36BF5F69AF9E8B87D72E1CA338A454E8
SHA1:	D348360A48377D417A88AE2B02D4DDF5DD05465C
SHA-256:	21B3C166352D3FD0E0DA46409A059088BDD9B43C6A16DC518EDD80531026B700
SHA-512:	7FFB4E218264C4E1CD18A2EA10FEC5B69EFBF57934E66C9B971B2A0C9756B44A2069416C2036B19AF5E92135AA2B142A7C92B8962D5D99E1189595C81C277C5B
Malicious:	false
Preview:	MDMP....... ........wd............d...............l............)..........T.......8...........T................N...........................................................................................U...........B..............GenuineIntelW...........T............wd.............................0..=...............P.a.c.i.f.i.c. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................P.a.c.i.f.i.c. .D.a.y.l.i.g.h.t. .T.i.m.e...........................................1.7.1.3.4...1...x.8.6.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.....................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER324B.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8262
Entropy (8bit):	3.6882687849265956
Encrypted:	false
SSDEEP:	192:Rrl7r3GLNiwF6Lh6Ye056+egmfTASSFCprU89boOsfL4m:RrlsNiy6d6YP56HgmfTASZoNfB
MD5:	86E72F9FD109BF2FA58519FADF05448A
SHA1:	92A4809AAEB783BACF468EDA9587D16240E6AB4C
SHA-256:	DC8499548B0251E46A697536833B9114ACC80AED8A67B11947442EC7A48E349E
SHA-512:	B6F657861DBC0488293954A60C6D0D1DF69B17468C22297D5B1AB4B136B82EAFB32A0101D353CA81AD6D0BBE81B18AFA993073ABE3DF04F2E369BF7C58CB2D6D
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.7.1.3.4.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.7.1.3.4...1...a.m.d.6.4.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.1.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.1.0.3.3.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.3.3.2.<./.P.i.d.>.......

C:\ProgramData\Microsoft\Windows\WER\Temp\WER327A.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4654
Entropy (8bit):	4.455487140247128
Encrypted:	false
SSDEEP:	48:cvIwSD8zszJgtWI9DeyWgc8sqYjo8fm8M4JCds63xFnikP+q8/13lt4SrSchd:uITfNMeTgrsqYJJAr1QvDW4d
MD5:	021D554F9F313524EE6B99AE5C7172EF
SHA1:	53E6F77C02ADEE8980EF90FCCA9CB357217491A4
SHA-256:	FCF51DAF53F9F53F302F73B45D9C8AAF9FD320B66B2C8FAAFD2B0BA3FC1FC0D1
SHA-512:	66134DD4DE70EE29BC4B242BD059C827967B8B519E2B7255FA7D547897EB8FF01E220556B2544383231F103EA9FF7DEF6DEF376BADCB6A52EFC0847E4AD0B660
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="17134" />.. <arg nm="vercsdbld" val="1" />.. <arg nm="verqfe" val="1" />.. <arg nm="csdbld" val="1" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="1033" />.. <arg nm="geoid" val="244" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="2065354" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.1.17134.0-11.0.47" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="4096" />..

C:\ProgramData\Microsoft\Windows\WER\Temp\WER32B9.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8262
Entropy (8bit):	3.6886771104106506
Encrypted:	false
SSDEEP:	192:Rrl7r3GLNiVr6J1/6Yet6+egmfTASSFCpr+89boKsfS4m:RrlsNi56J1/6Y86HgmfTASvopfs
MD5:	7463525AEB52BEC3CBF5E6A7D1B9B0D9
SHA1:	1435626C43DDCEAA2FF0F8E780C35F30DE2E563F
SHA-256:	6C6F8C9B9905F5D6346F2D406AC713D205F963772848BDDF9CB8CE83922CE5D9
SHA-512:	850083B535AE23620F13B426A53B6B1D3063DD7E0E575B20CE26CABE242EFB51CAA76FED94394B1DA1EE94F8EE28A8E5B78F4D4FA49ED7BF03131F51CAE8BE8F
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.7.1.3.4.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.7.1.3.4...1...a.m.d.6.4.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.1.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.1.0.3.3.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.3.4.0.<./.P.i.d.>.......

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3318.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4654
Entropy (8bit):	4.456108969059627
Encrypted:	false
SSDEEP:	48:cvIwSD8zszJgtWI9DeyWgc8sqYjM8fm8M4JCds63xF2t+q8/13lI4SrSDd:uITfNMeTgrsqYFJAUQKDWDd
MD5:	2E3EA9E5E53E422A644C6D7530A55EB4
SHA1:	71C8740158FACBDBBF6A930E86D733643618D93C
SHA-256:	DF33CF59E64FDD7E9372CE4776E31314B2381C986DABD42A237BC8AB69A6C13C
SHA-512:	0ECA2047024B5885866716AF028D18440BF26BA434839E089682FD8021A7888587E7A2AE3E5D2D5659DAD442C475C786755CDA1C1781BF8B7912A750BAA61679
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="17134" />.. <arg nm="vercsdbld" val="1" />.. <arg nm="verqfe" val="1" />.. <arg nm="csdbld" val="1" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="1033" />.. <arg nm="geoid" val="244" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="2065354" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.1.17134.0-11.0.47" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="4096" />..

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3567.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8342
Entropy (8bit):	3.6894410748941096
Encrypted:	false
SSDEEP:	192:Rrl7r3GLNiZs6/S6Ye56+egmf8f1SNcI4FCpD389boAsf0I4m:RrlsNii6a6YI6Hgmf8f1SNcvoTfr
MD5:	3961EB696FB9F6E87C23492FE511D82F
SHA1:	286F16E0B8700204D724C95B50C63D4B129CF992
SHA-256:	1B0895359B957F284FF5E99562FE353626E24A95EFBC65A38BDECB94DDD79AFF
SHA-512:	7F25D8442E53307801FBE8C946E3AA3ADD39468201D8911ADE2B3AB6744DC3BD850D819C75E07131155D7E7061FC54135CA51299F39A37EFFC7A226C266446D7
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.7.1.3.4.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.7.1.3.4...1...a.m.d.6.4.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.1.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.1.0.3.3.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.4.1.6.<./.P.i.d.>.......

C:\ProgramData\Microsoft\Windows\WER\Temp\WER35C6.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4771
Entropy (8bit):	4.47658935264774
Encrypted:	false
SSDEEP:	48:cvIwSD8zszJgtWI9DeyWgc8sqYjI8fm8M4JCdsO5F7o+q8vjsOd4SrSzd:uITfNMeTgrsqYpJeoKZDWzd
MD5:	1CEE9DB26461442847284B422E66392D
SHA1:	DE9D3559680C1EC39A87E750D7225780193EBFE0
SHA-256:	109175DDCCA0A77AC097BEA51D21A82B48ED50E6AAF07A01975799F03DD39F67
SHA-512:	A36C77491C620A5D208A772C71F8D8C77F8074752C527E13ABBC6E2CE540368BB2E4085FCADC7A3961EC2874F6A22209DCCFC23D969541C1E7098A94523545B8
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="17134" />.. <arg nm="vercsdbld" val="1" />.. <arg nm="verqfe" val="1" />.. <arg nm="csdbld" val="1" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="1033" />.. <arg nm="geoid" val="244" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="2065354" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.1.17134.0-11.0.47" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="4096" />..

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3604.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8342
Entropy (8bit):	3.6913883653704453
Encrypted:	false
SSDEEP:	192:Rrl7r3GLNiNY6ot6Yeb6+egmf8f1SNcI4FCpDU89bxysft7m:RrlsNii6y6YK6Hgmf8f1SNcGxxfs
MD5:	6558F0FC425F067381E7A29EBC97F456
SHA1:	2A423469D88A8D78449CEA50FDE9F30735117D2B
SHA-256:	58A92D20078E84D7F9177973057BCEAEF2C69050DB4336416F5FE2E2C4723A2A
SHA-512:	D8B3A3235EE12740A8A9108F8A73E401662515C7AF98A5908C28248DA0759F2FDEF94DFDEC3E0519E2D8AE132C36B3E9FA1DB0A082D1D108E1025F33EA34B0A0
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.7.1.3.4.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.7.1.3.4...1...a.m.d.6.4.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.1.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.1.0.3.3.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.3.4.8.<./.P.i.d.>.......

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3691.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4771
Entropy (8bit):	4.474001811543964
Encrypted:	false
SSDEEP:	48:cvIwSD8zszJgtWI9DeyWgc8sqYje8fm8M4JCdsO5Fa/+q8vjsOV4SrS9d:uITfNMeTgrsqYnJ/KhDW9d
MD5:	6E76E28CBD706D1AC427093CF8EEC761
SHA1:	30540F60D5EC12A7EE320334AE7D744B48A802B9
SHA-256:	BE57A2B54A2928DAEEA43BE75FC15097E962B1E642AD7528EB12DF6258A32618
SHA-512:	BF63EF33C596D699A86FEE73AA352D37269B5E5D4F6C39AEEAAD22B322B3413726848AA852EE4C4FD75777D6473A96046308E5666D1C3877D563CE7208243EEF
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="17134" />.. <arg nm="vercsdbld" val="1" />.. <arg nm="verqfe" val="1" />.. <arg nm="csdbld" val="1" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="1033" />.. <arg nm="geoid" val="244" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="2065354" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.1.17134.0-11.0.47" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="4096" />..

C:\ProgramData\Microsoft\Windows\WER\Temp\WERB3A.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Wed May 31 21:23:16 2023, 0x1205a4 type
Category:	dropped
Size (bytes):	38422
Entropy (8bit):	2.27011245749655
Encrypted:	false
SSDEEP:	192:wy2Bi4gZ53+J+YFaKQO5SkbwDZ2PRu/J2JFjc+9S7/AFBc3qnDzv:62C+1Kn5LbwDZ2PRu/Mfd2AFBxD7
MD5:	EC52035D56E8AE41CCE8B6C442F6D631
SHA1:	EF5A953D09AA1506467117FB883E63F918D1A061
SHA-256:	7EE52C255BE1BAEBA37E56B9A41FA4FA0C286D28C361B0905AECE11AE4182F0E
SHA-512:	9401DE1CCE14B4A63CD5577CA84AB58FCAA0A68806808A9D21F0D355B1CB57A99B15079871E84E4E7EC45AD9BA04252277CD842330977D1096112AAEDAB7AE7F
Malicious:	false
Preview:	MDMP....... ........wd............d...............l............)..........T.......8...........T...........P....{...........................................................................................U...........B..............GenuineIntelW...........T.......4....wd.............................0..=...............P.a.c.i.f.i.c. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................P.a.c.i.f.i.c. .D.a.y.l.i.g.h.t. .T.i.m.e...........................................1.7.1.3.4...1...x.8.6.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.....................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERB78.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Wed May 31 21:23:16 2023, 0x1205a4 type
Category:	dropped
Size (bytes):	45586
Entropy (8bit):	2.0439425809046137
Encrypted:	false
SSDEEP:	192:wbGw0k5BzO5SkbDJIWqSc9SKKPytuUm1UnOyJ:Hk5Bq5LbDJu7dtcm7J
MD5:	8A51045854634F698967F4F66D235879
SHA1:	670173C33FD0D6919320938F2D399C5ECCC39972
SHA-256:	FCEDAABC3B9B89546936179F0E4FD76BD71CFA7645089A0BFA97B2020F6B599E
SHA-512:	A37500A9A208149FF396EFCD7A074A0D79FD6EA886ED48F3F0CB8FC90D918B0EF19EC13044CDF033715EAB2F42112E905F0AA43976A1D1665B63D15E0B786A8C
Malicious:	false
Preview:	MDMP....... ........wd.........................................,..........T.......8...........T...........................0................................................................................U...........B..............GenuineIntelW...........T............wd.............................0..=...............P.a.c.i.f.i.c. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................P.a.c.i.f.i.c. .D.a.y.l.i.g.h.t. .T.i.m.e...........................................1.7.1.3.4...1...x.8.6.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.....................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERCC1.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8268
Entropy (8bit):	3.6894404174363666
Encrypted:	false
SSDEEP:	192:Rrl7r3GLNii36zQ6Y1k6XRgmfTASSFCprp89bbJsfSpm:RrlsNiS6zQ6Y26hgmfTASebifF
MD5:	419F0E218AA0DBAEE9E7DF45D6050075
SHA1:	B0438A9A8377981D83B314C0C6265AE77ACF9842
SHA-256:	D02A9D14A635379E5C3F9DE113280EA495FBF2E4BCBEB8061935BD4EAE8A299E
SHA-512:	4F5E3194D361EF9609F40184931FAEE7F344B46AE80A7D3AF76E477F3A0C0CF581F149E0AC2784A6B653297552148C2B2E8896FDBD5E5E0BF62070F04119E5BE
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.7.1.3.4.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.7.1.3.4...1...a.m.d.6.4.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.1.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.1.0.3.3.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.5.6.8.4.<./.P.i.d.>.......

C:\ProgramData\Microsoft\Windows\WER\Temp\WERCD1.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8272
Entropy (8bit):	3.688547518650938
Encrypted:	false
SSDEEP:	192:Rrl7r3GLNimq6J1f/6YOb6ogmfTASSFCpr089bbWsf6pm:RrlsNiL6J1H6YC6ogmfTASZb1f9
MD5:	4F2E11BED736260D8CB4E91FA34E0E0A
SHA1:	EFFCE963A530E78F47235F0756423F6CD3955F25
SHA-256:	A60FC90A646CDE5B89E0A426E489742355EFC02FC6BA7829B45CE8F51E3E3308
SHA-512:	87448B4FFC0EDAAD9FB014BD1CA7828187FF059A57B3A2C80353798E315FA93CE092C8B70A61518F7D01C60C3923FC1E8A24C301109556011DE0E9C13C47EBD7
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.7.1.3.4.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.7.1.3.4...1...a.m.d.6.4.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.1.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.1.0.3.3.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.1.3.6.<./.P.i.d.>.......

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD01.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4654
Entropy (8bit):	4.457323415558148
Encrypted:	false
SSDEEP:	48:cvIwSD8zsyJgtWI9DeyWgc8sqYjC8fm8M4JCds63xFnAl+q8/13l54SrS9d:uITfAMeTgrsqYLJAEQbDW9d
MD5:	087DE816C8FC88544B7AB483CFEE9F37
SHA1:	80A0526CF3A23374E13C62D9241DA585B7AB7E2D
SHA-256:	C36CAE6660D1AE60138E5944B2AFE39AF5E363A13C857BF243BE2D700B6317CD
SHA-512:	74A0EEC295B954E4FC8F9104B03D10D868A05B6710B649BBD81E389DFB9BBA75EFC46FC795678A35FE50F078584A5A1339294B31C642CFDD7280024C37FA930D
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="17134" />.. <arg nm="vercsdbld" val="1" />.. <arg nm="verqfe" val="1" />.. <arg nm="csdbld" val="1" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="1033" />.. <arg nm="geoid" val="244" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="2065353" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.1.17134.0-11.0.47" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="4096" />..

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD10.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4654
Entropy (8bit):	4.457062994191233
Encrypted:	false
SSDEEP:	48:cvIwSD8zsyJgtWI9DeyWgc8sqYjC8fm8M4JCds63xF0o+q8/13ljH4SrS8d:uITfAMeTgrsqYzJAzQhDW8d
MD5:	D6E931AAEEFBF1A6FD39AD66F97FF17D
SHA1:	D166C2462C1A9D90B7C9C7C720CC1E6F6262E4A8
SHA-256:	2A10416B468571ED1E0F4CA054367F035174B9A3932B046F2A48B88B5DA86A9B
SHA-512:	399A31F2D2083904DC69D71322A8390B75783D6ADE14EBC5F5DE0E1F314ACC3F37B6CF97F0A492D74F90A1411A83800962046CCE31F6A50A43EA0C197067E436
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="17134" />.. <arg nm="vercsdbld" val="1" />.. <arg nm="verqfe" val="1" />.. <arg nm="csdbld" val="1" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="1033" />.. <arg nm="geoid" val="244" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="2065353" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.1.17134.0-11.0.47" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="4096" />..

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Windows\SysWOW64\wermgr.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 63843 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	63843
Entropy (8bit):	7.99568798138569
Encrypted:	true
SSDEEP:	1536:MRxM2u+06GOIVUvVmMKAfUfsrPa1jfCu18ZNMe3v:KMH+F3IacMZ2CPACu1GN7v
MD5:	3AC860860707BAAF32469FA7CC7C0192
SHA1:	C33C2ACDABA0E6FA41FD2F00F186804722477639
SHA-256:	D015145D551ECD14916270EFAD773BBC9FD57FAD2228D2C24559F696C961D904
SHA-512:	D62AD2408C969A95550FB87EFDA50F988770BA5E39972041BF85924275BAF156B8BEC309ECC6409E5ACDD37EC175DEA40EFF921AB58933B5B5B5D35A6147567C
Malicious:	false
Preview:	MSCF....c.......,...................I..................V. .authroot.stl....e/5..CK..8U....a..t2.1.P. J.".t..2F2e....&))$7I.4...e...+SJE...[.T/..{......c.k....?..Z....bz..qzq.l...,.{...i......39..a.ia....&.3.L2...CTf....I7. ....o.2.0a1m.PG.t.......GH.k.6#L.t2.4._.Y!B.h.....NP~..<Z.G..F#..x"f%...x.aF(.J.3...bf7y.j....)...3......y7UZ..7g~9......."._.t_"K.S...">..,.......V..}.K.Vv3[...A.9O..Ea\..+CEv...6CBKt...K..5qa....!..<./X.......r.. ?(.\[. ......y..... ..V.s.`...k@.`........p...GY..;.`....v..ou..........GH.6.l...P2.(8g.....".......-#...h.U.t..{o./e.wAST.f}0R.(.NM.{...{.=Ch.va'.?W...C....T.pw=.W~+......u.`D.)(..VdN. .py@...%...YY.>.`.....Y.U........}...9....\V~=..-...Q......_0.o.nZ....(6.....4.}.`...s.O.K5.W..4.....s,}...6.....'.8&}.{.....RlZ.?.D4).(.....O......V..V.pk.:]...,.f`D..e.SO.G.%.:).......eo.bU}.....g..$.gui..h.;-....he(.XoY;..6a..x..`lq....:.F!..l.X....!...Lg..53.._....S..G..`...N\|..Zx..o.#}Lnd1.V.eE....I.'..`.....KnN....3....{.

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Windows\SysWOW64\wermgr.exe
File Type:	data
Category:	dropped
Size (bytes):	330
Entropy (8bit):	3.116771890515969
Encrypted:	false
SSDEEP:	6:kKlONFlwFN+SkQlPlEGYRMY9z+4KlDA3RUeg/U3lWQy:ANI2kPlE99SNxAhUe7oQy
MD5:	484DBD248D3B361F08AB51B836A604C1
SHA1:	8957FA1FC8ED8A1F7708595943F614165057F303
SHA-256:	A4ACDB44B8D8E0DD7D95AC663354246645E3A10865CCD78E6F6EDEC851872283
SHA-512:	2402DF038CD18846B63155806816D4E223D6E80A01D1D39894E19D759A57FA6D783CA3855DBDBE3145158535DFABD633D0EE2C8502AB14F726884B0FE67723E8
Malicious:	false
Preview:	p...... ........8......(....................................................... ............w......(...........c...h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".4.6.e.e.f.7.f.b.9.e.7.7.d.9.1.:.0."...

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\GM1SFAFG.htm

Download File

Process:	C:\Windows\SysWOW64\wermgr.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (540)
Category:	dropped
Size (bytes):	125289
Entropy (8bit):	4.77895407529033
Encrypted:	false
SSDEEP:	3072:3fSp4o9/vDD0pB4B+VCD8pAHQzHk9gIFaNXQejUdQ2N8eY:3fSD8eY
MD5:	C1CE7B29280F9C81AC0B13A5C8C3D984
SHA1:	8458516C961BCCCA5F3E31D628C602D96A293A7F
SHA-256:	E7A4F996BF89352870A33FA0C3637B92164BE6A0CB90167A8516225BC52695F2
SHA-512:	4C0E3F2A020C23A886F15572CBDE86488967CB2DDC4E1F3822BE939520469BDE54404E69D712BF9A557F005160A9EEB1A10743885EEA28B2FCE478B3C6F31D0C
Malicious:	false
Preview:	<!DOCTYPE html>... . . . . . . . . . .. . . . . .. . <html lang="en">. <head>. <meta name="pageKey" content="d_homepage-guest-home">. --> <meta name="locale" content="en_US">. <meta id="config" data-app-version="2.1.744" data-call-tree-id="AAX8/G3l18j74m96QqVFNQ==" data-jet-tags="guest-homepage" data-multiproduct-name="homepage-guest-frontend" data-service-name="homepage-guest-frontend" data-browser-id="82ea3cb5-224d-4308-854d-4809ef6a4c33" data-enable-page-view-heartbeat-tracking data-disable-comscore-tracking data-page-instance="urn:li:page:d_homepage-guest-home;+fFaSm7HRRi+TVZWV9hKoA==" data-disable-jsbeacon-pagekey-suffix="false" data-member-id="0">.. <link rel="canonical" href="https://www.linkedin.com/">. <link rel="alternate" hreflang="de" href="https://de.linkedin.com/">. <link rel="alternate" hreflang="en-IE" href="https://ie.linkedin.com/">. <link rel="alternate"

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\t5[1]

Download File

Process:	C:\Windows\SysWOW64\wermgr.exe
File Type:	ASCII text, with no line terminators
Category:	modified
Size (bytes):	188
Entropy (8bit):	5.683975673866817
Encrypted:	false
SSDEEP:	3:hiKNpVnQOJLJx9TrdncC2ZRsrJscNKan2k7b9aUnTWUlWH8MPZNtU8IjdzgynRkU:z7nbJNndmsdVdn20fS8MPZ/wzgyRkU
MD5:	B7729F63A255C1E106EA8D41A0A66937
SHA1:	10AE8840352BAA6C6FE1AD9792B5F5F3BDEB7A2E
SHA-256:	CBCE31F5BAC379FDE53E113E24D609AE4220F703BCE69A949A91D7034773B493
SHA-512:	268886B4FD8540AB75660E06A08F37662C7C7B9BE96B09F1C285E7A3C0AB5EC0E25C0F48B67446F50374A32B602778ADF8846F10C6F7A33D4A52B3430D377031
Malicious:	false
Preview:	yuGJ6IBiidz0EGMRiEkpR4BxnlvlohFNF/X6N/yI9egyQI7iQecol2G3qb8AINRNYzRZJHyhK7TZMbdO9MYkodBYhqZXFuSAc9vkeAOhlQSMkeVJqMsVBE+RC1Bv3t10jIEuFGs4N3aqX2U+qfYhy6GjQjG+NhHzb1tdYZF9IEp8oMEWBhhPvFDCgiPc

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1572864
Entropy (8bit):	4.293654975452905
Encrypted:	false
SSDEEP:	12288:1fzW+VDd5UcH0NAj6+zKLJNhv8+ZThEKWrcPxHDoB6pQf2/3jLPLeFQ:BW+VDd5UcH0NAjsFk
MD5:	7B7E3A3A4DC4AB70EFA11E58E42AEC8C
SHA1:	7C468DA95C394352219912E71ED149D290816C01
SHA-256:	B126447C0B427ECD681F31C08481ED6E92B7EF72AD80BA92AD0E7AFEA45F6294
SHA-512:	8A9928C6533BCFBBB60ECEECA42274E762AC940E63B2356CFB638E1B84C552F28CD7B34EA9EDC410304B7ED5D2E86E5D6B72114C0F985FD682179CFDB6263DA4
Malicious:	false
Preview:	regfj...j...p.\..,.................. ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e...4............E.4............E.....5............E.rmtm......................................................................................................................................................................................................................................................................................................................................................A........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\appcompat\Programs\Amcache.hve.LOG1

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	3.830178712996457
Encrypted:	false
SSDEEP:	384:oIm5Rftx1RPJ4JywHFnql9OsIRCMYVVln:vIRftx1xJ4JzHF+9OKMYJ
MD5:	6E5A4D6E91E9F5B0D250AAD80C81845A
SHA1:	B980E0A4358E06E648EF9E15A9E239543AC1CF5F
SHA-256:	6D5DB6F37AACF929CA3692EBB7B63A8E1C7A73ABB967A84B70ACD7D221FF96F2
SHA-512:	B64A88D17E5C508EA294213F4FCA98D3633B5099A131C8D34BE2CBD46F9DCF5FD9ABC77C08D61FE98D6F0F445DCEE703C4948C2CA215BC60B74BA6E860935385
Malicious:	false
Preview:	regfi...i...p.\..,.................. ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e...4............E.4............E.....5............E.rmtm......................................................................................................................................................................................................................................................................................................................................................AHvLE.>......i...............pG...;.$@/.........0..............hbin................p.\..,..........nk,..\|..........h........................... ...........................&...{ad79c032-a2ea-f756-e377-72fb9332c3ae}......nk ..\|.......... ........................... .......Z.......................Root........lf......Root....nk ..\|.......................}.............. ..............................DeviceCensus.......................vk..................WritePermissionsCheck.......p...

C:\Windows\appcompat\Programs\Amcache.hve.tmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	1.8898448102956298
Encrypted:	false
SSDEEP:	48:SHV5C1pYdAWmcZIRGAv23SS3eX5/cwlApldplCPjD04zISwE:S/C1ppcfAv0C0QALdLq/zIDE
MD5:	191B4618FC4FC6B9901196D54B5419B6
SHA1:	5E6E50E3CA2CDBBFEE07CE23CC093E7DD17C8483
SHA-256:	E30A7C645BCD9CBBEAF2CE9A76F1585E7FB086921CC447440E713A19B8DD6352
SHA-512:	86FBAD5E5F514E706F209B892D0665249D5D682EC5FF06B3E4D72E3B185B8857172CD4499F9BD7407EFF732202517559FC61BF7704EA339979C92E6887BCC52D
Malicious:	false
Preview:	regf................................ ...........C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e...t.m.p...v.............-.v.............-.....w.............-.rmtm....................................................................................................................................................................................................................................................................................................................................................>..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\appcompat\Programs\Amcache.hve.tmp.LOG1

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	1.9234441256749941
Encrypted:	false
SSDEEP:	48:kHV5L+SO8pYdAWmcZIRGAv23SS3eX5/cwlApldplCPjD04zISwE:k/L+h8ppcfAv0C0QALdLq/zIDE
MD5:	B39B0D3D7C48AFDA01C0893BCFAD1AF6
SHA1:	4AF9DE72B2609D15B3A69AE2C9CCC7E04D1351C3
SHA-256:	745C4D01F287E366E870670FC56AC64CBDD7AD32AC0C336E15086A400A9BCA48
SHA-512:	C286768B583A831CBBD373199FA78D2E4267624EA969F4A30617543BCEE6128C897D059F8BD8C51AFCEEFE5770346D6B8F3F187AE54342F04FA113916A4EEEF4
Malicious:	false
Preview:	regf................................ ...........C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e...t.m.p...v.............-.v.............-.....w.............-.rmtm....................................................................................................................................................................................................................................................................................................................................................>..HvLE....................+.C./..F.Ty..u.S........hbin................................nk,............h...........0...........................................&...{11517B7C-E79D-4e20-961B-75A811715ADD}......sk..............(.................................................................................8......................1.?l.cL<.P...b....~z...........8......................1.?l.cL<.P...b....~z.............?...................?...................?........... ... ........... ...

Static File Info

General

File type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Entropy (8bit):	7.135257361651807
TrID:	Win32 Dynamic Link Library (generic) (1002004/3) 99.60% Generic Win/DOS Executable (2004/3) 0.20% DOS Executable Generic (2002/1) 0.20% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	photographed.dat.dll
File size:	366760
MD5:	2c55c2c1b7fbc68e11f48a6a13a34ec1
SHA1:	725de881de6a04ebbdc7422710daa343af3dfc66
SHA256:	6b157281cbb1af882dc0e88eb4832bb892e8c2e1678e0bcf30050d47f015f77f
SHA512:	b34069d217f25824bd6f54467c2f4269be0964b38c0ee8c96a52ea35d7f13c0e426a8629c3e5ae8f55c30cea7d6719c403e59f738f514321c50cf2c67591a454
SSDEEP:	6144:ELh9nrxRw13UyU2G8g1QYYZTDt3n2x+Bdv5zsjiBsTYrPlUEYD/QzkRWAFctOp6c:mInTDtXF15zsjiyZ/0tSkStJB/ts
TLSH:	B774A0A1394084B7F79F06328428D76B90FEA74027F981D71F7CDA5A2EA05C1ED315A3
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......uc.&1..u1..u1..u...u3..u8ziu;..ucj.t4..u1..u...ucj.t:..ucj.t6..ucj.t`..ucj.t0..ucj.u0..ucj.t0..uRich1..u................PE..L..

File Icon


Icon Hash:	7ae282899bbab082

Static PE Info

General

Entrypoint:	0x100297c0
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x10000000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE, DLL
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, GUARD_CF
Time Stamp:	0x5D30EA7C [Thu Jul 18 21:54:04 2019 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	5f7981b73516d0a40ddc313c181df7bc

Authenticode Signature

Signature Valid:
Signature Issuer:
Signature Validation Error:
Error Number:
Not Before, Not After
Subject Chain
Version:
Thumbprint MD5:
Thumbprint SHA-1:
Thumbprint SHA-256:
Serial:

Entrypoint Preview

Instruction
mov eax, 00000001h
retn 000Ch
add eax, 0004E1E8h
add bh, bh
jne 00007FD5DCC34932h
push dword ptr [ebp+0Ch]
push dword ptr [ebp+08h]
call 00007FD5DCC347D8h
add esp, 0Ch
pop ebp
retn 000Ch
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
push ebp
mov ebp, esp
push esi
push dword ptr [ebp+08h]
mov esi, ecx
call 00007FD5DCC12D57h
mov dword ptr [esi], 10003BF0h
mov eax, esi
pop esi
pop ebp
retn 0004h
and dword ptr [ecx+04h], 00000000h
mov eax, ecx
and dword ptr [ecx+08h], 00000000h
mov dword ptr [ecx+04h], 10003BF8h
mov dword ptr [ecx], 10003BF0h
ret
push ebp
mov ebp, esp
sub esp, 0Ch
lea ecx, dword ptr [ebp-0Ch]
call 00007FD5DCC348FFh
push 1002DD1Ch
lea eax, dword ptr [ebp-0Ch]
push eax
call 00007FD5DCC34F78h
int3
jmp 00007FD5DCC34FA2h
push ebp
mov ebp, esp
push 00000000h
call dword ptr [10036094h]
push dword ptr [ebp+08h]
call dword ptr [10036098h]
push C0000409h
call dword ptr [10036040h]
push eax
call dword ptr [10036090h]
pop ebp
ret
push ebp
mov ebp, esp
sub esp, 00000324h
push 00000017h
call 00007FD5DCC34FCAh
test eax, eax
je 00007FD5DCC34927h
push 00000002h
pop ecx
int 29h
mov dword ptr [00000098h], eax

Rich Headers

Programming Language:

[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x2dd60	0x4b9c	.text
IMAGE_DIRECTORY_ENTRY_IMPORT	0x36228	0xb4	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x38000	0x408	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x39000	0x41e0	.rsrc
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x39000	0x2c50	.rsrc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x3c20	0x38	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x3c58	0x40	.text
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x36000	0x224	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x318fc	0x31a00	False	0.4846160658060453	data	6.473830763626044	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x33000	0x2ed4	0x2c00	False	0.1621981534090909	data	4.8559210172488525	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x36000	0x110c	0x1200	False	0.4971788194444444	data	5.287070500270899	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x38000	0x1a6e0	0x1b000	False	0.9550600405092593	data	7.905497592919236	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x53000	0x2c50	0x2e00	False	0.6877547554347826	data	6.460394547113394	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_VERSION	0x38060	0x3a4	data	English	United States

Imports

DLL

Import

KERNEL32.dll

SetLastError, DeleteTimerQueueTimer, ChangeTimerQueueTimer, CreateTimerQueueTimer, GetLogicalProcessorInformation, TlsFree, TlsSetValue, TlsGetValue, TlsAlloc, GetThreadPriority, SetThreadPriority, CreateThread, SwitchToThread, SignalObjectAndWait, Sleep, GetCurrentThreadId, GetCurrentProcess, WaitForSingleObjectEx, SetEvent, GetLastError, DuplicateHandle, CloseHandle, GetCurrentThread, CreateTimerQueue, QueryDepthSList, InterlockedFlushSList, InterlockedPushEntrySList, InterlockedPopEntrySList, GetProcAddress, GetNumaHighestNodeNumber, DisableThreadLibraryCalls, GetSystemTimeAsFileTime, GetCurrentProcessId, QueryPerformanceCounter, IsDebuggerPresent, IsProcessorFeaturePresent, TerminateProcess, SetUnhandledExceptionFilter, UnhandledExceptionFilter, GetModuleHandleA, GetModuleFileNameW, FreeLibraryAndExitThread, FreeLibrary, GetThreadTimes, OutputDebugStringW, LoadLibraryW, LoadLibraryExW, GetModuleHandleW, EncodePointer, UnregisterWaitEx, ReleaseSemaphore, InitializeSListHead, SetProcessAffinityMask, VirtualFree, VirtualProtect, VirtualAlloc, GetVersionExW, DeleteCriticalSection, TryEnterCriticalSection, LeaveCriticalSection, EnterCriticalSection, UnregisterWait, RegisterWaitForSingleObject, SetThreadAffinityMask, GetProcessAffinityMask

Exports

Name	Ordinal	Address
m?0?$_SpinWait@$00@details@Concurrency@@QAE@P6AXXZ@Z	1	0x10007370
m?0?$_SpinWait@$0A@@details@Concurrency@@QAE@P6AXXZ@Z	2	0x10007370
m?0SchedulerPolicy@Concurrency@@QAA@IZZ	3	0x10020d30
m?0SchedulerPolicy@Concurrency@@QAE@ABV01@@Z	4	0x10020d50
m?0SchedulerPolicy@Concurrency@@QAE@XZ	5	0x10020d80
m?0_Cancellation_beacon@details@Concurrency@@QAE@XZ	6	0x10010110
m?0_Concurrent_queue_base_v4@details@Concurrency@@IAE@I@Z	7	0x1000e6f0
m?0_Concurrent_queue_iterator_base_v4@details@Concurrency@@IAE@ABV_Concurrent_queue_base_v4@12@@Z	8	0x1000e760
m?0_Condition_variable@details@Concurrency@@QAE@XZ	9	0x10012150
m?0_Context@details@Concurrency@@QAE@PAVContext@2@@Z	10	0x10007a70
m?0_NonReentrantBlockingLock@details@Concurrency@@QAE@XZ	11	0x10016e30
m?0_NonReentrantPPLLock@details@Concurrency@@QAE@XZ	12	0x10016e50
m?0_ReaderWriterLock@details@Concurrency@@QAE@XZ	13	0x10016e60
m?0_ReentrantBlockingLock@details@Concurrency@@QAE@XZ	14	0x10016e30
m?0_ReentrantLock@details@Concurrency@@QAE@XZ	15	0x10016e70
m?0_ReentrantPPLLock@details@Concurrency@@QAE@XZ	16	0x10016e80
m?0_Runtime_object@details@Concurrency@@QAE@H@Z	17	0x10007a80
m?0_Runtime_object@details@Concurrency@@QAE@XZ	18	0x10007aa0
m?0_Scheduler@details@Concurrency@@QAE@PAVScheduler@2@@Z	19	0x10007a70
m?0_Scoped_lock@_NonReentrantPPLLock@details@Concurrency@@QAE@AAV123@@Z	20	0x10016ea0
m?0_Scoped_lock@_ReentrantPPLLock@details@Concurrency@@QAE@AAV123@@Z	21	0x10016ed0
m?0_SpinLock@details@Concurrency@@QAE@ACJ@Z	22	0x100286b0
m?0_StructuredTaskCollection@details@Concurrency@@QAE@PAV_CancellationTokenState@12@@Z	23	0x100244d0
m?0_TaskCollection@details@Concurrency@@QAE@PAV_CancellationTokenState@12@@Z	24	0x10024630
m?0_TaskCollection@details@Concurrency@@QAE@XZ	25	0x100246e0
m?0_Timer@details@Concurrency@@IAE@I_N@Z	26	0x10026cd0
m?0agent@Concurrency@@QAE@AAVScheduleGroup@1@@Z	27	0x10007ac0
m?0agent@Concurrency@@QAE@AAVScheduler@1@@Z	28	0x10007b30
m?0agent@Concurrency@@QAE@XZ	29	0x10007ba0
m?0bad_target@Concurrency@@QAE@PBD@Z	30	0x10013250
m?0bad_target@Concurrency@@QAE@XZ	31	0x10013270
m?0context_self_unblock@Concurrency@@QAE@PBD@Z	32	0x10013290
m?0context_self_unblock@Concurrency@@QAE@XZ	33	0x100132b0
m?0context_unblock_unbalanced@Concurrency@@QAE@PBD@Z	34	0x100132d0
m?0context_unblock_unbalanced@Concurrency@@QAE@XZ	35	0x100132f0
m?0critical_section@Concurrency@@QAE@XZ	36	0x10016f00
m?0default_scheduler_exists@Concurrency@@QAE@PBD@Z	37	0x10013310
m?0default_scheduler_exists@Concurrency@@QAE@XZ	38	0x10013330
m?0event@Concurrency@@QAE@XZ	39	0x10012170
m?0improper_lock@Concurrency@@QAE@PBD@Z	40	0x10013350
m?0improper_lock@Concurrency@@QAE@XZ	41	0x10013370
m?0improper_scheduler_attach@Concurrency@@QAE@PBD@Z	42	0x10013390
m?0improper_scheduler_attach@Concurrency@@QAE@XZ	43	0x100133b0
m?0improper_scheduler_detach@Concurrency@@QAE@PBD@Z	44	0x100133d0
m?0improper_scheduler_detach@Concurrency@@QAE@XZ	45	0x100133f0
m?0improper_scheduler_reference@Concurrency@@QAE@PBD@Z	46	0x10013410
m?0improper_scheduler_reference@Concurrency@@QAE@XZ	47	0x10013430
m?0invalid_link_target@Concurrency@@QAE@PBD@Z	48	0x10013450
m?0invalid_link_target@Concurrency@@QAE@XZ	49	0x10013470
m?0invalid_multiple_scheduling@Concurrency@@QAE@PBD@Z	50	0x10013490
m?0invalid_multiple_scheduling@Concurrency@@QAE@XZ	51	0x100134b0
m?0invalid_oversubscribe_operation@Concurrency@@QAE@PBD@Z	52	0x100134d0
m?0invalid_oversubscribe_operation@Concurrency@@QAE@XZ	53	0x100134f0
m?0invalid_scheduler_policy_key@Concurrency@@QAE@PBD@Z	54	0x10013510
m?0invalid_scheduler_policy_key@Concurrency@@QAE@XZ	55	0x10013530
m?0invalid_scheduler_policy_thread_specification@Concurrency@@QAE@PBD@Z	56	0x10013550
m?0invalid_scheduler_policy_thread_specification@Concurrency@@QAE@XZ	57	0x10013570
m?0invalid_scheduler_policy_value@Concurrency@@QAE@PBD@Z	58	0x10013590
m?0invalid_scheduler_policy_value@Concurrency@@QAE@XZ	59	0x100135b0
m?0message_not_found@Concurrency@@QAE@PBD@Z	60	0x100135d0
m?0message_not_found@Concurrency@@QAE@XZ	61	0x100135f0
m?0missing_wait@Concurrency@@QAE@PBD@Z	62	0x10013610
m?0missing_wait@Concurrency@@QAE@XZ	63	0x10013630
m?0nested_scheduler_missing_detach@Concurrency@@QAE@PBD@Z	64	0x10013650
m?0nested_scheduler_missing_detach@Concurrency@@QAE@XZ	65	0x10013670
m?0operation_timed_out@Concurrency@@QAE@PBD@Z	66	0x10013690
m?0operation_timed_out@Concurrency@@QAE@XZ	67	0x100136b0
m?0reader_writer_lock@Concurrency@@QAE@XZ	68	0x10016f40
m?0scheduler_not_attached@Concurrency@@QAE@PBD@Z	69	0x100136d0
m?0scheduler_not_attached@Concurrency@@QAE@XZ	70	0x100136f0
m?0scheduler_resource_allocation_error@Concurrency@@QAE@J@Z	71	0x10013710
m?0scheduler_resource_allocation_error@Concurrency@@QAE@PBDJ@Z	72	0x10013730
m?0scheduler_worker_creation_error@Concurrency@@QAE@J@Z	73	0x10013760
m?0scheduler_worker_creation_error@Concurrency@@QAE@PBDJ@Z	74	0x10013780
m?0scoped_lock@critical_section@Concurrency@@QAE@AAV12@@Z	75	0x10016ea0
m?0scoped_lock@reader_writer_lock@Concurrency@@QAE@AAV12@@Z	76	0x10016f70
m?0scoped_lock_read@reader_writer_lock@Concurrency@@QAE@AAV12@@Z	77	0x10016fa0
m?0unsupported_os@Concurrency@@QAE@PBD@Z	78	0x100137a0
m?0unsupported_os@Concurrency@@QAE@XZ	79	0x100137c0
m?1SchedulerPolicy@Concurrency@@QAE@XZ	80	0x10020df0
m?1_Cancellation_beacon@details@Concurrency@@QAE@XZ	81	0x100101f0
m?1_Concurrent_queue_base_v4@details@Concurrency@@MAE@XZ	82	0x1000e7d0
m?1_Concurrent_queue_iterator_base_v4@details@Concurrency@@IAE@XZ	83	0x1000e810
m?1_Concurrent_vector_base_v4@details@Concurrency@@IAE@XZ	84	0x1000ef10
m?1_Condition_variable@details@Concurrency@@QAE@XZ	85	0x100121c0
m?1_NonReentrantBlockingLock@details@Concurrency@@QAE@XZ	86	0x10016fc0
m?1_ReentrantBlockingLock@details@Concurrency@@QAE@XZ	87	0x10016fc0
m?1_Scoped_lock@_NonReentrantPPLLock@details@Concurrency@@QAE@XZ	88	0x10016fd0
m?1_Scoped_lock@_ReentrantPPLLock@details@Concurrency@@QAE@XZ	89	0x10017010
m?1_SpinLock@details@Concurrency@@QAE@XZ	90	0x10028700
m?1_StructuredTaskCollection@details@Concurrency@@QAE@XZ	91	0x100247c0
m?1_TaskCollection@details@Concurrency@@QAE@XZ	92	0x10024840
m?1_Timer@details@Concurrency@@MAE@XZ	93	0x10026cf0
m?1agent@Concurrency@@UAE@XZ	94	0x10008a60
m?1critical_section@Concurrency@@QAE@XZ	95	0x1000a500
m?1event@Concurrency@@QAE@XZ	96	0x10012210
m?1reader_writer_lock@Concurrency@@QAE@XZ	97	0x1000a500
m?1scoped_lock@critical_section@Concurrency@@QAE@XZ	98	0x10016fd0
m?1scoped_lock@reader_writer_lock@Concurrency@@QAE@XZ	99	0x10017050
m?1scoped_lock_read@reader_writer_lock@Concurrency@@QAE@XZ	100	0x10017050
m?4?$_SpinWait@$00@details@Concurrency@@QAEAAV012@$$QAV012@@Z	101	0x10008ad0
m?4?$_SpinWait@$00@details@Concurrency@@QAEAAV012@ABV012@@Z	102	0x10008b00
m?4?$_SpinWait@$0A@@details@Concurrency@@QAEAAV012@$$QAV012@@Z	103	0x10008ad0
m?4?$_SpinWait@$0A@@details@Concurrency@@QAEAAV012@ABV012@@Z	104	0x10008b00
m?4SchedulerPolicy@Concurrency@@QAEAAV01@ABV01@@Z	105	0x10020e00
m?_F?$_SpinWait@$00@details@Concurrency@@QAEXXZ	106	0x10008db0
m?_F?$_SpinWait@$0A@@details@Concurrency@@QAEXXZ	107	0x10008db0
m?_F_Context@details@Concurrency@@QAEXXZ	108	0x10008dc0
m?_F_Scheduler@details@Concurrency@@QAEXXZ	109	0x10008dc0
mAgentEventGuid@Concurrency@@3U_GUID@@B	110	0x10003ab4
mAlloc@Concurrency@@YAPAXI@Z	111	0x100242c0
mBlock@Context@Concurrency@@SAXXZ	112	0x1000fdf0
mChoreEventGuid@Concurrency@@3U_GUID@@B	113	0x10003a44
mConcRTEventGuid@Concurrency@@3U_GUID@@B	114	0x10003a04
mConcRT_ProviderGuid@Concurrency@@3U_GUID@@B	115	0x100039f4
mContextEventGuid@Concurrency@@3U_GUID@@B	116	0x10003a34
mCreate@CurrentScheduler@Concurrency@@SAXABVSchedulerPolicy@2@@Z	117	0x10011da0
mCreate@Scheduler@Concurrency@@SAPAV12@ABVSchedulerPolicy@2@@Z	118	0x1001e340
mCreateResourceManager@Concurrency@@YAPAUIResourceManager@1@XZ	119	0x10018480
mCreateScheduleGroup@CurrentScheduler@Concurrency@@SAPAVScheduleGroup@2@AAVlocation@2@@Z	120	0x10011dd0
mCreateScheduleGroup@CurrentScheduler@Concurrency@@SAPAVScheduleGroup@2@XZ	121	0x10011e00
mCurrentContext@Context@Concurrency@@SAPAV12@XZ	122	0x1000fe10
mDetach@CurrentScheduler@Concurrency@@SAXXZ	123	0x10011e20
mDisableTracing@Concurrency@@YAJXZ	124	0x100109f0
mEnableTracing@Concurrency@@YAJXZ	125	0x100109f0
mFree@Concurrency@@YAXPAX@Z	126	0x10024390
mGet@CurrentScheduler@Concurrency@@SAPAVScheduler@2@XZ	127	0x10011e50
mGetExecutionContextId@Concurrency@@YAIXZ	128	0x10019a50
mGetNumberOfVirtualProcessors@CurrentScheduler@Concurrency@@SAIXZ	129	0x10011e60
mGetOSVersion@Concurrency@@YA?AW4OSVersion@IResourceManager@1@XZ	130	0x10019b80
mGetPolicy@CurrentScheduler@Concurrency@@SA?AVSchedulerPolicy@2@XZ	131	0x10011e90
mGetPolicyValue@SchedulerPolicy@Concurrency@@QBEIW4PolicyElementKey@2@@Z	132	0x10020e20
mGetProcessorCount@Concurrency@@YAIXZ	133	0x10019b90
mGetProcessorNodeCount@Concurrency@@YAIXZ	134	0x10019ba0
mGetSchedulerId@Concurrency@@YAIXZ	135	0x10019bb0
mGetSharedTimerQueue@details@Concurrency@@YAPAXXZ	136	0x10012450
mId@Context@Concurrency@@SAIXZ	137	0x1000fe40
mId@CurrentScheduler@Concurrency@@SAIXZ	138	0x10011ec0
mIsAvailableLocation@CurrentScheduler@Concurrency@@SA_NABVlocation@2@@Z	139	0x10011ef0
mIsCurrentTaskCollectionCanceling@Context@Concurrency@@SA_NXZ	140	0x1000fe70
mLockEventGuid@Concurrency@@3U_GUID@@B	141	0x10003a64
mLog2@details@Concurrency@@YAKI@Z	142	0x10028810
mNFS_Allocate@details@Concurrency@@YAPAXIIPAX@Z	143	0x1000d980
mNFS_Free@details@Concurrency@@YAXPAX@Z	144	0x1000d9e0
mNFS_GetLineSize@details@Concurrency@@YAIXZ	145	0x1000da00
mOversubscribe@Context@Concurrency@@SAX_N@Z	146	0x1000feb0
mPPLParallelForEventGuid@Concurrency@@3U_GUID@@B	147	0x10003a94
mPPLParallelForeachEventGuid@Concurrency@@3U_GUID@@B	148	0x10003aa4
mPPLParallelInvokeEventGuid@Concurrency@@3U_GUID@@B	149	0x10003a84
mRegisterShutdownEvent@CurrentScheduler@Concurrency@@SAXPAX@Z	150	0x10011f20
mResetDefaultSchedulerPolicy@Scheduler@Concurrency@@SAXXZ	151	0x100202d0
mResourceManagerEventGuid@Concurrency@@3U_GUID@@B	152	0x10003a74
mScheduleGroupEventGuid@Concurrency@@3U_GUID@@B	153	0x10003a24
mScheduleGroupId@Context@Concurrency@@SAIXZ	154	0x1000fee0
mScheduleTask@CurrentScheduler@Concurrency@@SAXP6AXPAX@Z0@Z	155	0x10011f70
mScheduleTask@CurrentScheduler@Concurrency@@SAXP6AXPAX@Z0AAVlocation@2@@Z	156	0x10011fa0
mSchedulerEventGuid@Concurrency@@3U_GUID@@B	157	0x10003a14
mSetConcurrencyLimits@SchedulerPolicy@Concurrency@@QAEXII@Z	158	0x10020e60
mSetDefaultSchedulerPolicy@Scheduler@Concurrency@@SAXABVSchedulerPolicy@2@@Z	159	0x10020490
mSetPolicyValue@SchedulerPolicy@Concurrency@@QAEIW4PolicyElementKey@2@I@Z	160	0x10020ef0
mVirtualProcessorEventGuid@Concurrency@@3U_GUID@@B	161	0x10003a54
mVirtualProcessorId@Context@Concurrency@@SAIXZ	162	0x1000ff10
mYield@Context@Concurrency@@SAXXZ	163	0x1000ff40
m_Abort@_StructuredTaskCollection@details@Concurrency@@AAEXXZ	164	0x10024b40
m_Acquire@_NonReentrantBlockingLock@details@Concurrency@@QAEXXZ	165	0x10017300
m_Acquire@_NonReentrantPPLLock@details@Concurrency@@QAEXPAX@Z	166	0x10017310
m_Acquire@_ReentrantBlockingLock@details@Concurrency@@QAEXXZ	167	0x10017300
m_Acquire@_ReentrantLock@details@Concurrency@@QAEXXZ	168	0x10017330
m_Acquire@_ReentrantPPLLock@details@Concurrency@@QAEXPAX@Z	169	0x10017390
m_AcquireRead@_ReaderWriterLock@details@Concurrency@@QAEXXZ	170	0x100173d0
m_AcquireWrite@_ReaderWriterLock@details@Concurrency@@QAEXXZ	171	0x10017400
m_Advance@_Concurrent_queue_iterator_base_v4@details@Concurrency@@IAEXXZ	172	0x1000e9a0
m_Assign@_Concurrent_queue_iterator_base_v4@details@Concurrency@@IAEXABV123@@Z	173	0x1000e9f0
m_Byte_reverse_table@details@Concurrency@@3QBEB	174	0x10002c68
m_Cancel@_StructuredTaskCollection@details@Concurrency@@QAEXXZ	175	0x10024df0
m_Cancel@_TaskCollection@details@Concurrency@@QAEXXZ	176	0x10024ef0
m_CheckTaskCollection@_UnrealizedChore@details@Concurrency@@IAEXXZ	177	0x1000dd80
m_CleanupToken@_StructuredTaskCollection@details@Concurrency@@AAEXXZ	178	0x10025070
m_ConcRT_CoreAssert@details@Concurrency@@YAXPBD0H@Z	179	0x100289c0
m_ConcRT_Trace@details@Concurrency@@YAXHPB_WZZ	180	0x100289d0
m_Confirm_cancel@_Cancellation_beacon@details@Concurrency@@QAE_NXZ	181	0x10011c60
m_CurrentContext@_Context@details@Concurrency@@SA?AV123@XZ	182	0x1000ff60
m_Current_node@location@Concurrency@@SA?AV12@XZ	183	0x10015f00
m_Destroy@_AsyncTaskCollection@details@Concurrency@@EAEXXZ	184	0x1000df10
m_DoYield@?$_SpinWait@$00@details@Concurrency@@IAEXXZ	185	0x100099a0
m_DoYield@?$_SpinWait@$0A@@details@Concurrency@@IAEXXZ	186	0x10011c90
m_Get@_CurrentScheduler@details@Concurrency@@SA?AV_Scheduler@23@XZ	187	0x10011fd0
m_GetCombinableSize@details@Concurrency@@YAIXZ	188	0x10016d50
m_GetConcRTTraceInfo@Concurrency@@YAPBU_CONCRT_TRACE_INFO@details@1@XZ	189	0x10027300
m_GetConcurrency@details@Concurrency@@YAIXZ	190	0x10019b90
m_GetCurrentInlineDepth@_StackGuard@details@Concurrency@@CAAAIXZ	191	0x10011ca0
m_GetNumberOfVirtualProcessors@_CurrentScheduler@details@Concurrency@@SAIXZ	192	0x10011ff0
m_GetScheduler@_Scheduler@details@Concurrency@@QAEPAVScheduler@3@XZ	193	0x10009b00
m_Id@_CurrentScheduler@details@Concurrency@@SAIXZ	194	0x10012010
m_Internal_assign@_Concurrent_vector_base_v4@details@Concurrency@@IAEXABV123@IP6AXPAXI@ZP6AX1PBXI@Z4@Z	195	0x1000ef60
m_Internal_capacity@_Concurrent_vector_base_v4@details@Concurrency@@IBEIXZ	196	0x1000f100
m_Internal_clear@_Concurrent_vector_base_v4@details@Concurrency@@IAEIP6AXPAXI@Z@Z	197	0x1000f120
m_Internal_compact@_Concurrent_vector_base_v4@details@Concurrency@@IAEPAXIPAXP6AX0I@ZP6AX0PBXI@Z@Z	198	0x1000f190
m_Internal_copy@_Concurrent_vector_base_v4@details@Concurrency@@IAEXABV123@IP6AXPAXPBXI@Z@Z	199	0x1000f3b0
m_Internal_empty@_Concurrent_queue_base_v4@details@Concurrency@@IBE_NXZ	200	0x1000ea40
m_Internal_finish_clear@_Concurrent_queue_base_v4@details@Concurrency@@IAEXXZ	201	0x1000ea70
m_Internal_grow_by@_Concurrent_vector_base_v4@details@Concurrency@@IAEIIIP6AXPAXPBXI@Z1@Z	202	0x1000f540
m_Internal_grow_to_at_least_with_result@_Concurrent_vector_base_v4@details@Concurrency@@IAEIIIP6AXPAXPBXI@Z1@Z	203	0x1000f640
m_Internal_move_push@_Concurrent_queue_base_v4@details@Concurrency@@IAEXPAX@Z	204	0x1000eac0
m_Internal_pop_if_present@_Concurrent_queue_base_v4@details@Concurrency@@IAE_NPAX@Z	205	0x1000eb00
m_Internal_push@_Concurrent_queue_base_v4@details@Concurrency@@IAEXPBX@Z	206	0x1000eb50
m_Internal_push_back@_Concurrent_vector_base_v4@details@Concurrency@@IAEPAXIAAI@Z	207	0x1000f720
m_Internal_reserve@_Concurrent_vector_base_v4@details@Concurrency@@IAEXIII@Z	208	0x1000f7e0
m_Internal_resize@_Concurrent_vector_base_v4@details@Concurrency@@IAEXIIIP6AXPAXI@ZP6AX0PBXI@Z2@Z	209	0x1000f880
m_Internal_size@_Concurrent_queue_base_v4@details@Concurrency@@IBEIXZ	210	0x1000eb90
m_Internal_swap@_Concurrent_queue_base_v4@details@Concurrency@@IAEXAAV123@@Z	211	0x1000eba0
m_Internal_swap@_Concurrent_vector_base_v4@details@Concurrency@@IAEXAAV123@@Z	212	0x1000fa30
m_Internal_throw_exception@_Concurrent_queue_base_v4@details@Concurrency@@IBEXXZ	213	0x1000ebc0
m_Internal_throw_exception@_Concurrent_vector_base_v4@details@Concurrency@@IBEXI@Z	214	0x1000faf0
m_IsCanceling@_StructuredTaskCollection@details@Concurrency@@QAE_NXZ	215	0x10025260
m_IsCanceling@_TaskCollection@details@Concurrency@@QAE_NXZ	216	0x100252e0
m_IsSynchronouslyBlocked@_Context@details@Concurrency@@QBE_NXZ	217	0x1000ff80
m_NewCollection@_AsyncTaskCollection@details@Concurrency@@SAPAV123@PAV_CancellationTokenState@23@@Z	218	0x100253d0
m_NumberOfSpins@?$_SpinWait@$00@details@Concurrency@@IAEKXZ	219	0x10009e10
m_NumberOfSpins@?$_SpinWait@$0A@@details@Concurrency@@IAEKXZ	220	0x10009e10
m_Oversubscribe@_Context@details@Concurrency@@SAX_N@Z	221	0x1000feb0
m_Reference@_Scheduler@details@Concurrency@@QAEIXZ	222	0x1000ff80
m_Release@_NonReentrantBlockingLock@details@Concurrency@@QAEXXZ	223	0x100175c0
m_Release@_NonReentrantPPLLock@details@Concurrency@@QAEXXZ	224	0x100175d0
m_Release@_ReentrantBlockingLock@details@Concurrency@@QAEXXZ	225	0x100175c0
m_Release@_ReentrantLock@details@Concurrency@@QAEXXZ	226	0x100175e0
m_Release@_ReentrantPPLLock@details@Concurrency@@QAEXXZ	227	0x10017610
m_Release@_Scheduler@details@Concurrency@@QAEIXZ	228	0x10020d10
m_ReleaseRead@_ReaderWriterLock@details@Concurrency@@QAEXXZ	229	0x10017630
m_ReleaseWrite@_ReaderWriterLock@details@Concurrency@@QAEXXZ	230	0x10017640
m_Reset@?$_SpinWait@$00@details@Concurrency@@IAEXXZ	231	0x1000a090
m_Reset@?$_SpinWait@$0A@@details@Concurrency@@IAEXXZ	232	0x10011cb0
m_RunAndWait@_StructuredTaskCollection@details@Concurrency@@QAG?AW4_TaskCollectionStatus@23@PAV_UnrealizedChore@23@@Z	233	0x100255f0
m_RunAndWait@_TaskCollection@details@Concurrency@@QAG?AW4_TaskCollectionStatus@23@PAV_UnrealizedChore@23@@Z	234	0x10025890
m_Schedule@_StructuredTaskCollection@details@Concurrency@@QAEXPAV_UnrealizedChore@23@@Z	235	0x10025c60
m_Schedule@_StructuredTaskCollection@details@Concurrency@@QAEXPAV_UnrealizedChore@23@PAVlocation@3@@Z	236	0x10025cc0
m_Schedule@_TaskCollection@details@Concurrency@@QAEXPAV_UnrealizedChore@23@@Z	237	0x10025d20
m_Schedule@_TaskCollection@details@Concurrency@@QAEXPAV_UnrealizedChore@23@PAVlocation@3@@Z	238	0x10025e10
m_ScheduleTask@_CurrentScheduler@details@Concurrency@@SAXP6AXPAX@Z0@Z	239	0x10011f70
m_Segment_index_of@_Concurrent_vector_base_v4@details@Concurrency@@KAII@Z	240	0x1000fb50
m_SetSpinCount@?$_SpinWait@$00@details@Concurrency@@QAEXI@Z	241	0x1000a120
m_SetSpinCount@?$_SpinWait@$0A@@details@Concurrency@@QAEXI@Z	242	0x10011ce0
m_ShouldSpinAgain@?$_SpinWait@$00@details@Concurrency@@IAE_NXZ	243	0x1000a140
m_ShouldSpinAgain@?$_SpinWait@$0A@@details@Concurrency@@IAE_NXZ	244	0x1000a140
m_SpinOnce@?$_SpinWait@$00@details@Concurrency@@QAE_NXZ	245	0x1000a150
m_SpinOnce@?$_SpinWait@$0A@@details@Concurrency@@QAE_NXZ	246	0x10011d00
m_SpinYield@Context@Concurrency@@SAXXZ	247	0x1000ffa0
m_Start@_Timer@details@Concurrency@@IAEXXZ	248	0x10026e50
m_Stop@_Timer@details@Concurrency@@IAEXXZ	249	0x10026ed0
m_Trace_agents@Concurrency@@YAXW4Agents_EventType@1@_JZZ	250	0x10027390
m_Trace_ppl_function@Concurrency@@YAXABU_GUID@@EW4ConcRT_EventType@1@@Z	251	0x10027470
m_TryAcquire@_NonReentrantBlockingLock@details@Concurrency@@QAE_NXZ	252	0x10017770
m_TryAcquire@_ReentrantBlockingLock@details@Concurrency@@QAE_NXZ	253	0x10017770
m_TryAcquire@_ReentrantLock@details@Concurrency@@QAE_NXZ	254	0x10017780
m_TryAcquireWrite@_ReaderWriterLock@details@Concurrency@@QAE_NXZ	255	0x100177b0
m_UnderlyingYield@details@Concurrency@@YAXXZ	256	0x10028ae0
m_Value@_SpinCount@details@Concurrency@@SAIXZ	257	0x10017830
m_Yield@_Context@details@Concurrency@@SAXXZ	258	0x1000ff40
mcancel@agent@Concurrency@@QAE_NXZ	259	0x1000ab80
mcurrent@location@Concurrency@@SA?AV12@XZ	260	0x10016030
mdone@agent@Concurrency@@IAE_NXZ	261	0x1000af70
mfrom_numa_node@location@Concurrency@@SA?AV12@G@Z	262	0x100160c0
mget_error_code@scheduler_resource_allocation_error@Concurrency@@QBEJXZ	263	0x10013810
mis_current_task_group_canceling@Concurrency@@YA_NXZ	264	0x10016d80
mlock@critical_section@Concurrency@@QAEXXZ	265	0x10017880
mlock@reader_writer_lock@Concurrency@@QAEXXZ	266	0x1000d320
mlock_read@reader_writer_lock@Concurrency@@QAEXXZ	267	0x100178e0
mnative_handle@critical_section@Concurrency@@QAEAAV12@XZ	268	0x10017990
mnotify_all@_Condition_variable@details@Concurrency@@QAEXXZ	269	0x10012a80
mnotify_one@_Condition_variable@details@Concurrency@@QAEXXZ	270	0x10012af0
mreset@event@Concurrency@@QAEXXZ	271	0x10012b80
mset@event@Concurrency@@QAEXXZ	272	0x10012be0
mset_task_execution_resources@Concurrency@@YAXGPAU_GROUP_AFFINITY@@@Z	273	0x1001bf30
mset_task_execution_resources@Concurrency@@YAXK@Z	274	0x1001bf40
mstart@agent@Concurrency@@QAE_NXZ	275	0x1000c850
mstatus@agent@Concurrency@@QAE?AW4agent_status@2@XZ	276	0x1000c8f0
mstatus_port@agent@Concurrency@@QAEPAV?$ISource@W4agent_status@Concurrency@@@2@XZ	277	0x1000c910
mtry_lock@critical_section@Concurrency@@QAE_NXZ	278	0x100179a0
mtry_lock@reader_writer_lock@Concurrency@@QAE_NXZ	279	0x100179f0
mtry_lock_for@critical_section@Concurrency@@QAE_NI@Z	280	0x10017a60
mtry_lock_read@reader_writer_lock@Concurrency@@QAE_NXZ	281	0x10017ac0
munlock@critical_section@Concurrency@@QAEXXZ	282	0x10017af0
munlock@reader_writer_lock@Concurrency@@QAEXXZ	283	0x10017b70
mwait@Concurrency@@YAXI@Z	284	0x10026f10
mwait@_Condition_variable@details@Concurrency@@QAEXAAVcritical_section@3@@Z	285	0x10012d00
mwait@agent@Concurrency@@SA?AW4agent_status@2@PAV12@I@Z	286	0x1000d120
mwait@event@Concurrency@@QAEII@Z	287	0x10012d70
mwait_for@_Condition_variable@details@Concurrency@@QAE_NAAVcritical_section@3@I@Z	288	0x10012e50
mwait_for_all@agent@Concurrency@@SAXIPAPAV12@PAW4agent_status@2@I@Z	289	0x1000d190
mwait_for_multiple@event@Concurrency@@SAIPAPAV12@I_NI@Z	290	0x10012f40
next	291	0x100178b0

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 31, 2023 14:26:30.055960894 CEST	49724	443	192.168.2.3	213.55.33.103
May 31, 2023 14:26:30.056050062 CEST	443	49724	213.55.33.103	192.168.2.3
May 31, 2023 14:26:30.056248903 CEST	49724	443	192.168.2.3	213.55.33.103
May 31, 2023 14:26:30.056548119 CEST	49724	443	192.168.2.3	213.55.33.103
May 31, 2023 14:26:30.056583881 CEST	443	49724	213.55.33.103	192.168.2.3
May 31, 2023 14:26:33.296046972 CEST	443	49724	213.55.33.103	192.168.2.3
May 31, 2023 14:26:33.298266888 CEST	49725	443	192.168.2.3	213.55.33.103
May 31, 2023 14:26:33.298366070 CEST	443	49725	213.55.33.103	192.168.2.3
May 31, 2023 14:26:33.298552036 CEST	49725	443	192.168.2.3	213.55.33.103
May 31, 2023 14:26:33.298850060 CEST	49725	443	192.168.2.3	213.55.33.103
May 31, 2023 14:26:33.298892975 CEST	443	49725	213.55.33.103	192.168.2.3
May 31, 2023 14:26:36.340281963 CEST	443	49725	213.55.33.103	192.168.2.3
May 31, 2023 14:26:36.343806982 CEST	49726	443	192.168.2.3	213.55.33.103
May 31, 2023 14:26:36.343883038 CEST	443	49726	213.55.33.103	192.168.2.3
May 31, 2023 14:26:36.343988895 CEST	49726	443	192.168.2.3	213.55.33.103
May 31, 2023 14:26:36.344118118 CEST	49726	443	192.168.2.3	213.55.33.103
May 31, 2023 14:26:36.344317913 CEST	443	49726	213.55.33.103	192.168.2.3
May 31, 2023 14:26:36.344391108 CEST	49726	443	192.168.2.3	213.55.33.103
May 31, 2023 14:26:36.395472050 CEST	49727	443	192.168.2.3	213.55.33.103
May 31, 2023 14:26:36.395560026 CEST	443	49727	213.55.33.103	192.168.2.3
May 31, 2023 14:26:36.395662069 CEST	49727	443	192.168.2.3	213.55.33.103
May 31, 2023 14:26:36.395951986 CEST	49727	443	192.168.2.3	213.55.33.103
May 31, 2023 14:26:36.395982027 CEST	443	49727	213.55.33.103	192.168.2.3
May 31, 2023 14:26:39.571799040 CEST	443	49727	213.55.33.103	192.168.2.3
May 31, 2023 14:26:39.572799921 CEST	49728	443	192.168.2.3	213.55.33.103
May 31, 2023 14:26:39.572891951 CEST	443	49728	213.55.33.103	192.168.2.3
May 31, 2023 14:26:39.573003054 CEST	49728	443	192.168.2.3	213.55.33.103
May 31, 2023 14:26:39.573395014 CEST	49728	443	192.168.2.3	213.55.33.103
May 31, 2023 14:26:39.573426962 CEST	443	49728	213.55.33.103	192.168.2.3
May 31, 2023 14:26:42.679385900 CEST	443	49728	213.55.33.103	192.168.2.3
May 31, 2023 14:26:42.680380106 CEST	49729	443	192.168.2.3	213.55.33.103
May 31, 2023 14:26:42.680430889 CEST	443	49729	213.55.33.103	192.168.2.3
May 31, 2023 14:26:42.680541992 CEST	49729	443	192.168.2.3	213.55.33.103
May 31, 2023 14:26:42.680702925 CEST	49729	443	192.168.2.3	213.55.33.103
May 31, 2023 14:26:42.680768013 CEST	443	49729	213.55.33.103	192.168.2.3
May 31, 2023 14:26:42.680857897 CEST	49729	443	192.168.2.3	213.55.33.103
May 31, 2023 14:26:44.691308022 CEST	49730	443	192.168.2.3	213.55.33.103
May 31, 2023 14:26:44.691412926 CEST	443	49730	213.55.33.103	192.168.2.3
May 31, 2023 14:26:44.691591024 CEST	49730	443	192.168.2.3	213.55.33.103
May 31, 2023 14:26:44.691968918 CEST	49730	443	192.168.2.3	213.55.33.103
May 31, 2023 14:26:44.692023039 CEST	443	49730	213.55.33.103	192.168.2.3
May 31, 2023 14:26:45.846036911 CEST	443	49730	213.55.33.103	192.168.2.3
May 31, 2023 14:26:45.847600937 CEST	49731	443	192.168.2.3	213.55.33.103
May 31, 2023 14:26:45.847687006 CEST	443	49731	213.55.33.103	192.168.2.3
May 31, 2023 14:26:45.847837925 CEST	49731	443	192.168.2.3	213.55.33.103
May 31, 2023 14:26:45.848587990 CEST	49731	443	192.168.2.3	213.55.33.103
May 31, 2023 14:26:45.848628998 CEST	443	49731	213.55.33.103	192.168.2.3
May 31, 2023 14:26:48.947761059 CEST	443	49731	213.55.33.103	192.168.2.3
May 31, 2023 14:26:48.949193001 CEST	49732	443	192.168.2.3	213.55.33.103
May 31, 2023 14:26:48.949239016 CEST	443	49732	213.55.33.103	192.168.2.3
May 31, 2023 14:26:48.949552059 CEST	49732	443	192.168.2.3	213.55.33.103
May 31, 2023 14:26:48.949626923 CEST	49732	443	192.168.2.3	213.55.33.103
May 31, 2023 14:26:48.949709892 CEST	443	49732	213.55.33.103	192.168.2.3
May 31, 2023 14:26:48.949778080 CEST	49732	443	192.168.2.3	213.55.33.103
May 31, 2023 14:26:48.951689959 CEST	49733	443	192.168.2.3	213.55.33.103
May 31, 2023 14:26:48.951740980 CEST	443	49733	213.55.33.103	192.168.2.3
May 31, 2023 14:26:48.951884985 CEST	49733	443	192.168.2.3	213.55.33.103
May 31, 2023 14:26:48.952208042 CEST	49733	443	192.168.2.3	213.55.33.103
May 31, 2023 14:26:48.952241898 CEST	443	49733	213.55.33.103	192.168.2.3
May 31, 2023 14:26:52.118959904 CEST	443	49733	213.55.33.103	192.168.2.3
May 31, 2023 14:26:52.120115042 CEST	49734	443	192.168.2.3	213.55.33.103
May 31, 2023 14:26:52.120182037 CEST	443	49734	213.55.33.103	192.168.2.3
May 31, 2023 14:26:52.120333910 CEST	49734	443	192.168.2.3	213.55.33.103
May 31, 2023 14:26:52.120762110 CEST	49734	443	192.168.2.3	213.55.33.103
May 31, 2023 14:26:52.120793104 CEST	443	49734	213.55.33.103	192.168.2.3
May 31, 2023 14:26:55.221887112 CEST	443	49734	213.55.33.103	192.168.2.3
May 31, 2023 14:26:55.222837925 CEST	49735	443	192.168.2.3	213.55.33.103
May 31, 2023 14:26:55.222903967 CEST	443	49735	213.55.33.103	192.168.2.3
May 31, 2023 14:26:55.223081112 CEST	49735	443	192.168.2.3	213.55.33.103
May 31, 2023 14:26:55.223280907 CEST	49735	443	192.168.2.3	213.55.33.103
May 31, 2023 14:26:55.223319054 CEST	443	49735	213.55.33.103	192.168.2.3
May 31, 2023 14:26:55.223372936 CEST	49735	443	192.168.2.3	213.55.33.103
May 31, 2023 14:27:00.243968964 CEST	49736	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:00.453176975 CEST	2222	49736	200.84.200.20	192.168.2.3
May 31, 2023 14:27:00.456334114 CEST	49736	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:00.456793070 CEST	49736	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:00.691843033 CEST	2222	49736	200.84.200.20	192.168.2.3
May 31, 2023 14:27:00.693681955 CEST	49736	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:01.457454920 CEST	49736	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:01.670798063 CEST	2222	49736	200.84.200.20	192.168.2.3
May 31, 2023 14:27:01.671191931 CEST	49736	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:01.672095060 CEST	49736	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:02.104167938 CEST	2222	49736	200.84.200.20	192.168.2.3
May 31, 2023 14:27:02.119913101 CEST	2222	49736	200.84.200.20	192.168.2.3
May 31, 2023 14:27:02.120222092 CEST	49736	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:14.747859001 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:14.960622072 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:14.962850094 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:14.963324070 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:15.181190968 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:15.181426048 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:15.181843042 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:15.184566021 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:15.184566021 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:15.396590948 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:15.396779060 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:15.399277925 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:15.399384975 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:15.403223991 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:15.403335094 CEST	49738	2222	192.168.2.3	200.84.200.20

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 31, 2023 14:26:28.649318933 CEST	62050	53	192.168.2.3	8.8.8.8
May 31, 2023 14:26:28.676733971 CEST	53	62050	8.8.8.8	192.168.2.3
May 31, 2023 14:26:29.102452040 CEST	56042	53	192.168.2.3	8.8.8.8

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
May 31, 2023 14:26:28.649318933 CEST	192.168.2.3	8.8.8.8	0x9303	Standard query (0)	linkedin.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:26:29.102452040 CEST	192.168.2.3	8.8.8.8	0x74e	Standard query (0)	www.linkedin.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
May 31, 2023 14:26:28.676733971 CEST	8.8.8.8	192.168.2.3	0x9303	No error (0)	linkedin.com		13.107.42.14	A (IP address)	IN (0x0001)	false
May 31, 2023 14:26:29.127767086 CEST	8.8.8.8	192.168.2.3	0x74e	No error (0)	www.linkedin.com	www-linkedin-com.l-0005.l-msedge.net		CNAME (Canonical name)	IN (0x0001)	false

Target ID:	0
Start time:	14:23:14
Start date:	31/05/2023
Path:	C:\Windows\System32\loaddll32.exe
Wow64 process (32bit):	true
Commandline:	loaddll32.exe "C:\Users\user\Desktop\photographed.dat.dll"
Imagebase:	0xa00000
File size:	126464 bytes
MD5 hash:	3B4636AE519868037940CA5C4272091B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Analysis Process: conhost.exePID: 5728, Parent PID: 5212

General

Target ID:	1
Start time:	14:23:14
Start date:	31/05/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff745070000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: cmd.exePID: 6888, Parent PID: 5212

General

Target ID:	2
Start time:	14:23:14
Start date:	31/05/2023
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /C rundll32.exe "C:\Users\user\Desktop\photographed.dat.dll",#1
Imagebase:	0xb0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: rundll32.exePID: 7136, Parent PID: 5212

General

Target ID:	3
Start time:	14:23:14
Start date:	31/05/2023
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\photographed.dat.dll,m?0?$_SpinWait@$00@details@Concurrency@@QAE@P6AXXZ@Z
Imagebase:	0xfe0000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: rundll32.exePID: 5684, Parent PID: 6888

General

Target ID:	4
Start time:	14:23:14
Start date:	31/05/2023
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\photographed.dat.dll",#1
Imagebase:	0xfe0000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: WerFault.exePID: 4964, Parent PID: 5684

General

Target ID:	8
Start time:	14:23:15
Start date:	31/05/2023
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 5684 -s 660
Imagebase:	0xa30000
File size:	434592 bytes
MD5 hash:	9E2B8ACAD48ECCA55C0230D63623661B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Analysis Process: WerFault.exePID: 5272, Parent PID: 7136

General

Target ID:	9
Start time:	14:23:15
Start date:	31/05/2023
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7136 -s 664
Imagebase:	0xa30000
File size:	434592 bytes
MD5 hash:	9E2B8ACAD48ECCA55C0230D63623661B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Analysis Process: rundll32.exePID: 3108, Parent PID: 5212

General

Target ID:	10
Start time:	14:23:17
Start date:	31/05/2023
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\photographed.dat.dll,m?0?$_SpinWait@$0A@@details@Concurrency@@QAE@P6AXXZ@Z
Imagebase:	0xfe0000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Analysis Process: WerFault.exePID: 7056, Parent PID: 3108

General

Target ID:	12
Start time:	14:23:18
Start date:	31/05/2023
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 3108 -s 652
Imagebase:	0xa30000
File size:	434592 bytes
MD5 hash:	9E2B8ACAD48ECCA55C0230D63623661B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Analysis Process: rundll32.exePID: 7216, Parent PID: 5212

General

Target ID:	13
Start time:	14:23:20
Start date:	31/05/2023
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\photographed.dat.dll,m?0SchedulerPolicy@Concurrency@@QAA@IZZ
Imagebase:	0xfe0000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Analysis Process: WerFault.exePID: 7248, Parent PID: 7216

General

Target ID:	15
Start time:	14:23:21
Start date:	31/05/2023
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7216 -s 648
Imagebase:	0xa30000
File size:	434592 bytes
MD5 hash:	9E2B8ACAD48ECCA55C0230D63623661B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Analysis Process: rundll32.exePID: 7332, Parent PID: 5212

General

Target ID:	16
Start time:	14:23:24
Start date:	31/05/2023
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\photographed.dat.dll",m?0?$_SpinWait@$00@details@Concurrency@@QAE@P6AXXZ@Z
Imagebase:	0xfe0000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Analysis Process: rundll32.exePID: 7340, Parent PID: 5212

General

Target ID:	17
Start time:	14:23:24
Start date:	31/05/2023
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\photographed.dat.dll",m?0?$_SpinWait@$0A@@details@Concurrency@@QAE@P6AXXZ@Z
Imagebase:	0xfe0000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Analysis Process: rundll32.exePID: 7348, Parent PID: 5212

General

Target ID:	18
Start time:	14:23:24
Start date:	31/05/2023
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\photographed.dat.dll",m?0SchedulerPolicy@Concurrency@@QAA@IZZ
Imagebase:	0xfe0000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Analysis Process: rundll32.exePID: 7360, Parent PID: 5212

General

Target ID:	19
Start time:	14:23:24
Start date:	31/05/2023
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\photographed.dat.dll",next
Imagebase:	0xfe0000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Qbot_1, Description: Yara detected Qbot, Source: 00000013.00000002.409441736.00000000048D0000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Qbot_1, Description: Yara detected Qbot, Source: 00000013.00000002.406028423.0000000000CDA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security

Analysis Process: rundll32.exePID: 7380, Parent PID: 5212

General

Target ID:	21
Start time:	14:23:24
Start date:	31/05/2023
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\photographed.dat.dll",mwait_for_multiple@event@Concurrency@@SAIPAPAV12@I_NI@Z
Imagebase:	0xfe0000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Analysis Process: rundll32.exePID: 7416, Parent PID: 5212

General

Target ID:	23
Start time:	14:23:24
Start date:	31/05/2023
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\photographed.dat.dll",mwait_for_all@agent@Concurrency@@SAXIPAPAV12@PAW4agent_status@2@I@Z
Imagebase:	0xfe0000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Analysis Process: WerFault.exePID: 7496, Parent PID: 7332

General

Target ID:	26
Start time:	14:23:24
Start date:	31/05/2023
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7332 -s 652
Imagebase:	0xa30000
File size:	434592 bytes
MD5 hash:	9E2B8ACAD48ECCA55C0230D63623661B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Analysis Process: WerFault.exePID: 7504, Parent PID: 7340

General

Target ID:	27
Start time:	14:23:24
Start date:	31/05/2023
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7340 -s 652
Imagebase:	0xa30000
File size:	434592 bytes
MD5 hash:	9E2B8ACAD48ECCA55C0230D63623661B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Analysis Process: WerFault.exePID: 7568, Parent PID: 7348

General

Target ID:	29
Start time:	14:23:25
Start date:	31/05/2023
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7348 -s 648
Imagebase:	0xa30000
File size:	434592 bytes
MD5 hash:	9E2B8ACAD48ECCA55C0230D63623661B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Analysis Process: WerFault.exePID: 7584, Parent PID: 7416

General

Target ID:	30
Start time:	14:23:25
Start date:	31/05/2023
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7416 -s 648
Imagebase:	0xa30000
File size:	434592 bytes
MD5 hash:	9E2B8ACAD48ECCA55C0230D63623661B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Analysis Process: wermgr.exePID: 7772, Parent PID: 7360

General

Target ID:	31
Start time:	14:23:30
Start date:	31/05/2023
Path:	C:\Windows\SysWOW64\wermgr.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\wermgr.exe
Imagebase:	0x1390000
File size:	191904 bytes
MD5 hash:	CCF15E662ED5CE77B5FF1A7AAE305233
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Analysis Process: ipconfig.exePID: 1852, Parent PID: 7772

General

Target ID:	36
Start time:	14:27:01
Start date:	31/05/2023
Path:	C:\Windows\SysWOW64\ipconfig.exe
Wow64 process (32bit):	true
Commandline:	ipconfig /all
Imagebase:	0x11a0000
File size:	29184 bytes
MD5 hash:	B0C7423D02A007461C850CD0DFE09318
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Analysis Process: conhost.exePID: 1708, Parent PID: 1852

General

Target ID:	37
Start time:	14:27:01
Start date:	31/05/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff745070000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Analysis Process: whoami.exePID: 2244, Parent PID: 7772

General

Target ID:	38
Start time:	14:27:02
Start date:	31/05/2023
Path:	C:\Windows\SysWOW64\whoami.exe
Wow64 process (32bit):	true
Commandline:	whoami /all
Imagebase:	0x7ff68f300000
File size:	59392 bytes
MD5 hash:	2E498B32E15CD7C0177A254E2410559C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Analysis Process: conhost.exePID: 7716, Parent PID: 2244

General

Target ID:	39
Start time:	14:27:02
Start date:	31/05/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff745070000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Analysis Process: msiexec.exePID: 5264, Parent PID: 580

General

Target ID:	41
Start time:	14:27:02
Start date:	31/05/2023
Path:	C:\Windows\System32\msiexec.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\msiexec.exe /V
Imagebase:	0x7ff6eed80000
File size:	66048 bytes
MD5 hash:	4767B71A318E201188A0D0A420C8B608
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Disassembly

⊘No disassembly

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the library manifest used to load DLLs. Adversaries may take advantage of vague references in the library manifest of a program by replacing a legitimate library with a malicious one, causing the operating system to load their malicious library when it is called for by the victim program.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	Loaded DLLs, Process monitoring, Process use of network
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads.
Tactics:	Defense Evasion
Data Sources:	DLL monitoring, Loaded DLLs, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may hook into Windows application programming interface (API) functions to collect user credentials. Malicious hooking mechanisms may capture API calls that include parameters that reveal user authentication credentials.Unlike Keylogging , this technique focuses specifically on API functions that include parameters that reveal user credentials. Hooking involves redirecting calls to these functions and can be implemented via:
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Loaded DLLs, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report photographed.dat.dll

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Qbot

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Data Obfuscation

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_34d063e1f8b4a0a973e2832d9ca94882ab2137_82810a17_1c1229dd\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_34d063e1f8b4a0a973e2832d9ca94882ab2137_82810a17_1dd23bb0\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_34d063e1f8b4a0a973e2832d9ca94882ab2137_82810a17_1de23ba0\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_fce87c8f307b30dca7c45f44ed2a364c18519efd_82810a17_13262a0c\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_fce87c8f307b30dca7c45f44ed2a364c18519efd_82810a17_14da29be\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_fce87c8f307b30dca7c45f44ed2a364c18519efd_82810a17_1bd22a0c\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_fce87c8f307b30dca7c45f44ed2a364c18519efd_82810a17_1d0a3a87\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_fce87c8f307b30dca7c45f44ed2a364c18519efd_82810a17_1d123b42\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER14BF.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER15E9.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER1657.tmp.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER20E4.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2337.tmp.WERInternalMetadata.xml

Windows Analysis Report
photographed.dat.dll

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre