Edit tour

Windows Analysis Report
lets-test.msi

Overview

General Information

Sample name:	lets-test.msi
Analysis ID:	1476283
MD5:	b0428243a495bc1691d4c4f33b54e0eb
SHA1:	e7b0c8d355fc3cc1158b96b3a0e3420fac2b3f06
SHA256:	5683928d134cc328a0ae1460fb0c58ddf97d5bc854758c97a5c4d3c1869b842d
Tags:	exemsi
Infos:

Detection

Score:	84
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

AI detected suspicious sample

Bypasses PowerShell execution policy

Contains functionality to infect the boot sector

Creates multiple autostart registry keys

Executes Lua script

Found API chain indicative of debugger detection

Loading BitLocker PowerShell Module

Machine Learning detection for dropped file

Maps a DLL or memory area into another process

Modifies the DNS server

Modifies the windows firewall

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Queries sensitive service information (via WMI, Win32_LogicalDisk, often done to detect sandboxes)

Sample is not signed and drops a device driver

Uses ipconfig to lookup or modify the Windows network settings

Uses netsh to modify the Windows network and firewall settings

Yara detected Generic Downloader

Abnormal high CPU Usage

Adds / modifies Windows certificates

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks for available system drives (often done to infect USB drives)

Contains functionality for read data from the clipboard

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to query network adapater information

Contains functionality to read the PEB

Contains functionality to shutdown / reboot the system

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates driver files

Creates files inside the driver directory

Creates files inside the system directory

Creates or modifies windows services

Deletes files inside the Windows folder

Detected TCP or UDP traffic on non-standard ports

Detected non-DNS traffic on DNS port

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the program root directory (C:\Program Files)

Drops PE files to the windows directory (C:\Windows)

Drops certificate files (DER)

Enables debug privileges

Enables driver privileges

Enables security privileges

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found evasive API chain (may stop execution after checking a module file name)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Installs a raw input device (often for capturing keystrokes)

Launches processes in debugging mode, may be used to hinder debugging

May sleep (evasive loops) to hinder dynamic analysis

Modifies existing windows services

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains sections with non-standard names

Potential key logger detected (key state polling based)

Queries disk information (often used to detect virtual machines)

Queries information about the installed CPU (vendor, model number etc)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Change PowerShell Policies to an Insecure Level

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: PSScriptPolicyTest Creation By Uncommon Process

Sigma detected: Tap Installer Execution

Sigma detected: Uncommon Svchost Parent Process

Sleep loop found (likely to delay execution)

Stores files to the Windows start menu directory

Stores large binary data to the registry

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Keylogger Generic

Classification

Process Tree

System is w10x64

msiexec.exe (PID: 7520 cmdline: "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\lets-test.msi" MD5: E5DA170027542E25EDE42FC54C929077)

msiexec.exe (PID: 7556 cmdline: C:\Windows\system32\msiexec.exe /V MD5: E5DA170027542E25EDE42FC54C929077)

msiexec.exe (PID: 7660 cmdline: C:\Windows\syswow64\MsiExec.exe -Embedding A5D05F387DF25EBE7AE8DA514E37EF3C MD5: 9D09DC1EDA745A5F87553048E57620CF)

LetsPRO.exe (PID: 7868 cmdline: "C:\Program Files (x86)\haxGhXjmBFM\LetsPRO.exe" MD5: EA9E2F517B1CC2DBE7F78302DD7FB593)

LetsPRO.exe (PID: 7896 cmdline: "C:\Program Files (x86)\haxGhXjmBFM\app-3.8.0\LetsPRO.exe" MD5: 2D822C8477099A4F8D149F19836312D1)

haxGhXjmBFM.exe (PID: 7876 cmdline: "C:\Program Files (x86)\haxGhXjmBFM.exe" MD5: 9C44BE4CEAC0C983A812FD8459511FD0)

powershell.exe (PID: 7968 cmdline: powershell.exe -inputformat none -ExecutionPolicy Bypass -Command "If ($env:PROCESSOR_ARCHITEW6432) { $env:PROCESSOR_ARCHITEW6432 } Else { $env:PROCESSOR_ARCHITECTURE }" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 7980 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 9092 cmdline: powershell -inputformat none -ExecutionPolicy Bypass -File "C:\Program Files (x86)\letsvpn\AddWindowsSecurityExclusion.ps1" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 9100 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tapinstall.exe (PID: 1704 cmdline: "C:\Program Files (x86)\letsvpn\driver\tapinstall.exe" findall tap0901 MD5: 1E3CF83B17891AEE98C3E30012F0B034)

conhost.exe (PID: 1188 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tapinstall.exe (PID: 8836 cmdline: "C:\Program Files (x86)\letsvpn\driver\tapinstall.exe" install "C:\Program Files (x86)\letsvpn\driver\OemVista.inf" tap0901 MD5: 1E3CF83B17891AEE98C3E30012F0B034)

conhost.exe (PID: 8892 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 2208 cmdline: cmd /c netsh advfirewall firewall Delete rule name=lets MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 8748 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

netsh.exe (PID: 6012 cmdline: netsh advfirewall firewall Delete rule name=lets MD5: 4E89A1A088BE715D6C946E55AB07C7DF)

cmd.exe (PID: 8632 cmdline: cmd /c netsh advfirewall firewall Delete rule name=lets.exe MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 8612 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

netsh.exe (PID: 8504 cmdline: netsh advfirewall firewall Delete rule name=lets.exe MD5: 4E89A1A088BE715D6C946E55AB07C7DF)

cmd.exe (PID: 3980 cmdline: cmd /c netsh advfirewall firewall Delete rule name=LetsPRO.exe MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 4092 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

netsh.exe (PID: 2132 cmdline: netsh advfirewall firewall Delete rule name=LetsPRO.exe MD5: 4E89A1A088BE715D6C946E55AB07C7DF)

cmd.exe (PID: 8100 cmdline: cmd /c netsh advfirewall firewall Delete rule name=LetsPRO MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 8092 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

netsh.exe (PID: 7208 cmdline: netsh advfirewall firewall Delete rule name=LetsPRO MD5: 4E89A1A088BE715D6C946E55AB07C7DF)

tapinstall.exe (PID: 8356 cmdline: "C:\Program Files (x86)\letsvpn\driver\tapinstall.exe" findall tap0901 MD5: 1E3CF83B17891AEE98C3E30012F0B034)

conhost.exe (PID: 7808 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

LetsPRO.exe (PID: 8452 cmdline: "C:\Program Files (x86)\letsvpn\LetsPRO.exe" MD5: EA9E2F517B1CC2DBE7F78302DD7FB593)

LetsPRO.exe (PID: 8464 cmdline: "C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe" MD5: 38973DBBFAD9619FDE39FAB919EB9A04)

cmd.exe (PID: 8604 cmdline: "cmd.exe" /C ipconfig /all MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 5852 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

ipconfig.exe (PID: 8504 cmdline: ipconfig /all MD5: 3A3B9A5E00EF6A3F83BF300E2B6B67BB)

cmd.exe (PID: 8004 cmdline: "cmd.exe" /C route print MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 8364 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

svchost.exe (PID: 8836 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s NetSetupSvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

LetsPRO.exe (PID: 7884 cmdline: "C:\Program Files (x86)\haxGhXjmBFM\LetsPRO.exe" MD5: EA9E2F517B1CC2DBE7F78302DD7FB593)

LetsPRO.exe (PID: 7916 cmdline: "C:\Program Files (x86)\haxGhXjmBFM\app-3.8.0\LetsPRO.exe" MD5: 2D822C8477099A4F8D149F19836312D1)

LetsPRO.exe (PID: 7752 cmdline: "C:\Program Files (x86)\haxGhXjmBFM\LetsPRO.exe" MD5: EA9E2F517B1CC2DBE7F78302DD7FB593)

LetsPRO.exe (PID: 7784 cmdline: "C:\Program Files (x86)\haxGhXjmBFM\app-3.8.0\LetsPRO.exe" MD5: 2D822C8477099A4F8D149F19836312D1)

msedge.exe (PID: 7772 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7700 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2116 --field-trial-handle=1900,i,16840921317244570798,13407743960639991352,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

wegame.exe (PID: 7800 cmdline: "C:\Program Files (x86)\Common Files\wegame.exe" MD5: 063AF51C19F29BCDFD26C1BEBDC9ACE6)

svchost.exe (PID: 8164 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

msedge.exe (PID: 5672 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7316 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2076 --field-trial-handle=2052,i,15600672359767385931,12955159692457146143,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8072 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=4204 --field-trial-handle=2052,i,15600672359767385931,12955159692457146143,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

identity_helper.exe (PID: 8712 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=5976 --field-trial-handle=2052,i,15600672359767385931,12955159692457146143,262144 /prefetch:8 MD5: 76C58E5BABFE4ACF0308AA646FC0F416)

identity_helper.exe (PID: 8732 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=5976 --field-trial-handle=2052,i,15600672359767385931,12955159692457146143,262144 /prefetch:8 MD5: 76C58E5BABFE4ACF0308AA646FC0F416)

svchost.exe (PID: 8904 cmdline: C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

drvinst.exe (PID: 8944 cmdline: DrvInst.exe "4" "0" "C:\Users\user\AppData\Local\Temp\{99f02b5e-0c7c-d542-ad44-27ce9be55c97}\oemvista.inf" "9" "4d14a44ff" "0000000000000158" "WinSta0\Default" "0000000000000164" "208" "c:\program files (x86)\letsvpn\driver" MD5: 294990C88B9D1FE0A54A1FA8BF4324D9)

drvinst.exe (PID: 3428 cmdline: DrvInst.exe "2" "211" "ROOT\NET\0000" "C:\Windows\INF\oem4.inf" "oem4.inf:3beb73aff103cc24:tap0901.ndi:9.24.6.601:tap0901," "4d14a44ff" "0000000000000158" MD5: 294990C88B9D1FE0A54A1FA8BF4324D9)

svchost.exe (PID: 1104 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s NetSetupSvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

msedge.exe (PID: 8212 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 5844 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2128 --field-trial-handle=2084,i,12025234242823261480,2093702470493136090,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

svchost.exe (PID: 2672 cmdline: C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s Netman MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

WmiApSrv.exe (PID: 5252 cmdline: C:\Windows\system32\wbem\WmiApSrv.exe MD5: 9A48D32D7DBA794A40BF030DA500603B)

cleanup

Yara Signatures

Dropped Files

Source	Rule	Description	Author
C:\Program Files (x86)\letsvpn\app-3.8.0\netstandard.dll	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
C:\Program Files (x86)\letsvpn\Update.exe	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
C:\Program Files (x86)\letsvpn\app-3.8.0\libwin.dll	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: LetsPRO.exe PID: 8464	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
55.2.LetsPRO.exe.68030000.24.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security

Sigma Signatures

Sigma detected: Change PowerShell Policies to an Insecure Level

Source: Process started

Author: frack113: Data: Command: powershell.exe -inputformat none -ExecutionPolicy Bypass -Command "If ($env:PROCESSOR_ARCHITEW6432) { $env:PROCESSOR_ARCHITEW6432 } Else { $env:PROCESSOR_ARCHITECTURE }", CommandLine: powershell.exe -inputformat none -ExecutionPolicy Bypass -Command "If ($env:PROCESSOR_ARCHITEW6432) { $env:PROCESSOR_ARCHITEW6432 } Else { $env:PROCESSOR_ARCHITECTURE }", CommandLine|base64offset|contains: )f, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Program Files (x86)\haxGhXjmBFM.exe", ParentImage: C:\Program Files (x86)\haxGhXjmBFM.exe, ParentProcessId: 7876, ParentProcessName: haxGhXjmBFM.exe, ProcessCommandLine: powershell.exe -inputformat none -ExecutionPolicy Bypass -Command "If ($env:PROCESSOR_ARCHITEW6432) { $env:PROCESSOR_ARCHITEW6432 } Else { $env:PROCESSOR_ARCHITECTURE }", ProcessId: 7968, ProcessName: powershell.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: "C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe" /silent, EventID: 13, EventType: SetValue, Image: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe, ProcessId: 8464, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\LetsPRO

Sigma detected: PSScriptPolicyTest Creation By Uncommon Process

Source: File created

Author: Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe, ProcessId: 8464, TargetFilename: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0u45maxg.4nm.ps1

Sigma detected: Tap Installer Execution

Source: Process started

Author: Daniil Yugoslavskiy, Ian Davis, oscd.community: Data: Command: "C:\Program Files (x86)\letsvpn\driver\tapinstall.exe" findall tap0901, CommandLine: "C:\Program Files (x86)\letsvpn\driver\tapinstall.exe" findall tap0901, CommandLine|base64offset|contains: )^, Image: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe, NewProcessName: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe, OriginalFileName: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe, ParentCommandLine: "C:\Program Files (x86)\haxGhXjmBFM.exe", ParentImage: C:\Program Files (x86)\haxGhXjmBFM.exe, ParentProcessId: 7876, ParentProcessName: haxGhXjmBFM.exe, ProcessCommandLine: "C:\Program Files (x86)\letsvpn\driver\tapinstall.exe" findall tap0901, ProcessId: 1704, ProcessName: tapinstall.exe

Sigma detected: Uncommon Svchost Parent Process

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s NetSetupSvc, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s NetSetupSvc, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: "C:\Program Files (x86)\haxGhXjmBFM.exe", ParentImage: C:\Program Files (x86)\haxGhXjmBFM.exe, ParentProcessId: 7876, ParentProcessName: haxGhXjmBFM.exe, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s NetSetupSvc, ProcessId: 8836, ProcessName: svchost.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -inputformat none -ExecutionPolicy Bypass -Command "If ($env:PROCESSOR_ARCHITEW6432) { $env:PROCESSOR_ARCHITEW6432 } Else { $env:PROCESSOR_ARCHITECTURE }", CommandLine: powershell.exe -inputformat none -ExecutionPolicy Bypass -Command "If ($env:PROCESSOR_ARCHITEW6432) { $env:PROCESSOR_ARCHITEW6432 } Else { $env:PROCESSOR_ARCHITECTURE }", CommandLine|base64offset|contains: )f, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Program Files (x86)\haxGhXjmBFM.exe", ParentImage: C:\Program Files (x86)\haxGhXjmBFM.exe, ParentProcessId: 7876, ParentProcessName: haxGhXjmBFM.exe, ProcessCommandLine: powershell.exe -inputformat none -ExecutionPolicy Bypass -Command "If ($env:PROCESSOR_ARCHITEW6432) { $env:PROCESSOR_ARCHITEW6432 } Else { $env:PROCESSOR_ARCHITECTURE }", ProcessId: 7968, ProcessName: powershell.exe

Sigma detected: Suspicious Network Command

Source: Process started

Author: frack113, Christopher Peacock '@securepeacock', SCYTHE '@scythe_io': Data: Command: "cmd.exe" /C ipconfig /all, CommandLine: "cmd.exe" /C ipconfig /all, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: "C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe" , ParentImage: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe, ParentProcessId: 8464, ParentProcessName: LetsPRO.exe, ProcessCommandLine: "cmd.exe" /C ipconfig /all, ProcessId: 8604, ProcessName: cmd.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 8164, ProcessName: svchost.exe

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 94.9% probability

Machine Learning detection for dropped file

Source: C:\Program Files (x86)\haxGhXjmBFM\app-3.8.0\LetsPROCHS.dll

Joe Sandbox ML: detected

Source: C:\Program Files (x86)\Common Files\wegame.exe	Code function: 6_2_6C5B6164 __EH_prolog3_GS,CryptAcquireContextW,GetLastError,		6_2_6C5B6164
Source: C:\Program Files (x86)\Common Files\wegame.exe	Code function: 6_2_6C7FE1F0 CryptAcquireContextA,CryptGenRandom,CryptReleaseContext,		6_2_6C7FE1F0

Source: wegame.exe, 00000006.00000002.4142318714.000000006C825000.00000002.00000001.01000000.00000008.sdmp

Binary or memory string: -----BEGIN PUBLIC KEY-----

memstr_139cfb2e-9

Source:	Binary string: D:\a\1\s\Utils\obj\Release\Utils.pdb source: LetsPRO.exe, 00000037.00000002.4143079506.00000000032F2000.00000002.00000001.01000000.0000001A.sdmp
Source:	Binary string: D:\git\wegame_paas\beacon_report_cpp\beacon_sdk\Release\beacon_sdk.pdb source: wegame.exe, 00000006.00000002.4143954280.000000006CECB000.00000002.00000001.01000000.0000000C.sdmp
Source:	Binary string: E:\A\_work\1795\s\corefx\bin\obj\Windows_NT.AnyCPU.Release\System.Runtime.InteropServices.RuntimeInformation\net462\System.Runtime.InteropServices.RuntimeInformation.pdb source: LetsPRO.exe, 00000037.00000002.4168244500.00000000067E2000.00000002.00000001.01000000.0000001F.sdmp
Source:	Binary string: D:\a\1\s\LetsVPN\obj\Release\LetsPRO.pdb source: LetsPRO.exe, 00000037.00000000.2030391391.0000000000E62000.00000002.00000001.01000000.00000018.sdmp
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\userAccounts.pdb source: lets-test.msi
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\ShortcutFlags.pdb source: lets-test.msi
Source:	Binary string: E:\dailybuild_fix_5.4\wegame_client\build\bin\Release\wegame.pdbmm1GCTL source: wegame.exe, 00000006.00000002.4137406249.0000000000476000.00000002.00000001.01000000.00000004.sdmp, wegame.exe, 00000006.00000000.1716127775.0000000000476000.00000002.00000001.01000000.00000004.sdmp
Source:	Binary string: lp)rlkeyfuncencryptionPBE2PARAMkeylengthprfPBKDF2PARAMcrypto\asn1\p5_pbev2.ccrypto\evp\p5_crpt2.cassertion failed: keylen <= sizeof(key)crypto\hmac\hmac.ccrypto\pkcs12\p12_key.cxn--compiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 /WX -DL_ENDIAN -DOPENSSL_PIC -D_WIN32_WINNT=0x0501 source: wegame.exe, 00000006.00000002.4142318714.000000006C825000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: c:\git\OSS\notifyicon-wpf\Hardcodet.NotifyIcon.Wpf\Source\NotifyIconWpf\obj\Release\Hardcodet.Wpf.TaskbarNotification.pdb source: LetsPRO.exe, 00000037.00000002.4201314539.0000000037A82000.00000002.00000001.01000000.00000033.sdmp
Source:	Binary string: C:\Users\eric\dev\cb\bld\bin\e_sqlite3\win\v141\plain\x86\e_sqlite3.pdb source: LetsPRO.exe, 00000037.00000002.4256167829.0000000067067000.00000002.00000001.01000000.00000031.sdmp
Source:	Binary string: c:\users\samuli\opt\tap-windows6-mattock\tapinstall\7600\objfre_wlh_amd64\amd64\tapinstall.pdb source: tapinstall.exe, 0000001E.00000002.1912221093.00007FF7BEED1000.00000020.00000001.01000000.00000016.sdmp, tapinstall.exe, 0000001E.00000000.1910661790.00007FF7BEED1000.00000020.00000001.01000000.00000016.sdmp, tapinstall.exe, 00000020.00000000.1913117233.00007FF7BEED1000.00000020.00000001.01000000.00000016.sdmp, tapinstall.exe, 00000020.00000002.1953276492.00007FF7BEED1000.00000020.00000001.01000000.00000016.sdmp, tapinstall.exe, 00000032.00000002.1972779400.00007FF7BEED1000.00000020.00000001.01000000.00000016.sdmp, tapinstall.exe, 00000032.00000000.1970876937.00007FF7BEED1000.00000020.00000001.01000000.00000016.sdmp
Source:	Binary string: D:\a\1\s\SDK\AppCenterAnalytics\Microsoft.AppCenter.Analytics.WindowsDesktop\obj\Release\net461\Microsoft.AppCenter.Analytics.pdbSHA256 source: LetsPRO.exe, 00000037.00000002.4178693283.00000000300B2000.00000002.00000001.01000000.00000026.sdmp
Source:	Binary string: C:\WorkShop\WebSocket4Net\WebSocket4Net\obj\Release\WebSocket4Net.pdb source: LetsPRO.exe, 00000037.00000002.4214834576.00000000387E2000.00000002.00000001.01000000.00000038.sdmp
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\aischeduler2.pdb@ source: lets-test.msi
Source:	Binary string: /_/CommunityToolkit.Mvvm/obj/Release/netstandard2.0/CommunityToolkit.Mvvm.pdbSHA256 source: LetsPRO.exe, 00000037.00000002.4167809675.0000000006742000.00000002.00000001.01000000.0000001E.sdmp
Source:	Binary string: D:\a\1\s\SDK\AppCenter\Microsoft.AppCenter.WindowsDesktop\obj\Release\net461\Microsoft.AppCenter.pdb source: LetsPRO.exe, 00000037.00000002.4187562856.0000000034AB5000.00000004.00000020.00020000.00000000.sdmp, LetsPRO.exe, 00000037.00000002.4179081431.0000000030452000.00000002.00000001.01000000.00000027.sdmp
Source:	Binary string: C:\Users\eric\dev\SQLitePCL.raw\src\SQLitePCLRaw.batteries_v2.e_sqlite3.dynamic\obj\Release\netstandard2.0\SQLitePCLRaw.batteries_v2.pdb source: LetsPRO.exe, 00000037.00000002.4187448131.00000000317A2000.00000002.00000001.01000000.0000002D.sdmp
Source:	Binary string: E:\A\_work\1795\s\corefx\bin\obj\Windows_NT.AnyCPU.Release\System.Net.Http\netfx\System.Net.Http.pdb source: LetsPRO.exe, 00000037.00000002.4224367182.00000000392B2000.00000002.00000001.01000000.0000003D.sdmp
Source:	Binary string: /_/CommunityToolkit.Mvvm/obj/Release/netstandard2.0/CommunityToolkit.Mvvm.pdb source: LetsPRO.exe, 00000037.00000002.4167809675.0000000006742000.00000002.00000001.01000000.0000001E.sdmp
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\userAccounts.pdbQ source: lets-test.msi
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\aischeduler2.pdb source: lets-test.msi
Source:	Binary string: Extract: Mono.Cecil.Pdb.dll... 100% source: haxGhXjmBFM.exe, 00000008.00000003.2031982869.0000000000751000.00000004.00000020.00020000.00000000.sdmp, haxGhXjmBFM.exe, 00000008.00000002.2033229713.0000000000751000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\eric\dev\SQLitePCL.raw\src\SQLitePCLRaw.batteries_v2.e_sqlite3.dynamic\obj\Release\netstandard2.0\SQLitePCLRaw.batteries_v2.pdbSHA256 source: LetsPRO.exe, 00000037.00000002.4187448131.00000000317A2000.00000002.00000001.01000000.0000002D.sdmp
Source:	Binary string: D:\a\1\s\SDK\AppCenterCrashes\Microsoft.AppCenter.Crashes.WindowsDesktop\obj\Release\net461\Microsoft.AppCenter.Crashes.pdb source: LetsPRO.exe, 00000037.00000002.4178819054.00000000300C2000.00000002.00000001.01000000.00000028.sdmp
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\ShortcutFlags.pdbE source: lets-test.msi
Source:	Binary string: D:\a\1\s\LetsVPNDomainModel\obj\Release\LetsVPNDomainModel.pdb source: LetsPRO.exe, 00000037.00000002.4162624461.00000000059D2000.00000002.00000001.01000000.0000001C.sdmp
Source:	Binary string: D:\a\1\s\LetsVPNDomainModel\obj\Release\LetsVPNDomainModel.pdbwD source: LetsPRO.exe, 00000037.00000002.4162624461.00000000059D2000.00000002.00000001.01000000.0000001C.sdmp
Source:	Binary string: e:\newclientmail\trunk\code\errorreport\release\ErrorReport.pdb source: LetsPRO.exe, 00000005.00000000.1716952895.0000000000436000.00000002.00000001.01000000.00000005.sdmp, LetsPRO.exe, 00000005.00000002.1723561398.0000000000436000.00000002.00000001.01000000.00000005.sdmp, LetsPRO.exe, 0000000A.00000000.1717732510.0000000000436000.00000002.00000001.01000000.00000005.sdmp, LetsPRO.exe, 0000000A.00000002.1718436135.0000000000436000.00000002.00000001.01000000.00000005.sdmp, LetsPRO.exe, 0000000B.00000000.1717785516.0000000000436000.00000002.00000001.01000000.00000005.sdmp, LetsPRO.exe, 0000000B.00000002.1718664733.0000000000436000.00000002.00000001.01000000.00000005.sdmp
Source:	Binary string: E:\A\_work\156\s\corefx\bin\obj\AnyOS.AnyCPU.Release\System.Buffers\netfx\System.Buffers.pdb source: LetsPRO.exe, 00000037.00000002.4168359295.00000000067F2000.00000002.00000001.01000000.00000022.sdmp
Source:	Binary string: W.PDb source: haxGhXjmBFM.exe.1.dr
Source:	Binary string: D:\a\1\s\SDK\AppCenterCrashes\Microsoft.AppCenter.Crashes.WindowsDesktop\obj\Release\net461\Microsoft.AppCenter.Crashes.pdbSHA256, source: LetsPRO.exe, 00000037.00000002.4178819054.00000000300C2000.00000002.00000001.01000000.00000028.sdmp
Source:	Binary string: C:\WorkShop\WebSocket4Net\WebSocket4Net\obj\Release\WebSocket4Net.pdb* source: LetsPRO.exe, 00000037.00000002.4214834576.00000000387E2000.00000002.00000001.01000000.00000038.sdmp
Source:	Binary string: C:\Users\winsign\samuli\source\repos\tap-windows6\src\x64\Release\tap0901.pdb source: drvinst.exe, 00000023.00000003.1927968266.000002092AA5C000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000024.00000003.1942016589.0000014379274000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\s\LetsVPNInfraStructure\obj\Release\LetsVPNInfraStructure.pdb]KwK iK_CorDllMainmscoree.dll source: LetsPRO.exe, 00000037.00000002.4168992457.0000000006FB2000.00000002.00000001.01000000.00000023.sdmp
Source:	Binary string: C:\WorkShop\SuperSocket.ClientEngine\obj\Release\SuperSocket.ClientEngine.pdbR source: LetsPRO.exe, 00000037.00000002.4214552147.00000000387C2000.00000002.00000001.01000000.00000037.sdmp
Source:	Binary string: C:\Users\IEUser\pusher-websocket-dotnet\PusherClient\obj\release\net46\PusherClient.pdb source: LetsPRO.exe, 00000037.00000002.4213951978.00000000385D2000.00000002.00000001.01000000.00000036.sdmp
Source:	Binary string: D:\a\_work\1\s\corefx\bin\obj\AnyOS.AnyCPU.Release\System.Memory\netfx\System.Memory.pdb source: LetsPRO.exe, 00000037.00000002.4168580863.0000000006E72000.00000002.00000001.01000000.00000020.sdmp
Source:	Binary string: /_/Src/Newtonsoft.Json/obj/Release/net45/Newtonsoft.Json.pdbSHA256 source: LetsPRO.exe, 00000037.00000002.4164213776.0000000006032000.00000002.00000001.01000000.0000001D.sdmp
Source:	Binary string: E:\dailybuild_fix_5.4\wegame_client\build\lib\Release\common.pdb source: wegame.exe, 00000006.00000002.4142318714.000000006C825000.00000002.00000001.01000000.00000008.sdmp, wegame.exe, 00000006.00000003.1736539346.00000000031D0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\Users\ani\code\squirrel\squirrel.windows\build\Release\Win32\StubExecutable.pdb source: LetsPRO.exe, 00000003.00000000.1714533986.0000000000BDD000.00000002.00000001.01000000.00000003.sdmp, LetsPRO.exe, 00000003.00000002.1724304213.0000000000BDD000.00000002.00000001.01000000.00000003.sdmp, LetsPRO.exe, 00000007.00000000.1717340757.0000000000BDD000.00000002.00000001.01000000.00000003.sdmp, LetsPRO.exe, 00000007.00000002.1718433574.0000000000BDD000.00000002.00000001.01000000.00000003.sdmp, LetsPRO.exe, 00000009.00000002.1718643469.0000000000BDD000.00000002.00000001.01000000.00000003.sdmp, LetsPRO.exe, 00000009.00000000.1717405600.0000000000BDD000.00000002.00000001.01000000.00000003.sdmp, LetsPRO.exe, 00000036.00000000.2029609057.00000000004AD000.00000002.00000001.01000000.00000017.sdmp, LetsPRO.exe, 00000036.00000002.2041845468.00000000004AD000.00000002.00000001.01000000.00000017.sdmp
Source:	Binary string: /_/Src/Newtonsoft.Json/obj/Release/net45/Newtonsoft.Json.pdb source: LetsPRO.exe, 00000037.00000002.4164213776.0000000006032000.00000002.00000001.01000000.0000001D.sdmp
Source:	Binary string: compiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 /WX -DL_ENDIAN -DOPENSSL_PIC -D_WIN32_WINNT=0x0501 source: wegame.exe, 00000006.00000002.4142318714.000000006C825000.00000002.00000001.01000000.00000008.sdmp, wegame.exe, 00000006.00000003.1736539346.00000000031D0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\s\LetsVPN\obj\Release\LetsPRO.pdbm source: LetsPRO.exe, 00000037.00000000.2030391391.0000000000E62000.00000002.00000001.01000000.00000018.sdmp
Source:	Binary string: E:\dailybuild_fix_5.4\wegame_client\build\bin\Release\wegame.pdb source: wegame.exe, 00000006.00000002.4137406249.0000000000476000.00000002.00000001.01000000.00000004.sdmp, wegame.exe, 00000006.00000000.1716127775.0000000000476000.00000002.00000001.01000000.00000004.sdmp
Source:	Binary string: D:\a\1\s\LetsVPNInfraStructure\obj\Release\LetsVPNInfraStructure.pdb source: LetsPRO.exe, 00000037.00000002.4168992457.0000000006FB2000.00000002.00000001.01000000.00000023.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Runtime.CompilerServices.Unsafe\net461-Release\System.Runtime.CompilerServices.Unsafe.pdbBSJB source: LetsPRO.exe, 00000037.00000002.4168104099.0000000006772000.00000002.00000001.01000000.00000021.sdmp
Source:	Binary string: C:\Users\eric\dev\SQLitePCL.raw\src\SQLitePCLRaw.core\obj\Release\netstandard2.0\SQLitePCLRaw.core.pdbSHA256xpRb source: LetsPRO.exe, 00000037.00000002.4196069676.00000000371F2000.00000002.00000001.01000000.0000002F.sdmp
Source:	Binary string: C:\Users\eric\dev\SQLitePCL.raw\src\SQLitePCLRaw.provider.dynamic_cdecl\obj\Release\netstandard2.0\SQLitePCLRaw.provider.dynamic_cdecl.pdb source: LetsPRO.exe, 00000037.00000002.4196250023.0000000037212000.00000002.00000001.01000000.00000030.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Runtime.CompilerServices.Unsafe\net461-Release\System.Runtime.CompilerServices.Unsafe.pdb source: LetsPRO.exe, 00000037.00000002.4168104099.0000000006772000.00000002.00000001.01000000.00000021.sdmp
Source:	Binary string: C:\Users\eric\dev\SQLitePCL.raw\src\SQLitePCLRaw.provider.dynamic_cdecl\obj\Release\netstandard2.0\SQLitePCLRaw.provider.dynamic_cdecl.pdbSHA256 source: LetsPRO.exe, 00000037.00000002.4196250023.0000000037212000.00000002.00000001.01000000.00000030.sdmp
Source:	Binary string: E:\dailybuild_fix_5.4\wegame_client\build\lib\Release\adapt_for_imports.pdb source: wegame.exe, 00000006.00000002.4143381615.000000006C98C000.00000002.00000001.01000000.00000007.sdmp
Source:	Binary string: D:\a\1\s\SDK\AppCenterAnalytics\Microsoft.AppCenter.Analytics.WindowsDesktop\obj\Release\net461\Microsoft.AppCenter.Analytics.pdb source: LetsPRO.exe, 00000037.00000002.4178693283.00000000300B2000.00000002.00000001.01000000.00000026.sdmp
Source:	Binary string: c:\users\samuli\opt\tap-windows6-mattock\tapinstall\7600\objfre_wlh_amd64\amd64\tapinstall.pdbH source: tapinstall.exe, 0000001E.00000002.1912221093.00007FF7BEED1000.00000020.00000001.01000000.00000016.sdmp, tapinstall.exe, 0000001E.00000000.1910661790.00007FF7BEED1000.00000020.00000001.01000000.00000016.sdmp, tapinstall.exe, 00000020.00000000.1913117233.00007FF7BEED1000.00000020.00000001.01000000.00000016.sdmp, tapinstall.exe, 00000020.00000002.1953276492.00007FF7BEED1000.00000020.00000001.01000000.00000016.sdmp, tapinstall.exe, 00000032.00000002.1972779400.00007FF7BEED1000.00000020.00000001.01000000.00000016.sdmp, tapinstall.exe, 00000032.00000000.1970876937.00007FF7BEED1000.00000020.00000001.01000000.00000016.sdmp
Source:	Binary string: C:\WorkShop\SuperSocket.ClientEngine\obj\Release\SuperSocket.ClientEngine.pdb source: LetsPRO.exe, 00000037.00000002.4214552147.00000000387C2000.00000002.00000001.01000000.00000037.sdmp
Source:	Binary string: C:\Users\eric\dev\SQLitePCL.raw\src\SQLitePCLRaw.nativelibrary\obj\Release\netstandard2.0\SQLitePCLRaw.nativelibrary.pdbSHA256 source: LetsPRO.exe, 00000037.00000002.4195831415.0000000035422000.00000002.00000001.01000000.0000002E.sdmp
Source:	Binary string: C:\Users\IEUser\pusher-websocket-dotnet\PusherClient\obj\release\net46\PusherClient.pdbSHA256 source: LetsPRO.exe, 00000037.00000002.4213951978.00000000385D2000.00000002.00000001.01000000.00000036.sdmp
Source:	Binary string: E:\A\_work\1795\s\corefx\bin\obj\Windows_NT.AnyCPU.Release\System.Runtime.InteropServices.RuntimeInformation\net462\System.Runtime.InteropServices.RuntimeInformation.pdbxE source: LetsPRO.exe, 00000037.00000002.4168244500.00000000067E2000.00000002.00000001.01000000.0000001F.sdmp
Source:	Binary string: keyfuncencryptionPBE2PARAMkeylengthprfPBKDF2PARAMcrypto\asn1\p5_pbev2.ccrypto\evp\p5_crpt2.cassertion failed: keylen <= sizeof(key)crypto\hmac\hmac.ccrypto\pkcs12\p12_key.cxn--compiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 /WX -DL_ENDIAN -DOPENSSL_PIC -D_WIN32_WINNT=0x0501 source: wegame.exe, 00000006.00000003.1736539346.00000000031D0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\Users\eric\dev\SQLitePCL.raw\src\SQLitePCLRaw.core\obj\Release\netstandard2.0\SQLitePCLRaw.core.pdb source: LetsPRO.exe, 00000037.00000002.4196069676.00000000371F2000.00000002.00000001.01000000.0000002F.sdmp
Source:	Binary string: D:\git\wegame_client\dependences\Lua\include\lua51.pdb source: wegame.exe, 00000006.00000002.4141048756.000000006C57A000.00000002.00000001.01000000.00000009.sdmp
Source:	Binary string: D:\a\1\s\SDK\AppCenter\Microsoft.AppCenter.WindowsDesktop\obj\Release\net461\Microsoft.AppCenter.pdbSHA256X7 source: LetsPRO.exe, 00000037.00000002.4187562856.0000000034AB5000.00000004.00000020.00020000.00000000.sdmp, LetsPRO.exe, 00000037.00000002.4179081431.0000000030452000.00000002.00000001.01000000.00000027.sdmp
Source:	Binary string: C:\Users\eric\dev\SQLitePCL.raw\src\SQLitePCLRaw.nativelibrary\obj\Release\netstandard2.0\SQLitePCLRaw.nativelibrary.pdb source: LetsPRO.exe, 00000037.00000002.4195831415.0000000035422000.00000002.00000001.01000000.0000002E.sdmp

Source: C:\Windows\System32\msiexec.exe	File opened: z:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: x:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: v:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: t:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: r:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: p:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: n:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: l:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: j:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: h:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: f:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: b:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: y:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: w:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: u:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: s:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: q:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: o:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: m:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: k:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: i:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: g:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: e:	Jump to behavior
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	File opened: c:
Source: C:\Windows\System32\msiexec.exe	File opened: a:	Jump to behavior

Source: C:\Program Files (x86)\haxGhXjmBFM\LetsPRO.exe	Code function: 3_2_00BC4318 __EH_prolog3_GS,FindFirstFileW,FindNextFileW,FindClose,std::ios_base::_Ios_base_dtor,	3_2_00BC4318
Source: C:\Program Files (x86)\haxGhXjmBFM\app-3.8.0\LetsPRO.exe	Code function: 5_2_00404F4D __EH_prolog3,GetFullPathNameW,PathIsUNCW,GetVolumeInformationW,CharUpperW,FindFirstFileW,FindClose,lstrlenW,	5_2_00404F4D
Source: C:\Program Files (x86)\Common Files\wegame.exe	Code function: 6_2_0045CBDF __EH_prolog3_GS,memset,GetModuleFileNameW,?filename@path@filesystem@ierd_tgp@@QBE?AV123@XZ,?parent_path@path@filesystem@ierd_tgp@@QBE?AV123@XZ,memset,FindFirstFileW,memset,wcsncpy_s,wcsncat_s,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindClose,	6_2_0045CBDF
Source: C:\Program Files (x86)\Common Files\wegame.exe	Code function: 6_2_004570C9 __EH_prolog3_GS,memset,memset,FindFirstFileW,memset,wcscmp,wcscmp,memset,DeleteFileW,?get_log_instance@base@@YAPAVILogger@1@XZ,GetLastError,FindNextFileW,FindClose,RemoveDirectoryW,?get_log_instance@base@@YAPAVILogger@1@XZ,GetLastError,	6_2_004570C9
Source: C:\Program Files (x86)\Common Files\wegame.exe	Code function: 6_2_00457307 __EH_prolog3_GS,memset,GetEnvironmentVariableW,?get_log_instance@base@@YAPAVILogger@1@XZ,memset,GetModuleFileNameW,wcsrchr,SimpleUString::operator=,memset,GetFileAttributesW,memset,memset,FindFirstFileW,memset,wcscmp,SimpleUString::operator=,wcscmp,wcscmp,FindNextFileW,FindClose,?get_log_instance@base@@YAPAVILogger@1@XZ,	6_2_00457307
Source: C:\Program Files (x86)\Common Files\wegame.exe	Code function: 6_2_0040F710 _invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,memset,FindFirstFileW,wcscpy_s,_invalid_parameter_noinfo_noreturn,	6_2_0040F710
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Code function: 8_2_004059CC GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	8_2_004059CC
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Code function: 8_2_004065FD FindFirstFileW,FindClose,	8_2_004065FD
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Code function: 8_2_00402868 FindFirstFileW,	8_2_00402868
Source: C:\Program Files (x86)\haxGhXjmBFM\app-3.8.0\LetsPRO.exe	Code function: 10_2_00404F4D __EH_prolog3,GetFullPathNameW,PathIsUNCW,GetVolumeInformationW,CharUpperW,FindFirstFileW,FindClose,lstrlenW,	10_2_00404F4D

Networking

Yara detected Generic Downloader

Source: Yara match	File source: C:\Program Files (x86)\letsvpn\app-3.8.0\netstandard.dll, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\letsvpn\Update.exe, type: DROPPED

Source: global traffic	UDP traffic: 192.168.2.4:59728 -> 103.7.30.61:8000
Source: global traffic	UDP traffic: 192.168.2.4:59474 -> 103.7.30.83:8000

Source: global traffic

TCP traffic: 192.168.2.4:49765 -> 8.8.8.8:53

Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: tqos.wegamex.com.hkAccept: /Content-Length: 689Content-Type: multipart/form-data; boundary=------------------------15ced2856b975cac
Source: global traffic	HTTP traffic detected: GET /app/4fc436ef36f4026102d7?protocol=5&client=pusher-dotnet-client&version=1.1.2 HTTP/1.1Host: ws-ap1.pusher.comUpgrade: websocketConnection: UpgradeSec-WebSocket-Version: 13Sec-WebSocket-Key: NmRhMTFjMTgtMjY0OC00OQ==Origin: ws://ws-ap1.pusher.com

Source: Joe Sandbox View	IP Address: 183.60.146.66 183.60.146.66
Source: Joe Sandbox View	IP Address: 152.195.19.97 152.195.19.97
Source: Joe Sandbox View	IP Address: 103.235.46.96 103.235.46.96
Source: Joe Sandbox View	IP Address: 103.235.46.96 103.235.46.96

Source: global traffic	HTTP traffic detected: GET /crx/blobs/Af2yII2B0rZ8cHZ0zhAQMpE5nnHa-luPaKnkV2HzRYHJSUKQp47BzdeiX0Igp7uG9ixLd9f-dn93AlqvBwPDqfl_F5H1vnj2K-nXA2wr_RToPGmP3S9lmWq3G-LCKHiOc8oAxlKa5TcGVwrsFgTq79yNDjEULjiD5Cwy/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_79_1_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/arbitration_priority_list/4.0.5/asset?assetgroup=ArbitrationService HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: ArbitrationServiceSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: POST /chromewebstore/v1.1/items/verify HTTP/1.1Host: www.googleapis.comConnection: keep-aliveContent-Length: 119Content-Type: application/jsonSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1721941035&P2=404&P3=2&P4=M7A1OzH62S9Lk3UHKN5cCSEzeUZ01KVvQkb3YBsYyAsZEb3jWqQ4rtBDc42rk4GP3zd%2b0DfERo9Q01hcvKyUew%3d%3d HTTP/1.1Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.comConnection: keep-aliveMS-CV: 1jOZtoZB8Px9C8siZ9XR9iSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8

Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.35.170
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.35.170
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.35.170
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.35.170
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.35.170
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.35.170
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.35.170
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.35.170
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.35.170
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.35.170
Source: unknown	TCP traffic detected without corresponding DNS query: 152.195.19.97
Source: unknown	TCP traffic detected without corresponding DNS query: 152.195.19.97
Source: unknown	TCP traffic detected without corresponding DNS query: 152.195.19.97
Source: unknown	TCP traffic detected without corresponding DNS query: 152.195.19.97
Source: unknown	TCP traffic detected without corresponding DNS query: 152.195.19.97
Source: unknown	TCP traffic detected without corresponding DNS query: 152.195.19.97
Source: unknown	TCP traffic detected without corresponding DNS query: 152.195.19.97
Source: unknown	TCP traffic detected without corresponding DNS query: 152.195.19.97
Source: unknown	TCP traffic detected without corresponding DNS query: 152.195.19.97
Source: unknown	TCP traffic detected without corresponding DNS query: 152.195.19.97
Source: unknown	TCP traffic detected without corresponding DNS query: 152.195.19.97
Source: unknown	TCP traffic detected without corresponding DNS query: 152.195.19.97
Source: unknown	TCP traffic detected without corresponding DNS query: 152.195.19.97
Source: unknown	TCP traffic detected without corresponding DNS query: 152.195.19.97
Source: unknown	TCP traffic detected without corresponding DNS query: 23.98.101.155
Source: unknown	TCP traffic detected without corresponding DNS query: 23.98.101.155
Source: unknown	TCP traffic detected without corresponding DNS query: 23.98.101.155
Source: unknown	TCP traffic detected without corresponding DNS query: 23.98.101.155
Source: unknown	TCP traffic detected without corresponding DNS query: 23.98.101.155
Source: unknown	TCP traffic detected without corresponding DNS query: 23.98.101.155
Source: unknown	TCP traffic detected without corresponding DNS query: 183.60.146.66
Source: unknown	TCP traffic detected without corresponding DNS query: 183.60.146.66
Source: unknown	TCP traffic detected without corresponding DNS query: 183.60.146.66
Source: unknown	TCP traffic detected without corresponding DNS query: 183.60.146.66
Source: unknown	TCP traffic detected without corresponding DNS query: 183.60.146.66
Source: unknown	TCP traffic detected without corresponding DNS query: 183.60.146.66
Source: unknown	TCP traffic detected without corresponding DNS query: 35.227.223.56
Source: unknown	TCP traffic detected without corresponding DNS query: 35.227.223.56
Source: unknown	TCP traffic detected without corresponding DNS query: 35.227.223.56
Source: unknown	TCP traffic detected without corresponding DNS query: 35.227.223.56
Source: unknown	TCP traffic detected without corresponding DNS query: 35.227.223.56
Source: unknown	TCP traffic detected without corresponding DNS query: 35.227.223.56
Source: unknown	TCP traffic detected without corresponding DNS query: 35.227.223.56
Source: unknown	TCP traffic detected without corresponding DNS query: 23.98.101.155
Source: unknown	TCP traffic detected without corresponding DNS query: 23.98.101.155
Source: unknown	TCP traffic detected without corresponding DNS query: 23.98.101.155
Source: unknown	TCP traffic detected without corresponding DNS query: 23.98.101.155
Source: unknown	TCP traffic detected without corresponding DNS query: 23.98.101.155
Source: unknown	TCP traffic detected without corresponding DNS query: 23.98.101.155
Source: unknown	TCP traffic detected without corresponding DNS query: 23.98.101.155

Source: global traffic	HTTP traffic detected: GET /crx/blobs/Af2yII2B0rZ8cHZ0zhAQMpE5nnHa-luPaKnkV2HzRYHJSUKQp47BzdeiX0Igp7uG9ixLd9f-dn93AlqvBwPDqfl_F5H1vnj2K-nXA2wr_RToPGmP3S9lmWq3G-LCKHiOc8oAxlKa5TcGVwrsFgTq79yNDjEULjiD5Cwy/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_79_1_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/arbitration_priority_list/4.0.5/asset?assetgroup=ArbitrationService HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: ArbitrationServiceSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1721941035&P2=404&P3=2&P4=M7A1OzH62S9Lk3UHKN5cCSEzeUZ01KVvQkb3YBsYyAsZEb3jWqQ4rtBDc42rk4GP3zd%2b0DfERo9Q01hcvKyUew%3d%3d HTTP/1.1Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.comConnection: keep-aliveMS-CV: 1jOZtoZB8Px9C8siZ9XR9iSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rest-api?edns_client_subnet=0.0.0.0%2F0&name=nit.crash1ytics.com.&type=1 HTTP/1.1Host: d1dmgcawtbm6l9.cloudfront.netUser-Agent: Go-http-client/1.1Accept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /rest-api?edns_client_subnet=0.0.0.0%2F0&name=nal.fqoqehwib.com.&type=1 HTTP/1.1Host: d1dmgcawtbm6l9.cloudfront.netUser-Agent: Go-http-client/1.1Accept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /rest-api?edns_client_subnet=0.0.0.0%2F0&name=chr.alipayassets.com.&type=1 HTTP/1.1Host: d1dmgcawtbm6l9.cloudfront.netUser-Agent: Go-http-client/1.1Accept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /rest-api?edns_client_subnet=0.0.0.0%2F0&name=nit.crash1ytics.com.&type=1 HTTP/1.1Host: d1dmgcawtbm6l9.cloudfront.netUser-Agent: Go-http-client/1.1Accept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /app/4fc436ef36f4026102d7?protocol=5&client=pusher-dotnet-client&version=1.1.2 HTTP/1.1Host: ws-ap1.pusher.comUpgrade: websocketConnection: UpgradeSec-WebSocket-Version: 13Sec-WebSocket-Key: NmRhMTFjMTgtMjY0OC00OQ==Origin: ws://ws-ap1.pusher.com

Source: LetsPRO.exe, 00000037.00000002.4268427872.000000006852B000.00000002.00000001.01000000.00000024.sdmp	String found in binary or memory: os/exec.Command(]. new data: GID[^/app([0-9]+)/app^created by (.+)$bad TinySizeClassbad key algorithmbad local addressboundBindToDevicecannot find id %sclose dns channelconnectingAddresscorkOptionEnableddecryption failedduplicate addresseffectiveNetProtoentersyscallblockexec apiAgent GIDexec apiAgent RIDexec deleteRegDirexec format errorexec nicIndexToIPexec phyNIC Indexexec phyNIC SetIPexec tapIFCE Nameexec: killing Cmdexec: not startedfractional secondframe_ping_lengthg already scannedget up-going ACK glEdgeFlagPointerglPopClientAttribglTexCoordPointergp.waiting != nilhandshake failureif-modified-sinceillegal parameterin string literalindex > windowEndinteger too largeinvalid BMPStringinvalid IA5Stringinvalid bit size invalid stream IDip2if func returnipv6-only networkisConnectNotifiedjoyReleaseCapturekey align too biglocked m0 woke upmark - bad statusmarkBits overflowmciGetCreatorTaskmessage too largemidiInGetDevCapsWmidiOutGetNumDevsmidiStreamRestartmissing closing )missing closing ]missing extensionmixerGetLineInfoWmultipartmaxpartsneed re-resolve: nextId too large:nil resource bodyno available Datano data availablenoChecksumEnablednotetsleepg on g0old node version:operation abortedparameter problempermission deniedpkg/buffer.Bufferpkg/sleep.Sleeperpkg/tcpip.Addresspppoe instanceId:protect fd failedreceiveBufferSizereceiveTOSEnabledreceiveTTLEnabledreflect.Value.Capreflect.Value.Intreflect.Value.Lenreflect: New(nil)reflect: call of remoteAddr is nilruntime.newosprocruntime/internal/runtime: level = runtime: nameOff runtime: pointer runtime: summary[runtime: textOff runtime: typeOff scanobject n == 0seeker can't seekselect (no cases)set sdk loglevel:set tap static ipstack: frame={sp:start map checkerstart refresh infswept cached spansync.RWMutex.Lockthread exhaustiontimeGetSystemTimetransfer-encodingtruncated headersudp routines num:unknown caller pcunknown hostname:unknown type kindunrecognized nameupdate dns dialeruse gid:%s rid:%swait for GC cyclewaveInGetDevCapsWwaveInGetPositionwaveOutGetNumDevswebsocket: close wglGetPixelFormatwglGetProcAddresswglSetPixelFormatwine_get_versionwrong medium typewww.baidu.com:443www.facebook.com.x-forwarded-proto but memory size connection limit (message too big) because dotdotdot in async preempt equals www.facebook.com (Facebook)
Source: LetsPRO.exe, 00000037.00000002.4268427872.000000006852B000.00000002.00000001.01000000.00000024.sdmp	String found in binary or memory: wrong medium typewww.baidu.com:443www.facebook.com.x-forwarded-proto but memory size connection limit (message too big) because dotdotdot in async preempt equals www.facebook.com (Facebook)

Source: global traffic	DNS traffic detected: DNS query: ied-tqos.wegamex.com.hk
Source: global traffic	DNS traffic detected: DNS query: tqos.wegamex.com.hk
Source: global traffic	DNS traffic detected: DNS query: clients2.googleusercontent.com
Source: global traffic	DNS traffic detected: DNS query: chrome.cloudflare-dns.com
Source: global traffic	DNS traffic detected: DNS query: crt.sectigo.com
Source: global traffic	DNS traffic detected: DNS query: ws-ap1.pusher.com
Source: global traffic	DNS traffic detected: DNS query: www.baidu.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: www.yandex.com
Source: global traffic	DNS traffic detected: DNS query: nal.fqoqehwib.com
Source: global traffic	DNS traffic detected: DNS query: d1dmgcawtbm6l9.cloudfront.net
Source: global traffic	DNS traffic detected: DNS query: chr.alipayassets.com
Source: global traffic	DNS traffic detected: DNS query: nit.crash1ytics.com
Source: global traffic	DNS traffic detected: DNS query: in.appcenter.ms

Source: unknown

HTTP traffic detected: POST /dns-query HTTP/1.1Host: chrome.cloudflare-dns.comConnection: keep-aliveContent-Length: 128Accept: application/dns-messageAccept-Language: *User-Agent: ChromeAccept-Encoding: identityContent-Type: application/dns-message

Source: LetsPRO.exe, 00000037.00000002.4187562856.0000000034B38000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://acraiz.icpbrasil.gov.br/DPCacraiz.pdf0?
Source: LetsPRO.exe, 00000037.00000002.4187562856.0000000034B38000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://acraiz.icpbrasil.gov.br/LCRacraizv2.crl0
Source: wegame.exe, 00000006.00000003.1736539346.00000000031D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDCodeSigningCA-1.crt0
Source: wegame.exe, 00000006.00000003.1736539346.00000000031D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: wegame.exe, 00000006.00000003.1736539346.00000000031D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: wegame.exe, 00000006.00000003.1736539346.00000000031D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: wegame.exe, 00000006.00000003.1736539346.00000000031D0000.00000004.00001000.00020000.00000000.sdmp, LetsPRO.exe, 00000037.00000002.4165069289.0000000006110000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: LetsPRO.exe, 00000037.00000002.4166122797.0000000006193000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRoo
Source: wegame.exe, 00000006.00000003.1736539346.00000000031D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: LetsPRO.exe, 00000037.00000002.4187562856.0000000034BCB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: LetsPRO.exe, 00000037.00000002.4187562856.0000000034A90000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: LetsPRO.exe, 00000037.00000002.4183661580.0000000030CEF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.m
Source: powershell.exe, 00000018.00000002.1893014368.0000000002F54000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000018.00000002.1905703178.00000000073F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.micro
Source: LetsPRO.exe, 00000037.00000002.4166122797.0000000006193000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoPublicC4t
Source: LetsPRO.exe, 00000037.00000002.4166122797.0000000006193000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCo
Source: LetsPRO.exe, 00000037.00000002.4142762410.0000000001A47000.00000004.00000020.00020000.00000000.sdmp, LetsPRO.exe, 00000037.00000002.4180752320.00000000309B5000.00000004.00000020.00020000.00000000.sdmp, LetsPRO.exe, 00000037.00000002.4187562856.0000000034BA4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y
Source: svchost.exe, 0000000E.00000002.4142093238.00000177F8E00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: LetsPRO.exe, 00000037.00000002.4187562856.0000000034B38000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.xrampsecurity.com/XGCA.crl0
Source: LetsPRO.exe, 00000037.00000002.4187562856.0000000034B38000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl1.comsign.co.il/crl/comsignglobalrootca.crl0
Source: LetsPRO.exe, 00000037.00000002.4166122797.0000000006193000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/D
Source: wegame.exe, 00000006.00000003.1736539346.00000000031D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: wegame.exe, 00000006.00000003.1736539346.00000000031D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: wegame.exe, 00000006.00000003.1736539346.00000000031D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: wegame.exe, 00000006.00000003.1736539346.00000000031D0000.00000004.00001000.00020000.00000000.sdmp, LetsPRO.exe, 00000037.00000002.4165069289.0000000006110000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: wegame.exe, 00000006.00000003.1736539346.00000000031D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: wegame.exe, 00000006.00000003.1736539346.00000000031D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/assured-cs-g1.crl00
Source: wegame.exe, 00000006.00000003.1736539346.00000000031D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: wegame.exe, 00000006.00000003.1736539346.00000000031D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: wegame.exe, 00000006.00000003.1736539346.00000000031D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: wegame.exe, 00000006.00000003.1736539346.00000000031D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/assured-cs-g1.crl0L
Source: wegame.exe, 00000006.00000003.1736539346.00000000031D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0L
Source: LetsPRO.exe, 00000037.00000002.4142762410.0000000001A47000.00000004.00000020.00020000.00000000.sdmp, LetsPRO.exe, 00000037.00000002.4180752320.00000000309B5000.00000004.00000020.00020000.00000000.sdmp, LetsPRO.exe, 00000037.00000002.4187562856.0000000034BA4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#
Source: LetsPRO.exe, 00000037.00000002.4180752320.00000000309D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: LetsPRO.exe, 00000037.00000002.4165069289.0000000006110000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/enw
Source: svchost.exe, 0000000E.00000003.1727303694.00000177F8C98000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: svchost.exe, 0000000E.00000003.1727303694.00000177F8C98000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acosgr5ufcefr7w7nv4v6k4ebdda_117.0.5938.132/117.0.5
Source: svchost.exe, 0000000E.00000003.1727303694.00000177F8C98000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: svchost.exe, 0000000E.00000003.1727303694.00000177F8C98000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: svchost.exe, 0000000E.00000003.1727303694.00000177F8C98000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: svchost.exe, 0000000E.00000003.1727303694.00000177F8C98000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: svchost.exe, 0000000E.00000003.1727303694.00000177F8CCD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: svchost.exe, 0000000E.00000003.1727303694.00000177F8D87000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: LetsPRO.exe, 00000037.00000002.4164213776.0000000006032000.00000002.00000001.01000000.0000001D.sdmp	String found in binary or memory: http://james.newtonking.com/projects/json
Source: LetsPRO.exe, 00000037.00000002.4163447409.0000000005D52000.00000002.00000001.01000000.0000001B.sdmp	String found in binary or memory: http://logging.apache.org/log4net/release/faq.html#trouble-EventLog
Source: haxGhXjmBFM.exe, 00000008.00000002.2032480091.000000000040A000.00000004.00000001.01000000.00000006.sdmp, haxGhXjmBFM.exe, 00000008.00000003.1973465998.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, haxGhXjmBFM.exe, 00000008.00000000.1717959233.000000000040A000.00000008.00000001.01000000.00000006.sdmp, haxGhXjmBFM.exe.1.dr	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: powershell.exe, 00000018.00000002.1898978574.0000000005C86000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000037.00000002.4153902708.00000000045B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: LetsPRO.exe, 00000037.00000002.4187562856.0000000034BCB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0
Source: wegame.exe, 00000006.00000003.1736539346.00000000031D0000.00000004.00001000.00020000.00000000.sdmp, LetsPRO.exe, 00000037.00000002.4166122797.0000000006193000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0A
Source: wegame.exe, 00000006.00000003.1736539346.00000000031D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0C
Source: wegame.exe, 00000006.00000003.1736539346.00000000031D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0L
Source: wegame.exe, 00000006.00000003.1736539346.00000000031D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0N
Source: wegame.exe, 00000006.00000003.1736539346.00000000031D0000.00000004.00001000.00020000.00000000.sdmp, LetsPRO.exe, 00000037.00000002.4165069289.0000000006110000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0X
Source: LetsPRO.exe, 00000037.00000002.4142762410.0000000001A47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.sectig
Source: LetsPRO.exe, 00000037.00000002.4166122797.0000000006193000.00000004.00000020.00020000.00000000.sdmp, LetsPRO.exe, 00000037.00000002.4180752320.00000000309B5000.00000004.00000020.00020000.00000000.sdmp, LetsPRO.exe, 00000037.00000002.4187562856.0000000034BA4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.sectigo.com0
Source: LetsPRO.exe, 00000037.00000002.4143541172.0000000003648000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: LetsPRO.exe, 00000037.00000002.4180752320.00000000309B5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://pki.digidentity.eu/validatie0
Source: LetsPRO.exe, 00000037.00000002.4143541172.0000000003371000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000037.00000000.2030391391.0000000000E62000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://schemas.fontawesome.io/icons/
Source: powershell.exe, 00000018.00000002.1893721239.0000000004D66000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000037.00000002.4143541172.0000000003648000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: powershell.exe, 0000000C.00000002.1728755337.000000000476C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000018.00000002.1893721239.0000000004C11000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000037.00000002.4143541172.0000000003371000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000018.00000002.1893721239.0000000004D66000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000037.00000002.4143541172.0000000003648000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: wegame.exe, wegame.exe, 00000006.00000002.4137406249.0000000000476000.00000002.00000001.01000000.00000004.sdmp, wegame.exe, 00000006.00000000.1716127775.0000000000476000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: http://ue.qq.com/mur/?a=survey&b=15087&c=1&d=15272af955762c32696995ddcabc396a
Source: wegame.exe, 00000006.00000002.4137406249.0000000000476000.00000002.00000001.01000000.00000004.sdmp, wegame.exe, 00000006.00000000.1716127775.0000000000476000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: http://ue.qq.com/mur/?a=survey&b=15087&c=1&d=15272af955762c32696995ddcabc396a-s-f
Source: LetsPRO.exe, 00000037.00000000.2030391391.0000000000E62000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://wpfanimatedgif.codeplex.com
Source: LetsPRO.exe, 00000037.00000002.4143541172.0000000003648000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000037.00000002.4187562856.0000000034AB5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: LetsPRO.exe, 00000037.00000002.4187562856.0000000034B38000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.cert.fnmt.es/dpcs/0
Source: wegame.exe, 00000006.00000003.1736539346.00000000031D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com/ssl-cps-repository.htm0
Source: LetsPRO.exe, 00000037.00000002.4187562856.0000000034B38000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.dnie.es/dpc0
Source: LetsPRO.exe, 00000037.00000002.4187562856.0000000034B38000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.firmaprofesional.com/cps0
Source: LetsPRO.exe, 00000037.00000002.4201314539.0000000037A82000.00000002.00000001.01000000.00000033.sdmp, LetsPRO.exe, 00000037.00000000.2030391391.0000000000E62000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://www.hardcodet.net/taskbar
Source: LetsPRO.exe, 00000037.00000002.4194258639.0000000034EB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: wegame.exe, 00000006.00000002.4143954280.000000006CECB000.00000002.00000001.01000000.0000000C.sdmp	String found in binary or memory: http://www.openssl.org/support/faq.html
Source: wegame.exe, 00000006.00000002.4137406249.0000000000476000.00000002.00000001.01000000.00000004.sdmp, wegame.exe, 00000006.00000000.1716127775.0000000000476000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: http://www.winimage.com/zLibDll
Source: wegame.exe, 00000006.00000002.4137406249.0000000000476000.00000002.00000001.01000000.00000004.sdmp, wegame.exe, 00000006.00000000.1716127775.0000000000476000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: http://www.winimage.com/zLibDll1.2.5
Source: LetsPRO.exe, 00000037.00000002.4172640122.000000000FC92000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://0.0.0.0%2F0
Source: LetsPRO.exe, 00000037.00000002.4173822346.000000000FD00000.00000004.00001000.00020000.00000000.sdmp, LetsPRO.exe, 00000037.00000002.4177372856.000000000FF72000.00000004.00001000.00020000.00000000.sdmp, LetsPRO.exe, 00000037.00000002.4177807037.000000000FFB2000.00000004.00001000.00020000.00000000.sdmp, LetsPRO.exe, 00000037.00000002.4176380888.000000000FEAA000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://USUS2.Session-IdCERTIFICATE
Source: powershell.exe, 0000000C.00000002.1728755337.00000000047A8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1728755337.0000000004799000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000018.00000002.1893721239.0000000004C11000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore6lB
Source: LetsPRO.exe, 00000037.00000002.4167809675.0000000006742000.00000002.00000001.01000000.0000001E.sdmp	String found in binary or memory: https://aka.ms/toolkit/dotnet
Source: LetsPRO.exe, 00000037.00000002.4153902708.00000000045B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: LetsPRO.exe, 00000037.00000002.4153902708.00000000045B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: LetsPRO.exe, 00000037.00000002.4153902708.00000000045B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: wegame.exe, wegame.exe, 00000006.00000002.4142318714.000000006C825000.00000002.00000001.01000000.00000008.sdmp, wegame.exe, 00000006.00000003.1736539346.00000000031D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://curl.haxx.se/docs/http-cookies.html
Source: LetsPRO.exe, 00000037.00000002.4171712622.000000000FC22000.00000004.00001000.00020000.00000000.sdmp, LetsPRO.exe, 00000037.00000002.4173917688.000000000FD44000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://d1dmgcawtbm6l9.cloudfront.net/rest-api
Source: LetsPRO.exe, 00000037.00000002.4171712622.000000000FC22000.00000004.00001000.00020000.00000000.sdmp, LetsPRO.exe, 00000037.00000002.4173917688.000000000FD44000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://d1dmgcawtbm6l9.cloudfront.net/rest-apiedns_client_subnet=0.0.0.0%2F0&name=d1dmgcawtbm6l9.clo
Source: LetsPRO.exe, 00000037.00000002.4268427872.000000006852B000.00000002.00000001.01000000.00000024.sdmp	String found in binary or memory: https://d1dmgcawtbm6l9.cloudfront.net/rest-apiinvalid
Source: LetsPRO.exe, 00000037.00000000.2030391391.0000000000E62000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: https://d3jb1hiazbhf2r.cloudfront.net/letsvpn-world/en/articles/3401886-special-settings-for-smartby
Source: LetsPRO.exe, 00000037.00000000.2030391391.0000000000E62000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: https://d3jb1hiazbhf2r.cloudfront.net/letsvpn-world/en/articles/8262720-special-settings-for-host-ne
Source: LetsPRO.exe, 00000037.00000000.2030391391.0000000000E62000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: https://d3jb1hiazbhf2r.cloudfront.net/letsvpn-world/en/articles/8262786-special-settings-for-express
Source: LetsPRO.exe, 00000037.00000000.2030391391.0000000000E62000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: https://d3jb1hiazbhf2r.cloudfront.net/letsvpn-world/en/articles/8262801-special-settings-for-killer-
Source: LetsPRO.exe, 00000037.00000000.2030391391.0000000000E62000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: https://d3jb1hiazbhf2r.cloudfront.net/letsvpn-world/en/articles/8263068-how-to-delete-hosts-in-windo
Source: svchost.exe, 0000000E.00000003.1727303694.00000177F8D42000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6
Source: svchost.exe, 0000000E.00000003.1727303694.00000177F8CF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/Prod.C:
Source: svchost.exe, 0000000E.00000003.1727303694.00000177F8D42000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2
Source: svchost.exe, 0000000E.00000003.1727303694.00000177F8D23000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1727303694.00000177F8D42000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1727303694.00000177F8D87000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1727303694.00000177F8D74000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1727303694.00000177F8D68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: svchost.exe, 0000000E.00000003.1727303694.00000177F8D42000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96
Source: LetsPRO.exe, 00000037.00000002.4167809675.0000000006742000.00000002.00000001.01000000.0000001E.sdmp	String found in binary or memory: https://github.com/CommunityToolkit/dotnet
Source: LetsPRO.exe, 00000037.00000002.4164213776.0000000006032000.00000002.00000001.01000000.0000001D.sdmp	String found in binary or memory: https://github.com/JamesNK/Newtonsoft.Json
Source: LetsPRO.exe, 00000037.00000002.4143541172.0000000003648000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: LetsPRO.exe, 00000037.00000002.4168580863.0000000006E72000.00000002.00000001.01000000.00000020.sdmp	String found in binary or memory: https://github.com/dotnet/corefx/tree/32b491939fbd125f304031c35038b1e14b4e3958
Source: LetsPRO.exe, 00000037.00000002.4168580863.0000000006E72000.00000002.00000001.01000000.00000020.sdmp	String found in binary or memory: https://github.com/dotnet/corefx/tree/32b491939fbd125f304031c35038b1e14b4e39588
Source: LetsPRO.exe, 00000037.00000002.4168359295.00000000067F2000.00000002.00000001.01000000.00000022.sdmp	String found in binary or memory: https://github.com/dotnet/corefx/tree/7601f4f6225089ffb291dc7d58293c7bbf5c5d4f
Source: LetsPRO.exe, 00000037.00000002.4168398162.00000000067F6000.00000002.00000001.01000000.00000022.sdmp	String found in binary or memory: https://github.com/dotnet/corefx/tree/7601f4f6225089ffb291dc7d58293c7bbf5c5d4f8
Source: LetsPRO.exe, 00000037.00000002.4143541172.0000000003648000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000037.00000002.4179081431.0000000030452000.00000002.00000001.01000000.00000027.sdmp	String found in binary or memory: https://in.appcenter.ms
Source: LetsPRO.exe, 00000037.00000002.4179081431.0000000030452000.00000002.00000001.01000000.00000027.sdmp	String found in binary or memory: https://in.appcenter.ms./logs?api-version=1.0.0
Source: LetsPRO.exe, 00000037.00000002.4143541172.0000000003648000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://in.appcenter.ms/logs?api-version=1.0.0
Source: haxGhXjmBFM.exe, 00000008.00000002.2033229713.0000000000739000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://intercom.help/letsvpn-world/-N
Source: LetsPRO.exe, 00000037.00000000.2030391391.0000000000E62000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: https://intercom.help/letsvpn-world/en/articles/2780068-%E5%A6%82%E4%BD%95%E4%B8%8B%E8%BD%BD%E5%BE%9
Source: LetsPRO.exe, 00000037.00000000.2030391391.0000000000E62000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: https://intercom.help/letsvpn-world/en/articles/2830420-special-settings-for-killer-networking-produ
Source: LetsPRO.exe, 00000037.00000000.2030391391.0000000000E62000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: https://intercom.help/letsvpn-world/en/articles/2907649-%E9%80%9A%E8%BF%87%E7%94%B3%E8%BF%B0%E6%89%B
Source: LetsPRO.exe, 00000037.00000000.2030391391.0000000000E62000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: https://intercom.help/letsvpn-world/en/articles/2925752-how-to-download-letsvpn
Source: LetsPRO.exe, 00000037.00000000.2030391391.0000000000E62000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: https://intercom.help/letsvpn-world/en/articles/2926044-what-if-i-reached-maximum-connection-limit
Source: LetsPRO.exe, 00000037.00000000.2030391391.0000000000E62000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: https://intercom.help/letsvpn-world/en/articles/2926062-recover-my-letsvpn-account
Source: LetsPRO.exe, 00000037.00000000.2030391391.0000000000E62000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: https://intercom.help/letsvpn-world/en/articles/3081101-adjust-the-settings-for-ipv6
Source: LetsPRO.exe, 00000037.00000000.2030391391.0000000000E62000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: https://intercom.help/letsvpn-world/en/articles/3710603-about-logging-in-out-anomalies
Source: LetsPRO.exe, 00000037.00000000.2030391391.0000000000E62000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: https://intercom.help/letsvpn-world/en/collections/1611781-%E4%B8%AD%E6%96%87%E5%B8%AE%E5%8A%A9
Source: LetsPRO.exe, 00000037.00000002.4143541172.0000000003371000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000037.00000000.2030391391.0000000000E62000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: https://intercom.help/letsvpn-world/en/collections/1628560-help-documents
Source: LetsPRO.exe, 00000037.00000000.2030391391.0000000000E62000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: https://intercom.help/letsvpn-world/en/collections/Killer
Source: LetsPRO.exe, 00000037.00000000.2030391391.0000000000E62000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: https://letsvpn.world/privacy.html
Source: LetsPRO.exe, 00000037.00000000.2030391391.0000000000E62000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: https://letsvpn.world/registerterm.html
Source: LetsPRO.exe, 00000037.00000000.2030391391.0000000000E62000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: https://letsvpn.world/terms.html
Source: LetsPRO.exe, 00000037.00000002.4173917688.000000000FD0C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://nit.crash1ytics.com
Source: LetsPRO.exe, 00000037.00000002.4173917688.000000000FD0C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://nit.crash1ytics.com-
Source: LetsPRO.exe, 00000037.00000002.4175179086.000000000FD84000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://nit.crash1ytics.com/app33/device
Source: LetsPRO.exe, 00000037.00000002.4172640122.000000000FC86000.00000004.00001000.00020000.00000000.sdmp, LetsPRO.exe, 00000037.00000002.4173917688.000000000FD0C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://nit.crash1ytics.com/app33/devicechecking
Source: LetsPRO.exe, 00000037.00000002.4177372856.000000000FF72000.00000004.00001000.00020000.00000000.sdmp, LetsPRO.exe, 00000037.00000002.4173917688.000000000FD0C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://nit.crash1ytics.com/app33/devicehttps://nit.crash1ytics.com/app33/device
Source: LetsPRO.exe, 00000037.00000002.4172640122.000000000FC86000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://nit.crash1ytics.com/app33/devicehttps://nit.crash1ytics.com/app33/deviceHu
Source: LetsPRO.exe, 00000037.00000002.4176710420.000000000FF1B000.00000004.00001000.00020000.00000000.sdmp, LetsPRO.exe, 00000037.00000002.4173917688.000000000FD0C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://nit.crash1ytics.comhttpCode=-2
Source: powershell.exe, 00000018.00000002.1898978574.0000000005C86000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000037.00000002.4153902708.00000000045B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: svchost.exe, 0000000E.00000003.1727303694.00000177F8D42000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneclient.sfx.ms/Win/Installers/23.194.0917.0001/amd64/OneDriveSetup.exe
Source: svchost.exe, 0000000E.00000003.1727303694.00000177F8CF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe.C:
Source: LetsPRO.exe, 00000037.00000000.2030391391.0000000000E62000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: https://pngimg.com/uploads/light/light_PNG14440.png
Source: LetsPRO.exe, 00000037.00000002.4177372856.000000000FF72000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://postPost223.61.70.52
Source: LetsPRO.exe, 00000037.00000000.2030391391.0000000000E62000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: https://rdrt.jkjtdfbs.com/letsvpn-world/en/articles/8262690-special-settings-for-intel-connectivity-
Source: LetsPRO.exe, 00000037.00000002.4142762410.0000000001A47000.00000004.00000020.00020000.00000000.sdmp, LetsPRO.exe, 00000037.00000002.4166122797.0000000006193000.00000004.00000020.00020000.00000000.sdmp, LetsPRO.exe, 00000037.00000002.4180752320.00000000309B5000.00000004.00000020.00020000.00000000.sdmp, LetsPRO.exe, 00000037.00000002.4187562856.0000000034BA4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sectigo.com/CPS0
Source: LetsPRO.exe, 00000037.00000000.2030391391.0000000000E62000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: https://widget.intercom.io/widget/
Source: wegame.exe, 00000006.00000003.1736539346.00000000031D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.digicert.com/CPS0
Source: LetsPRO.exe, 00000037.00000002.4164213776.0000000006032000.00000002.00000001.01000000.0000001D.sdmp	String found in binary or memory: https://www.newtonsoft.com/jsonschema
Source: LetsPRO.exe, 00000037.00000002.4164213776.0000000006032000.00000002.00000001.01000000.0000001D.sdmp	String found in binary or memory: https://www.nuget.org/packages/Newtonsoft.Json.Bson

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443

Source: C:\Program Files (x86)\haxGhXjmBFM.exe

Code function: 8_2_00405461 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,FindCloseChangeNotification,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard,

8_2_00405461

Source: LetsPRO.exe, 00000037.00000002.4268427872.000000006852B000.00000002.00000001.01000000.00000024.sdmp

Binary or memory string: is unavailable()<>@,;:\"/[]?=,M3.2.0,M11.1.0-------------- 0601021504Z0700114.114.114.114126.255.255.254169.254.255.255191.255.255.254223.255.255.254255.255.255.248476837158203125: cannot parse : no frame (sp=; SameSite=None<invalid Value>ASCII_Hex_DigitAccept-EncodingAccept-LanguageAccount-ExpiredAccount-TimeoutAddDllDirectoryAddMandatoryAceAreFileApisANSIBP_BUFFERFORMATBackupEventLogWCLSIDFromProgIDCLSIDFromStringCOLORADJUSTMENTCOMPOSITIONFORMCRYPTOAPI_BLOB_CRYPT_ATTRIBUTECRYPT_ATTR_BLOBCRYPT_DATA_BLOBCRYPT_HASH_BLOBCallWindowProcWClientAuthType(CoInitializeWOWColorAdjustLumaCompareFileTimeControl_RunDLLWCreateDataCacheCreateErrorInfoCreateHardLinkWCreateMailslotWCreateMetaFileWCreatePopupMenuCreateToolbarExCreateWindowExWCryptCreateHashCryptDestroyKeyCryptGetUserKeyCryptMemReallocCryptMsgControlDAD_DragEnterExDESKTOPENUMPROCDdeGetLastErrorDdeQueryStringWDdeUnaccessDataDdeUninitializeDefRawInputProcDefSubclassProcDeleteIPAddressDestinationAddrDeviceIoControlDialogBoxParamWDlgDirSelectExWDnsPolicyConfigDownload-FailedDragAcceptFilesDrawMenuBarTempDrawStatusTextWDrawThemeTextExDuplicateHandleECDSAP256SHA256ECDSAP384SHA384ENG_TIME_FIELDSENUMLOGFONTEXDVENUMRESLANGPROCEXPLICIT_ACCESSEmptyWorkingSetEnableScrollBarEngCreateBitmapEngEraseSurfaceEngFindResourceEngGradientFillEnumEnhMetaFileExcludeClipRectExtCreateRegionFailed to find Failed to load FindExecutableWFindNextStreamWFindNextVolumeWFindResourceExWFindVolumeCloseFlush dns cacheFlushIpNetTableFlushViewOfFileFreeAddrInfoExWGENERIC_MAPPINGGateway TimeoutGdiGradientFillGdiIsMetaFileDCGetActiveObjectGetActiveWindowGetAdapterIndexGetAdaptersInfoGetArcDirectionGetCharWidth32WGetClassInfoExWGetComboBoxInfoGetCommTimeoutsGetCommandLineWGetDCBrushColorGetDateFormatExGetDlgItemTextWGetEnhMetaFileWGetGraphicsModeGetGuiResourcesGetIpStatisticsGetKeyNameTextWGetKeyboardTypeGetLocaleInfoExGetMailslotInfoGetMenuItemRectGetMonitorInfoWGetNearestColorGetPolyFillModeGetProcessHeapsGetProcessTimesGetRawInputDataGetSecurityInfoGetStartupInfoWGetTapePositionGetTextMetricsWGetThemeIntListGetThemeMarginsGetThemeSysBoolGetThemeSysFontGetThemeSysSizeGetThreadLocaleGetTimeFormatExGetTitleBarInfoGetTrusteeFormWGetTrusteeNameWGetTrusteeTypeWGetWindowRgnBoxGlobalFindAtomWHanifi_RohingyaHasIPPacketInfoHost-Block-ListHost-Local-ListICreateTypeLib2IMEMENUITEMINFOIO_STATUS_BLOCKIP-Country-ListIP-Queue-LengthIP_ADAPTER_INFOIPersistStorageIShellItemArrayI_CryptAllocTlsI_RpcFreeBufferIcmp6CreateFileIcmpCloseHandleIcmpSendEcho2ExIdempotency-KeyImageList_MergeImageList_WriteImmIsUIMessageWImpersonateSelfInSendMessageExInitMUILanguageInsertMenuItemWIsBadStringPtrWIsHungAppWindowIsValidCodePageIsWindowEnabledIsWindowUnicodeIsWindowVisibleIsWow64Process2K32GetWsChangesKillSystemTimerLPCONDITIONPROCLPENUMFORMATETCLPFNDFMCALLBACKLPLOGCOLORSPACELPMESSAGEFILTERLPOLECLIENTSITELPPAGEPAINTHOOKLPPAGESETUPHOOKLPPRINTHOOKPROCLPSETUPHOOKPROCLPSHQUERYRBINFOLPWSAOVERLAPPEDLWBTBVCITWI2025Length RequiredLoadLibraryExA

memstr_16003103-2

Source: C:\Program Files (x86)\haxGhXjmBFM\app-3.8.0\LetsPRO.exe	Code function: 5_2_0040CA14 GetKeyState,GetKeyState,GetKeyState,GetKeyState,SendMessageW,		5_2_0040CA14
Source: C:\Program Files (x86)\haxGhXjmBFM\app-3.8.0\LetsPRO.exe	Code function: 10_2_0040CA14 GetKeyState,GetKeyState,GetKeyState,GetKeyState,SendMessageW,		10_2_0040CA14

Source: Yara match	File source: 55.2.LetsPRO.exe.68030000.24.unpack, type: UNPACKEDPE
Source: Yara match	File source: Process Memory Space: LetsPRO.exe PID: 8464, type: MEMORYSTR
Source: Yara match	File source: C:\Program Files (x86)\letsvpn\app-3.8.0\libwin.dll, type: DROPPED

Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	File created: C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\AEED7C5D2183A1352C6D421D65F131F0	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{7fc39624-296a-4042-b309-10cc640cfd85}\tap0901.cat (copy)	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\driver\tap0901.cat	Jump to dropped file
Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe	File created: C:\Users\user\AppData\Local\Temp\{99f02b5e-0c7c-d542-ad44-27ce9be55c97}\tap0901.cat (copy)	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{7fc39624-296a-4042-b309-10cc640cfd85}\SET98BE.tmp	Jump to dropped file
Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe	File created: C:\Users\user\AppData\Local\Temp\{99f02b5e-0c7c-d542-ad44-27ce9be55c97}\SET9776.tmp	Jump to dropped file

Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe

Process Stats: CPU usage > 49%

Source: C:\Program Files (x86)\Common Files\wegame.exe

Code function: 6_2_6C614908: __EH_prolog3_GS,memset,__snprintf_s,CreateFileA,memset,memset,DeviceIoControl,memset,memset,memset,isalnum,isalnum,GetLastError,FindCloseChangeNotification,

6_2_6C614908

Source: C:\Program Files (x86)\haxGhXjmBFM.exe

Code function: 8_2_0040338F EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,ExitProcess,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,

8_2_0040338F

Source: C:\Program Files (x86)\haxGhXjmBFM.exe

File created: C:\Program Files (x86)\letsvpn\driver\tap0901.sys

Jump to behavior

Source: C:\Windows\System32\drvinst.exe

File created: C:\Windows\System32\DriverStore\Temp\{7fc39624-296a-4042-b309-10cc640cfd85}

Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\61335c.msi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\inprogressinstallinfo.ipi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\SourceHash{5FD627E3-9BD5-491C-92C5-2934CD5F1E11}	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI3D01.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI3D02.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI3DDE.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI3E0E.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI3E8C.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI3EAC.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI3EDC.tmp	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\FileRepository\oemvista.inf_amd64_662fd96dfdced4ae
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\drvstore.tmp
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\inf\oem4.inf
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\drivers\SET9E3C.tmp
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\drivers\SET9E3C.tmp

Source: C:\Windows\System32\msiexec.exe

File deleted: C:\Windows\Installer\MSI3D02.tmp

Jump to behavior

Source: C:\Program Files (x86)\haxGhXjmBFM\LetsPRO.exe	Code function: 3_2_00BCB18B	3_2_00BCB18B
Source: C:\Program Files (x86)\haxGhXjmBFM\LetsPRO.exe	Code function: 3_2_00BD3929	3_2_00BD3929
Source: C:\Program Files (x86)\haxGhXjmBFM\LetsPRO.exe	Code function: 3_2_00BCA95F	3_2_00BCA95F
Source: C:\Program Files (x86)\haxGhXjmBFM\LetsPRO.exe	Code function: 3_2_00BC7B91	3_2_00BC7B91
Source: C:\Program Files (x86)\haxGhXjmBFM\LetsPRO.exe	Code function: 3_2_00BCAC09	3_2_00BCAC09
Source: C:\Program Files (x86)\haxGhXjmBFM\LetsPRO.exe	Code function: 3_2_00BCA5ED	3_2_00BCA5ED
Source: C:\Program Files (x86)\haxGhXjmBFM\LetsPRO.exe	Code function: 3_2_00BD2D55	3_2_00BD2D55
Source: C:\Program Files (x86)\haxGhXjmBFM\LetsPRO.exe	Code function: 3_2_00BCA540	3_2_00BCA540
Source: C:\Program Files (x86)\haxGhXjmBFM\LetsPRO.exe	Code function: 3_2_00BCAED0	3_2_00BCAED0
Source: C:\Program Files (x86)\haxGhXjmBFM\app-3.8.0\LetsPRO.exe	Code function: 5_2_004301D2	5_2_004301D2
Source: C:\Program Files (x86)\haxGhXjmBFM\app-3.8.0\LetsPRO.exe	Code function: 5_2_0040E1EC	5_2_0040E1EC
Source: C:\Program Files (x86)\haxGhXjmBFM\app-3.8.0\LetsPRO.exe	Code function: 5_2_004221AB	5_2_004221AB
Source: C:\Program Files (x86)\haxGhXjmBFM\app-3.8.0\LetsPRO.exe	Code function: 5_2_00431316	5_2_00431316
Source: C:\Program Files (x86)\haxGhXjmBFM\app-3.8.0\LetsPRO.exe	Code function: 5_2_0042931D	5_2_0042931D
Source: C:\Program Files (x86)\haxGhXjmBFM\app-3.8.0\LetsPRO.exe	Code function: 5_2_00433386	5_2_00433386
Source: C:\Program Files (x86)\haxGhXjmBFM\app-3.8.0\LetsPRO.exe	Code function: 5_2_00421590	5_2_00421590
Source: C:\Program Files (x86)\haxGhXjmBFM\app-3.8.0\LetsPRO.exe	Code function: 5_2_004225B7	5_2_004225B7
Source: C:\Program Files (x86)\haxGhXjmBFM\app-3.8.0\LetsPRO.exe	Code function: 5_2_00430714	5_2_00430714
Source: C:\Program Files (x86)\haxGhXjmBFM\app-3.8.0\LetsPRO.exe	Code function: 5_2_004257D2	5_2_004257D2
Source: C:\Program Files (x86)\haxGhXjmBFM\app-3.8.0\LetsPRO.exe	Code function: 5_2_00421904	5_2_00421904
Source: C:\Program Files (x86)\haxGhXjmBFM\app-3.8.0\LetsPRO.exe	Code function: 5_2_004229D7	5_2_004229D7
Source: C:\Program Files (x86)\haxGhXjmBFM\app-3.8.0\LetsPRO.exe	Code function: 5_2_00430C56	5_2_00430C56
Source: C:\Program Files (x86)\haxGhXjmBFM\app-3.8.0\LetsPRO.exe	Code function: 5_2_0042CC67	5_2_0042CC67
Source: C:\Program Files (x86)\haxGhXjmBFM\app-3.8.0\LetsPRO.exe	Code function: 5_2_00421DD7	5_2_00421DD7
Source: C:\Program Files (x86)\Common Files\wegame.exe	Code function: 6_2_00450039	6_2_00450039
Source: C:\Program Files (x86)\Common Files\wegame.exe	Code function: 6_2_004240D0	6_2_004240D0
Source: C:\Program Files (x86)\Common Files\wegame.exe	Code function: 6_2_00450262	6_2_00450262
Source: C:\Program Files (x86)\Common Files\wegame.exe	Code function: 6_2_00406380	6_2_00406380
Source: C:\Program Files (x86)\Common Files\wegame.exe	Code function: 6_2_0042E4A0	6_2_0042E4A0
Source: C:\Program Files (x86)\Common Files\wegame.exe	Code function: 6_2_0045050D	6_2_0045050D
Source: C:\Program Files (x86)\Common Files\wegame.exe	Code function: 6_2_00424510	6_2_00424510
Source: C:\Program Files (x86)\Common Files\wegame.exe	Code function: 6_2_0042E710	6_2_0042E710
Source: C:\Program Files (x86)\Common Files\wegame.exe	Code function: 6_2_00424730	6_2_00424730
Source: C:\Program Files (x86)\Common Files\wegame.exe	Code function: 6_2_0042C7C0	6_2_0042C7C0
Source: C:\Program Files (x86)\Common Files\wegame.exe	Code function: 6_2_004507CA	6_2_004507CA
Source: C:\Program Files (x86)\Common Files\wegame.exe	Code function: 6_2_0041E800	6_2_0041E800
Source: C:\Program Files (x86)\Common Files\wegame.exe	Code function: 6_2_004328E0	6_2_004328E0
Source: C:\Program Files (x86)\Common Files\wegame.exe	Code function: 6_2_004308F0	6_2_004308F0
Source: C:\Program Files (x86)\Common Files\wegame.exe	Code function: 6_2_0042E930	6_2_0042E930
Source: C:\Program Files (x86)\Common Files\wegame.exe	Code function: 6_2_00436A20	6_2_00436A20
Source: C:\Program Files (x86)\Common Files\wegame.exe	Code function: 6_2_00428B60	6_2_00428B60
Source: C:\Program Files (x86)\Common Files\wegame.exe	Code function: 6_2_00422BD0	6_2_00422BD0
Source: C:\Program Files (x86)\Common Files\wegame.exe	Code function: 6_2_00438DE0	6_2_00438DE0
Source: C:\Program Files (x86)\Common Files\wegame.exe	Code function: 6_2_00426FC0	6_2_00426FC0
Source: C:\Program Files (x86)\Common Files\wegame.exe	Code function: 6_2_00424FA0	6_2_00424FA0
Source: C:\Program Files (x86)\Common Files\wegame.exe	Code function: 6_2_00429288	6_2_00429288
Source: C:\Program Files (x86)\Common Files\wegame.exe	Code function: 6_2_00431370	6_2_00431370
Source: C:\Program Files (x86)\Common Files\wegame.exe	Code function: 6_2_004294D3	6_2_004294D3
Source: C:\Program Files (x86)\Common Files\wegame.exe	Code function: 6_2_004055C0	6_2_004055C0
Source: C:\Program Files (x86)\Common Files\wegame.exe	Code function: 6_2_00423690	6_2_00423690
Source: C:\Program Files (x86)\Common Files\wegame.exe	Code function: 6_2_004318A0	6_2_004318A0
Source: C:\Program Files (x86)\Common Files\wegame.exe	Code function: 6_2_00437A20	6_2_00437A20
Source: C:\Program Files (x86)\Common Files\wegame.exe	Code function: 6_2_00433A30	6_2_00433A30
Source: C:\Program Files (x86)\Common Files\wegame.exe	Code function: 6_2_00415CE0	6_2_00415CE0
Source: C:\Program Files (x86)\Common Files\wegame.exe	Code function: 6_2_00431D80	6_2_00431D80
Source: C:\Program Files (x86)\Common Files\wegame.exe	Code function: 6_2_00419E70	6_2_00419E70
Source: C:\Program Files (x86)\Common Files\wegame.exe	Code function: 6_2_0044FE01	6_2_0044FE01
Source: C:\Program Files (x86)\Common Files\wegame.exe	Code function: 6_2_6C52CC00	6_2_6C52CC00
Source: C:\Program Files (x86)\Common Files\wegame.exe	Code function: 6_2_6C501528	6_2_6C501528
Source: C:\Program Files (x86)\Common Files\wegame.exe	Code function: 6_2_6C501672	6_2_6C501672
Source: C:\Program Files (x86)\Common Files\wegame.exe	Code function: 6_2_6C5608E0	6_2_6C5608E0
Source: C:\Program Files (x86)\Common Files\wegame.exe	Code function: 6_2_6C52A4C0	6_2_6C52A4C0
Source: C:\Program Files (x86)\Common Files\wegame.exe	Code function: 6_2_6C556500	6_2_6C556500
Source: C:\Program Files (x86)\Common Files\wegame.exe	Code function: 6_2_6C51E600	6_2_6C51E600
Source: C:\Program Files (x86)\Common Files\wegame.exe	Code function: 6_2_6C556500	6_2_6C556500
Source: C:\Program Files (x86)\Common Files\wegame.exe	Code function: 6_2_6C501672	6_2_6C501672
Source: C:\Program Files (x86)\Common Files\wegame.exe	Code function: 6_2_6C501528	6_2_6C501528
Source: C:\Program Files (x86)\Common Files\wegame.exe	Code function: 6_2_6C556500	6_2_6C556500
Source: C:\Program Files (x86)\Common Files\wegame.exe	Code function: 6_2_6C50B1A0	6_2_6C50B1A0
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Code function: 8_2_00406B15	8_2_00406B15
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Code function: 8_2_004072EC	8_2_004072EC
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Code function: 8_2_00404C9E	8_2_00404C9E
Source: C:\Program Files (x86)\haxGhXjmBFM\app-3.8.0\LetsPRO.exe	Code function: 10_2_004301D2	10_2_004301D2
Source: C:\Program Files (x86)\haxGhXjmBFM\app-3.8.0\LetsPRO.exe	Code function: 10_2_0040E1EC	10_2_0040E1EC
Source: C:\Program Files (x86)\haxGhXjmBFM\app-3.8.0\LetsPRO.exe	Code function: 10_2_004221AB	10_2_004221AB
Source: C:\Program Files (x86)\haxGhXjmBFM\app-3.8.0\LetsPRO.exe	Code function: 10_2_00431316	10_2_00431316
Source: C:\Program Files (x86)\haxGhXjmBFM\app-3.8.0\LetsPRO.exe	Code function: 10_2_0042931D	10_2_0042931D
Source: C:\Program Files (x86)\haxGhXjmBFM\app-3.8.0\LetsPRO.exe	Code function: 10_2_00433386	10_2_00433386
Source: C:\Program Files (x86)\haxGhXjmBFM\app-3.8.0\LetsPRO.exe	Code function: 10_2_00421590	10_2_00421590
Source: C:\Program Files (x86)\haxGhXjmBFM\app-3.8.0\LetsPRO.exe	Code function: 10_2_004225B7	10_2_004225B7
Source: C:\Program Files (x86)\haxGhXjmBFM\app-3.8.0\LetsPRO.exe	Code function: 10_2_00430714	10_2_00430714
Source: C:\Program Files (x86)\haxGhXjmBFM\app-3.8.0\LetsPRO.exe	Code function: 10_2_004257D2	10_2_004257D2
Source: C:\Program Files (x86)\haxGhXjmBFM\app-3.8.0\LetsPRO.exe	Code function: 10_2_00421904	10_2_00421904
Source: C:\Program Files (x86)\haxGhXjmBFM\app-3.8.0\LetsPRO.exe	Code function: 10_2_004229D7	10_2_004229D7
Source: C:\Program Files (x86)\haxGhXjmBFM\app-3.8.0\LetsPRO.exe	Code function: 10_2_00430C56	10_2_00430C56
Source: C:\Program Files (x86)\haxGhXjmBFM\app-3.8.0\LetsPRO.exe	Code function: 10_2_0042CC67	10_2_0042CC67
Source: C:\Program Files (x86)\haxGhXjmBFM\app-3.8.0\LetsPRO.exe	Code function: 10_2_00421DD7	10_2_00421DD7
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 24_2_02E5B4B8	24_2_02E5B4B8
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 24_2_02E5B4A8	24_2_02E5B4A8
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 24_2_08843AA8	24_2_08843AA8

Source: Joe Sandbox View	Dropped File: C:\Program Files (x86)\Common Files\Lua51.dll 7FA367A644670ED94A01BC0927996D93B82EA2658BB7D84C99C648F12B6A61F1
Source: Joe Sandbox View	Dropped File: C:\Program Files (x86)\Common Files\adapt_for_imports.dll 96AEA19B11327AE4200396E84F06A4746A926F43B688C22E60B370DED1CF6D58
Source: Joe Sandbox View	Dropped File: C:\Program Files (x86)\Common Files\beacon_sdk.dll B5DF19432F50AD434CA860173C9EB0DC6FDFACA48F75A3B416D038C213D089DA
Source: Joe Sandbox View	Dropped File: C:\Program Files (x86)\Common Files\common.dll 2E21F70ADCBE5FE3D51EB9236FC23E071E675C802BFEEC2CA5C0A41EEF35E9A2

Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe

Process token adjusted: Load Driver

Source: C:\Windows\System32\svchost.exe

Process token adjusted: Security

Source: C:\Program Files (x86)\haxGhXjmBFM\LetsPRO.exe	Code function: String function: 00BC8C30 appears 40 times
Source: C:\Program Files (x86)\haxGhXjmBFM\app-3.8.0\LetsPRO.exe	Code function: String function: 00421528 appears 104 times
Source: C:\Program Files (x86)\haxGhXjmBFM\app-3.8.0\LetsPRO.exe	Code function: String function: 00421040 appears 78 times
Source: C:\Program Files (x86)\haxGhXjmBFM\app-3.8.0\LetsPRO.exe	Code function: String function: 0042100D appears 280 times
Source: C:\Program Files (x86)\haxGhXjmBFM\app-3.8.0\LetsPRO.exe	Code function: String function: 00425160 appears 46 times
Source: C:\Program Files (x86)\haxGhXjmBFM\app-3.8.0\LetsPRO.exe	Code function: String function: 0042047E appears 32 times
Source: C:\Program Files (x86)\haxGhXjmBFM\app-3.8.0\LetsPRO.exe	Code function: String function: 004046E0 appears 62 times
Source: C:\Program Files (x86)\haxGhXjmBFM\app-3.8.0\LetsPRO.exe	Code function: String function: 004104B8 appears 54 times
Source: C:\Program Files (x86)\Common Files\wegame.exe	Code function: String function: 00420F10 appears 62 times
Source: C:\Program Files (x86)\Common Files\wegame.exe	Code function: String function: 00467B2C appears 38 times
Source: C:\Program Files (x86)\Common Files\wegame.exe	Code function: String function: 00467AC1 appears 288 times
Source: C:\Program Files (x86)\Common Files\wegame.exe	Code function: String function: 00467A6B appears 66 times
Source: C:\Program Files (x86)\Common Files\wegame.exe	Code function: String function: 004137A0 appears 127 times
Source: C:\Program Files (x86)\Common Files\wegame.exe	Code function: String function: 00467AF5 appears 135 times
Source: C:\Program Files (x86)\Common Files\wegame.exe	Code function: String function: 0043F2BB appears 107 times
Source: C:\Program Files (x86)\Common Files\wegame.exe	Code function: String function: 6C6ABF6F appears 48 times

Source: lets-test.msi	Binary or memory string: OriginalFilenameuserAccounts.dllF vs lets-test.msi
Source: lets-test.msi	Binary or memory string: OriginalFilenameaischeduler.dllF vs lets-test.msi
Source: lets-test.msi	Binary or memory string: OriginalFilenameShortcutFlags.dllF vs lets-test.msi

Source: Utils.dll.8.dr, EncryptionHelper.cs

Base64 encoded string: 'MmnG6VOR+WnZS9H1nUImgh51Osbv1HNbg0tmihNKIe56P70uL5Qpu7Pg5BRk5AHEN7JjJBMMg3K+zTtV1yr5Z4OUpvRNri102lHcvY0xDlrDpER1nsJylqsBoy24674eg5Pyf3n55VkkXWX2Plb+wrLs7sPC+KmgyOhFif4ZESQXqTS/q+Cy+EtUFZRYqDg3wLkTAIUg1Y7TO+me6hpjVKfavGaVZK1R87D+dwnC6O2GqA12ZUWUCoJF+py6stRs8RpFoxKdoMxM4mXOakl31jpmLW9rBvYUNccWVwfNyGADglRdMjx+Knx+Ab4Ca/RMsF15MI+IIUAV0kbgkZTtN6VeLZELo1C99hV/Ot4T1yJwAA4zU9fkRdwuv86e2+f4n8Ibntyh6By9eV3rJQ5FOZE+Wu+N1Yjkhn0JuoRSNmlY4o+qMvv//2zJm0rK3xXL7L9T6zz/CXllU+qIEXFd67uS1taBykurfdYqbNy1BXZwSqPLpWUQt1Icr3fwdORhEvVZi3TX5PkUtYY2omHSmrFDIX5IRDpvcNSgNyGBjeeXXtOgxSXviM5dkg+010rGN1m7sU5zEgGH8h5f+iLJTyk7ZYE6NeZUnz6ueYCm2tfkXABcJGcizm9NR4WFXgUyVhmShAKnl/ibHfEI8IykY6PDIZbRv3AdfG8tZnqZeb8NYKFOzumRpA8MmmIFMvImu/JWb/SP0WbUZWg3Lt39f1EUnTe2+6HgXCXMCf39SoSNiuSWVDux7rte2dtYRwNssXKSMtXbSw12nG08+UE+k428PU/ZA7d/r+InLoUCZlprYMzd3lqJOLwnpGAJI+0KeAlyg86ZXGP2GukkIGjG8idjKBWpvqL/euEHNNfBIqpIdAjuQAKXsmeRq7fc2sC+ntLiUtuG0iu4Pr5THZBcNX9g+iSxZNCrZ1ShbcFzZ0tej74Xk64QWcLkjH9xQ5v6k/I02zDp+4XpQ6/iFL87Bh9jJD7ZtbMV3cWL3I5xQULhfw/475Ip0jnBfXY+JArydLESbTrWhGcNo1BYO5SRy+FPuP6IH1knm0v4VZlacAELHL6IzUfmjtagkFs3hGDkzYGKEJ6xFGmgRjhmUcWfLCp7Xwkl0IM5FJw21IfQpQojn8S5Lj2KPQkE1WkNkhJx/j3fLMLgbNfrfjeo9pWPFQo6byGz+K+PJ+Cwo0ZbttwUYL2GucrayJxqPShrxKLFb9v3iCWLIYMVcfgA7LpXdS+6lmOUZxrepO0jSugA5fQv8kHvvwkA0DQwU85yViJVK94hBaY75RKqwiI4Tfsqu5pFoq0Z6uCwJ5gfpbG/hF8wqoj0ybbFt1b+QQdS8cEjZtnS/LyLvl35oLIF4q2J/oda0ESYRsx8wA7UGAK8KKDGyOihfXywxgE4CU3ko1PNy9A6KZBaYzertv3uHeBJH2JC9H1qErVSG8dIk3BbAVtIsJ+OMEbbS+mSuMa42Fl5hLjwbB4V7K2iWEp+w+JZ+1NTCJxXqZze/YLwg/UPb/HJyqAqKkFku8ctNUPqsVtu2FjqDSEezp5stKsqsjyfdBAouLetvlrlp5lMOyd12Yi4VTlu/8AXRFbWCFf73feCj8NULfc0vqfjSfZ0HoirsvomNYn5GABtU75DiKOZgptCEYzfPnmcx6M6F2DgYB4ITTP2XV8+ousV7sEOSw18Gd40lSQmi25bmKUAnKIINhyki0IX/76e6LdYfvWWJTGzFOiZ+KuufFS0vTZEQnVnEpXviz+DqyQzKxiWVAId8mdXOZv4rmDXjeEEOkqLe/ZoIT8udAy+xRdhHXyTpnDj9VoU4oVIkwGg/scKxIrRn7FzcVEk6o7V4cmgGcOwmf42JYy92F+xZu0Ro4Fx4aMpR63P/UADAfidp59dPBJBJrEtVeBkVqposXpKcFYPHKHdyq6FRzAd2aM8RzmVaWiIadl4YDXNN7IiAAMv+G0MqmgBwKHWdhqac2eLRn+giLEwJgiqSUpeedeXobdqZOF6uoJ2jTmxgzBgyVqvGXkKKex5ZnskC9P7EQXhHEGZ5L0KhXgtHxPIZ4coRlfaepVbIq12quYqN3Y3WgfCrmZ4BAQf2h3TMgwUSYCHrHlAPapjT+NLeoJYvaxlY3Z8aB6G3JCcQ4fCeVo0c0mw+wDFOnfaxr26DsReIde+o7I6nOyqag1Reg13GlDzshLN35WmPHDwc2XDUD+vaNQBYBg0ED99UPxjaptvHdgxABfLVNieAxL7UBc327uKcl+n4fs69fwdsQGWIw7d2vSpKjFyalG/1EDHvq1Cgh5LmAAiyyTnBTa76nzQrIK+37hTO+vRBKdsgkdnET+DPNNRv5aR1RWJABSBJV3kV23SxxMjMmqIIr2DxgROOmspYZZ4AK9o8cT7tJBaHWvan0aplwcb/ALoWFBLDweGa0Dc+JXFHhwd4nKy8mRdC7IKZJzUlfEukKXvmEB19fWKvfOfHQkxQEwSss9LO+QQ3BKdjGjrKFDsKIpfUotoSH85KG9+pndOXxD7xDbNsPajtxFMXZxydh7xIK91+P7ekRN7gjMUIoDSs3jhOtpqG5+yYxTgT7PwCU1RCTqD9mG2rIioUsS1+Oz8OYHJvuYvBFzQftJDSkeaP1Ib2kHlFEP5ZLnLbiPAVKyW3RqoMPqXDFpkRl8qyo6YGigP2h5AP3EyxAZ3olZuqIjNKb1aKngO0rADdgNg2X5bTej3eD5w/+5S77oPj2mXnIZAseCrhysxuZTaY4HR3jWLMud8aGpMIREdjIUcRo/Jlpoch5RpLLjxQAOKhLm0zuq75naOqzDyphDiXEbvavcEFHuLHFjfUFjfkFoZuWG2sttUMeOJ+NnL7JaoSSe/WFI4S4s+OIpe2yJoWCJZX4O3n2kHoapNgQz8eEcZyPvx6WCuo55UYfUa6nbOGtCyUm8027mv/8w2QrZAFxJPhf1+I10kFp6MoO1ho/RAVvEv3j1gQXDgvsGxEpkN0TWtzHCOmai74md

Source: classification engine

Classification label: mal84.troj.spyw.evad.winMSI@118/595@27/19

Source: C:\Program Files (x86)\Common Files\wegame.exe

Code function: 6_2_6C524640 GetLastError,FormatMessageA,

6_2_6C524640

Source: C:\Program Files (x86)\haxGhXjmBFM.exe

8_2_0040338F

Source: C:\Program Files (x86)\haxGhXjmBFM.exe

Code function: 8_2_00404722 GetDlgItem,SetWindowTextW,SHAutoComplete,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceExW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW,

8_2_00404722

Source: C:\Program Files (x86)\Common Files\wegame.exe

Code function: 6_2_00456E02 __EH_prolog3_GS,CreateToolhelp32Snapshot,Process32First,memset,CloseHandle,OpenProcess,GetModuleFileNameExW,K32GetModuleFileNameExW,SimpleUString::operator=,memset,_wsplitpath_s,SimpleUString::operator=,FindCloseChangeNotification,Process32Next,FindCloseChangeNotification,

6_2_00456E02

Source: C:\Program Files (x86)\haxGhXjmBFM.exe

Code function: 8_2_00402104 CoCreateInstance,

8_2_00402104

Source: C:\Program Files (x86)\haxGhXjmBFM\app-3.8.0\LetsPRO.exe

Code function: 5_2_0040F158 FindResourceW,LoadResource,LockResource,FreeResource,

5_2_0040F158

Source: C:\Windows\System32\msiexec.exe

File created: C:\Program Files (x86)\1etsvpn

Jump to behavior

Source: C:\Windows\System32\msiexec.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\CML3E68.tmp

Jump to behavior

Source: C:\Windows\System32\drvinst.exe	Mutant created: \BaseNamedObjects\DrvInst.exe_mutex_{5B10AC83-4F13-4fde-8C0B-B85681BA8D73}
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7980:120:WilError_03
Source: C:\Program Files (x86)\Common Files\wegame.exe	Mutant created: \Sessions\1\BaseNamedObjects\_TGP_EXISTS_MUTEX_NAME_
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Mutant created: \Sessions\1\BaseNamedObjects\C__Program Files (x86)_letsvpn_app-3.8.0_Log_
Source: C:\Program Files (x86)\Common Files\wegame.exe	Mutant created: \Sessions\1\BaseNamedObjects\WeGameCN_Mutex
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8748:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5852:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1188:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8364:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7808:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8612:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8092:120:WilError_03
Source: C:\Program Files (x86)\Common Files\wegame.exe	Mutant created: \Sessions\1\BaseNamedObjects\446e43c4-a90f-56a2-a09d-e5123a135e92
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:9100:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4092:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8892:120:WilError_03

Source: C:\Windows\System32\msiexec.exe

File created: C:\Windows\TEMP\~DF76C1447C2DDEB1A0.TMP

Jump to behavior

Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select ProcessorID From Win32_processor
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select ProcessorId From Win32_Processor
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select Manufacturer From Win32_Processor
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Processor
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select ProcessorID From Win32_processor
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select Manufacturer From Win32_Processor
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select ProcessorId From Win32_Processor

Source: C:\Program Files (x86)\haxGhXjmBFM.exe

File read: C:\Program Files (x86)\desktop.ini

Jump to behavior

Source: C:\Program Files (x86)\haxGhXjmBFM\LetsPRO.exe

Key opened: HKEY_USERSS-1-5-18\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: wegame.exe, 00000006.00000002.4143954280.000000006CECB000.00000002.00000001.01000000.0000000C.sdmp, LetsPRO.exe, 00000037.00000002.4256167829.0000000067067000.00000002.00000001.01000000.00000031.sdmp	Binary or memory string: UPDATE %Q.%s SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: wegame.exe, 00000006.00000002.4143954280.000000006CECB000.00000002.00000001.01000000.0000000C.sdmp, LetsPRO.exe, 00000037.00000002.4256167829.0000000067067000.00000002.00000001.01000000.00000031.sdmp	Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: LetsPRO.exe, 00000037.00000002.4180752320.00000000309C3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Select MACAddress From Win32_NetworkAdapter WHERE ((MACAddress Is Not NULL) AND (Manufacturer <> 'Microsoft'));5
Source: LetsPRO.exe, 00000037.00000002.4256167829.0000000067067000.00000002.00000001.01000000.00000031.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: LetsPRO.exe, 00000037.00000002.4256167829.0000000067067000.00000002.00000001.01000000.00000031.sdmp	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: LetsPRO.exe, 00000037.00000002.4256167829.0000000067067000.00000002.00000001.01000000.00000031.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: LetsPRO.exe, 00000037.00000002.4256167829.0000000067067000.00000002.00000001.01000000.00000031.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: LetsPRO.exe, 00000037.00000002.4256167829.0000000067067000.00000002.00000001.01000000.00000031.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);

Source: wegame.exe	String found in binary or memory: -launcher=
Source: wegame.exe	String found in binary or memory: -launcher

Source: unknown	Process created: C:\Windows\System32\msiexec.exe "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\lets-test.msi"
Source: unknown	Process created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding A5D05F387DF25EBE7AE8DA514E37EF3C
Source: unknown	Process created: C:\Program Files (x86)\haxGhXjmBFM\LetsPRO.exe "C:\Program Files (x86)\haxGhXjmBFM\LetsPRO.exe"
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
Source: C:\Program Files (x86)\haxGhXjmBFM\LetsPRO.exe	Process created: C:\Program Files (x86)\haxGhXjmBFM\app-3.8.0\LetsPRO.exe "C:\Program Files (x86)\haxGhXjmBFM\app-3.8.0\LetsPRO.exe"
Source: unknown	Process created: C:\Program Files (x86)\Common Files\wegame.exe "C:\Program Files (x86)\Common Files\wegame.exe"
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Program Files (x86)\haxGhXjmBFM\LetsPRO.exe "C:\Program Files (x86)\haxGhXjmBFM\LetsPRO.exe"
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Program Files (x86)\haxGhXjmBFM.exe "C:\Program Files (x86)\haxGhXjmBFM.exe"
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Program Files (x86)\haxGhXjmBFM\LetsPRO.exe "C:\Program Files (x86)\haxGhXjmBFM\LetsPRO.exe"
Source: C:\Program Files (x86)\haxGhXjmBFM\LetsPRO.exe	Process created: C:\Program Files (x86)\haxGhXjmBFM\app-3.8.0\LetsPRO.exe "C:\Program Files (x86)\haxGhXjmBFM\app-3.8.0\LetsPRO.exe"
Source: C:\Program Files (x86)\haxGhXjmBFM\LetsPRO.exe	Process created: C:\Program Files (x86)\haxGhXjmBFM\app-3.8.0\LetsPRO.exe "C:\Program Files (x86)\haxGhXjmBFM\app-3.8.0\LetsPRO.exe"
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe -inputformat none -ExecutionPolicy Bypass -Command "If ($env:PROCESSOR_ARCHITEW6432) { $env:PROCESSOR_ARCHITEW6432 } Else { $env:PROCESSOR_ARCHITECTURE }"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2116 --field-trial-handle=1900,i,16840921317244570798,13407743960639991352,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2076 --field-trial-handle=2052,i,15600672359767385931,12955159692457146143,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=4204 --field-trial-handle=2052,i,15600672359767385931,12955159692457146143,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=5976 --field-trial-handle=2052,i,15600672359767385931,12955159692457146143,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=5976 --field-trial-handle=2052,i,15600672359767385931,12955159692457146143,262144 /prefetch:8
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -inputformat none -ExecutionPolicy Bypass -File "C:\Program Files (x86)\letsvpn\AddWindowsSecurityExclusion.ps1"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Process created: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe "C:\Program Files (x86)\letsvpn\driver\tapinstall.exe" findall tap0901
Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Process created: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe "C:\Program Files (x86)\letsvpn\driver\tapinstall.exe" install "C:\Program Files (x86)\letsvpn\driver\OemVista.inf" tap0901
Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\drvinst.exe DrvInst.exe "4" "0" "C:\Users\user\AppData\Local\Temp\{99f02b5e-0c7c-d542-ad44-27ce9be55c97}\oemvista.inf" "9" "4d14a44ff" "0000000000000158" "WinSta0\Default" "0000000000000164" "208" "c:\program files (x86)\letsvpn\driver"
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\drvinst.exe DrvInst.exe "2" "211" "ROOT\NET\0000" "C:\Windows\INF\oem4.inf" "oem4.inf:3beb73aff103cc24:tap0901.ndi:9.24.6.601:tap0901," "4d14a44ff" "0000000000000158"
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s NetSetupSvc
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c netsh advfirewall firewall Delete rule name=lets
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall Delete rule name=lets
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c netsh advfirewall firewall Delete rule name=lets.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall Delete rule name=lets.exe
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c netsh advfirewall firewall Delete rule name=LetsPRO.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall Delete rule name=LetsPRO.exe
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c netsh advfirewall firewall Delete rule name=LetsPRO
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall Delete rule name=LetsPRO
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Process created: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe "C:\Program Files (x86)\letsvpn\driver\tapinstall.exe" findall tap0901
Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2128 --field-trial-handle=2084,i,12025234242823261480,2093702470493136090,262144 /prefetch:3
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Process created: C:\Program Files (x86)\letsvpn\LetsPRO.exe "C:\Program Files (x86)\letsvpn\LetsPRO.exe"
Source: C:\Program Files (x86)\letsvpn\LetsPRO.exe	Process created: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe "C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe"
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s Netman
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s NetSetupSvc
Source: unknown	Process created: C:\Windows\System32\wbem\WmiApSrv.exe C:\Windows\system32\wbem\WmiApSrv.exe
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C ipconfig /all
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /all
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C route print
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding A5D05F387DF25EBE7AE8DA514E37EF3C	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Program Files (x86)\haxGhXjmBFM\LetsPRO.exe "C:\Program Files (x86)\haxGhXjmBFM\LetsPRO.exe"	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Program Files (x86)\haxGhXjmBFM.exe "C:\Program Files (x86)\haxGhXjmBFM.exe"	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Program Files (x86)\haxGhXjmBFM\LetsPRO.exe "C:\Program Files (x86)\haxGhXjmBFM\LetsPRO.exe"	Jump to behavior
Source: C:\Program Files (x86)\haxGhXjmBFM\LetsPRO.exe	Process created: C:\Program Files (x86)\haxGhXjmBFM\app-3.8.0\LetsPRO.exe "C:\Program Files (x86)\haxGhXjmBFM\app-3.8.0\LetsPRO.exe"	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2116 --field-trial-handle=1900,i,16840921317244570798,13407743960639991352,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\haxGhXjmBFM\LetsPRO.exe	Process created: C:\Program Files (x86)\haxGhXjmBFM\app-3.8.0\LetsPRO.exe "C:\Program Files (x86)\haxGhXjmBFM\app-3.8.0\LetsPRO.exe"	Jump to behavior
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe -inputformat none -ExecutionPolicy Bypass -Command "If ($env:PROCESSOR_ARCHITEW6432) { $env:PROCESSOR_ARCHITEW6432 } Else { $env:PROCESSOR_ARCHITECTURE }"	Jump to behavior
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -inputformat none -ExecutionPolicy Bypass -File "C:\Program Files (x86)\letsvpn\AddWindowsSecurityExclusion.ps1"	Jump to behavior
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Process created: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe "C:\Program Files (x86)\letsvpn\driver\tapinstall.exe" findall tap0901	Jump to behavior
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Process created: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe "C:\Program Files (x86)\letsvpn\driver\tapinstall.exe" install "C:\Program Files (x86)\letsvpn\driver\OemVista.inf" tap0901	Jump to behavior
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c netsh advfirewall firewall Delete rule name=lets	Jump to behavior
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c netsh advfirewall firewall Delete rule name=lets.exe	Jump to behavior
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c netsh advfirewall firewall Delete rule name=LetsPRO.exe	Jump to behavior
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c netsh advfirewall firewall Delete rule name=LetsPRO	Jump to behavior
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Process created: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe "C:\Program Files (x86)\letsvpn\driver\tapinstall.exe" findall tap0901	Jump to behavior
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Process created: C:\Program Files (x86)\letsvpn\LetsPRO.exe "C:\Program Files (x86)\letsvpn\LetsPRO.exe"	Jump to behavior
Source: C:\Program Files (x86)\haxGhXjmBFM\LetsPRO.exe	Process created: C:\Program Files (x86)\haxGhXjmBFM\app-3.8.0\LetsPRO.exe "C:\Program Files (x86)\haxGhXjmBFM\app-3.8.0\LetsPRO.exe"	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2076 --field-trial-handle=2052,i,15600672359767385931,12955159692457146143,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=4204 --field-trial-handle=2052,i,15600672359767385931,12955159692457146143,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=5976 --field-trial-handle=2052,i,15600672359767385931,12955159692457146143,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=5976 --field-trial-handle=2052,i,15600672359767385931,12955159692457146143,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\drvinst.exe DrvInst.exe "4" "0" "C:\Users\user\AppData\Local\Temp\{99f02b5e-0c7c-d542-ad44-27ce9be55c97}\oemvista.inf" "9" "4d14a44ff" "0000000000000158" "WinSta0\Default" "0000000000000164" "208" "c:\program files (x86)\letsvpn\driver"
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\drvinst.exe DrvInst.exe "2" "211" "ROOT\NET\0000" "C:\Windows\INF\oem4.inf" "oem4.inf:3beb73aff103cc24:tap0901.ndi:9.24.6.601:tap0901," "4d14a44ff" "0000000000000158"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall Delete rule name=lets
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall Delete rule name=lets.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall Delete rule name=LetsPRO.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall Delete rule name=LetsPRO
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2128 --field-trial-handle=2084,i,12025234242823261480,2093702470493136090,262144 /prefetch:3
Source: C:\Program Files (x86)\letsvpn\LetsPRO.exe	Process created: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe "C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe"
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C ipconfig /all
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C route print
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /all
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown

Source: C:\Windows\System32\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: srpapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: tsappcmp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: tsappcmp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: srclient.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: spp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Program Files (x86)\haxGhXjmBFM\LetsPRO.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Program Files (x86)\haxGhXjmBFM\LetsPRO.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files (x86)\haxGhXjmBFM\app-3.8.0\LetsPRO.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Program Files (x86)\haxGhXjmBFM\app-3.8.0\LetsPRO.exe	Section loaded: oledlg.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\wegame.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\wegame.exe	Section loaded: adapt_for_imports.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\wegame.exe	Section loaded: lua51.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\wegame.exe	Section loaded: common.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\wegame.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\wegame.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\wegame.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\wegame.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\wegame.exe	Section loaded: beacon_sdk.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\wegame.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\wegame.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\wegame.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\wegame.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\wegame.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\wegame.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\wegame.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\wegame.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\wegame.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\wegame.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\wegame.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\wegame.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\wegame.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\wegame.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\wegame.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\wegame.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\wegame.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\wegame.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\wegame.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\wegame.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\wegame.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\wegame.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\wegame.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\wegame.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\wegame.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\wegame.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\wegame.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\wegame.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Program Files (x86)\haxGhXjmBFM\LetsPRO.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Program Files (x86)\haxGhXjmBFM\LetsPRO.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files (x86)\haxGhXjmBFM\app-3.8.0\LetsPRO.exe	Section loaded: oledlg.dll	Jump to behavior
Source: C:\Program Files (x86)\haxGhXjmBFM\app-3.8.0\LetsPRO.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Program Files (x86)\haxGhXjmBFM\app-3.8.0\LetsPRO.exe	Section loaded: oledlg.dll	Jump to behavior
Source: C:\Program Files (x86)\haxGhXjmBFM\app-3.8.0\LetsPRO.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe	Section loaded: apphelp.dll
Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe	Section loaded: devobj.dll
Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe	Section loaded: msasn1.dll
Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe	Section loaded: devrtl.dll
Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe	Section loaded: spinf.dll
Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe	Section loaded: drvstore.dll
Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe	Section loaded: devobj.dll
Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe	Section loaded: newdev.dll
Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe	Section loaded: msasn1.dll
Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe	Section loaded: cryptsp.dll
Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe	Section loaded: rsaenh.dll
Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe	Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe	Section loaded: gpapi.dll
Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe	Section loaded: cabinet.dll
Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: umpnpmgr.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: devrtl.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: devrtl.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: drvstore.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: cabinet.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: devrtl.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: drvstore.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: devobj.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: cabinet.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netsetupsvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netsetupapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netsetupengine.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: implatsetup.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: devrtl.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: spinf.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: drvstore.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ifmon.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mprapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasmontr.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasapi32.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasman.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mfc42u.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasman.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: authfwcfg.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwpolicyiomgr.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: firewallapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dnsapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwbase.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpcmonitor.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dot3cfg.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dot3api.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: onex.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: eappcfg.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ncrypt.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: eappprxy.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ntasn1.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwcfg.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: hnetmon.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netshell.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nlaapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netsetupapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netiohlp.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winnsi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshhttp.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: httpapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshipsec.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: activeds.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: polstore.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winipsec.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: adsldpc.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: adsldpc.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshwfp.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cabinet.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: p2pnetsh.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: p2p.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rpcnsh.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: whhelper.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winhttp.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wlancfg.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wlanapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wshelper.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wevtapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mswsock.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: peerdistsh.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wcmapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rmclient.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mobilenetworking.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: slc.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: sppc.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ktmw32.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mprmsg.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ifmon.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mprapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasmontr.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasapi32.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasman.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mfc42u.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasman.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: authfwcfg.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwpolicyiomgr.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: firewallapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dnsapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwbase.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpcmonitor.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dot3cfg.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dot3api.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: onex.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: eappcfg.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ncrypt.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: eappprxy.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ntasn1.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwcfg.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: hnetmon.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netshell.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nlaapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netsetupapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netiohlp.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winnsi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshhttp.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: httpapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshipsec.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: activeds.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: polstore.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winipsec.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: adsldpc.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: adsldpc.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshwfp.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cabinet.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: p2pnetsh.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: p2p.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rpcnsh.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: whhelper.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winhttp.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wlancfg.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wlanapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wshelper.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wevtapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mswsock.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: peerdistsh.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wcmapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rmclient.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mobilenetworking.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: slc.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: sppc.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ktmw32.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mprmsg.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ifmon.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mprapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasmontr.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasapi32.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasman.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mfc42u.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasman.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: authfwcfg.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwpolicyiomgr.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: firewallapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dnsapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwbase.dll

Source: C:\Program Files (x86)\haxGhXjmBFM.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Automated click: Next >
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Automated click: Install

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: lets-test.msi

Static file information: File size 52425728 > 1048576

Source:	Binary string: D:\a\1\s\Utils\obj\Release\Utils.pdb source: LetsPRO.exe, 00000037.00000002.4143079506.00000000032F2000.00000002.00000001.01000000.0000001A.sdmp
Source:	Binary string: D:\git\wegame_paas\beacon_report_cpp\beacon_sdk\Release\beacon_sdk.pdb source: wegame.exe, 00000006.00000002.4143954280.000000006CECB000.00000002.00000001.01000000.0000000C.sdmp
Source:	Binary string: E:\A\_work\1795\s\corefx\bin\obj\Windows_NT.AnyCPU.Release\System.Runtime.InteropServices.RuntimeInformation\net462\System.Runtime.InteropServices.RuntimeInformation.pdb source: LetsPRO.exe, 00000037.00000002.4168244500.00000000067E2000.00000002.00000001.01000000.0000001F.sdmp
Source:	Binary string: D:\a\1\s\LetsVPN\obj\Release\LetsPRO.pdb source: LetsPRO.exe, 00000037.00000000.2030391391.0000000000E62000.00000002.00000001.01000000.00000018.sdmp
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\userAccounts.pdb source: lets-test.msi
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\ShortcutFlags.pdb source: lets-test.msi
Source:	Binary string: E:\dailybuild_fix_5.4\wegame_client\build\bin\Release\wegame.pdbmm1GCTL source: wegame.exe, 00000006.00000002.4137406249.0000000000476000.00000002.00000001.01000000.00000004.sdmp, wegame.exe, 00000006.00000000.1716127775.0000000000476000.00000002.00000001.01000000.00000004.sdmp
Source:	Binary string: lp)rlkeyfuncencryptionPBE2PARAMkeylengthprfPBKDF2PARAMcrypto\asn1\p5_pbev2.ccrypto\evp\p5_crpt2.cassertion failed: keylen <= sizeof(key)crypto\hmac\hmac.ccrypto\pkcs12\p12_key.cxn--compiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 /WX -DL_ENDIAN -DOPENSSL_PIC -D_WIN32_WINNT=0x0501 source: wegame.exe, 00000006.00000002.4142318714.000000006C825000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: c:\git\OSS\notifyicon-wpf\Hardcodet.NotifyIcon.Wpf\Source\NotifyIconWpf\obj\Release\Hardcodet.Wpf.TaskbarNotification.pdb source: LetsPRO.exe, 00000037.00000002.4201314539.0000000037A82000.00000002.00000001.01000000.00000033.sdmp
Source:	Binary string: C:\Users\eric\dev\cb\bld\bin\e_sqlite3\win\v141\plain\x86\e_sqlite3.pdb source: LetsPRO.exe, 00000037.00000002.4256167829.0000000067067000.00000002.00000001.01000000.00000031.sdmp
Source:	Binary string: c:\users\samuli\opt\tap-windows6-mattock\tapinstall\7600\objfre_wlh_amd64\amd64\tapinstall.pdb source: tapinstall.exe, 0000001E.00000002.1912221093.00007FF7BEED1000.00000020.00000001.01000000.00000016.sdmp, tapinstall.exe, 0000001E.00000000.1910661790.00007FF7BEED1000.00000020.00000001.01000000.00000016.sdmp, tapinstall.exe, 00000020.00000000.1913117233.00007FF7BEED1000.00000020.00000001.01000000.00000016.sdmp, tapinstall.exe, 00000020.00000002.1953276492.00007FF7BEED1000.00000020.00000001.01000000.00000016.sdmp, tapinstall.exe, 00000032.00000002.1972779400.00007FF7BEED1000.00000020.00000001.01000000.00000016.sdmp, tapinstall.exe, 00000032.00000000.1970876937.00007FF7BEED1000.00000020.00000001.01000000.00000016.sdmp
Source:	Binary string: D:\a\1\s\SDK\AppCenterAnalytics\Microsoft.AppCenter.Analytics.WindowsDesktop\obj\Release\net461\Microsoft.AppCenter.Analytics.pdbSHA256 source: LetsPRO.exe, 00000037.00000002.4178693283.00000000300B2000.00000002.00000001.01000000.00000026.sdmp
Source:	Binary string: C:\WorkShop\WebSocket4Net\WebSocket4Net\obj\Release\WebSocket4Net.pdb source: LetsPRO.exe, 00000037.00000002.4214834576.00000000387E2000.00000002.00000001.01000000.00000038.sdmp
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\aischeduler2.pdb@ source: lets-test.msi
Source:	Binary string: /_/CommunityToolkit.Mvvm/obj/Release/netstandard2.0/CommunityToolkit.Mvvm.pdbSHA256 source: LetsPRO.exe, 00000037.00000002.4167809675.0000000006742000.00000002.00000001.01000000.0000001E.sdmp
Source:	Binary string: D:\a\1\s\SDK\AppCenter\Microsoft.AppCenter.WindowsDesktop\obj\Release\net461\Microsoft.AppCenter.pdb source: LetsPRO.exe, 00000037.00000002.4187562856.0000000034AB5000.00000004.00000020.00020000.00000000.sdmp, LetsPRO.exe, 00000037.00000002.4179081431.0000000030452000.00000002.00000001.01000000.00000027.sdmp
Source:	Binary string: C:\Users\eric\dev\SQLitePCL.raw\src\SQLitePCLRaw.batteries_v2.e_sqlite3.dynamic\obj\Release\netstandard2.0\SQLitePCLRaw.batteries_v2.pdb source: LetsPRO.exe, 00000037.00000002.4187448131.00000000317A2000.00000002.00000001.01000000.0000002D.sdmp
Source:	Binary string: E:\A\_work\1795\s\corefx\bin\obj\Windows_NT.AnyCPU.Release\System.Net.Http\netfx\System.Net.Http.pdb source: LetsPRO.exe, 00000037.00000002.4224367182.00000000392B2000.00000002.00000001.01000000.0000003D.sdmp
Source:	Binary string: /_/CommunityToolkit.Mvvm/obj/Release/netstandard2.0/CommunityToolkit.Mvvm.pdb source: LetsPRO.exe, 00000037.00000002.4167809675.0000000006742000.00000002.00000001.01000000.0000001E.sdmp
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\userAccounts.pdbQ source: lets-test.msi
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\aischeduler2.pdb source: lets-test.msi
Source:	Binary string: Extract: Mono.Cecil.Pdb.dll... 100% source: haxGhXjmBFM.exe, 00000008.00000003.2031982869.0000000000751000.00000004.00000020.00020000.00000000.sdmp, haxGhXjmBFM.exe, 00000008.00000002.2033229713.0000000000751000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\eric\dev\SQLitePCL.raw\src\SQLitePCLRaw.batteries_v2.e_sqlite3.dynamic\obj\Release\netstandard2.0\SQLitePCLRaw.batteries_v2.pdbSHA256 source: LetsPRO.exe, 00000037.00000002.4187448131.00000000317A2000.00000002.00000001.01000000.0000002D.sdmp
Source:	Binary string: D:\a\1\s\SDK\AppCenterCrashes\Microsoft.AppCenter.Crashes.WindowsDesktop\obj\Release\net461\Microsoft.AppCenter.Crashes.pdb source: LetsPRO.exe, 00000037.00000002.4178819054.00000000300C2000.00000002.00000001.01000000.00000028.sdmp
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\ShortcutFlags.pdbE source: lets-test.msi
Source:	Binary string: D:\a\1\s\LetsVPNDomainModel\obj\Release\LetsVPNDomainModel.pdb source: LetsPRO.exe, 00000037.00000002.4162624461.00000000059D2000.00000002.00000001.01000000.0000001C.sdmp
Source:	Binary string: D:\a\1\s\LetsVPNDomainModel\obj\Release\LetsVPNDomainModel.pdbwD source: LetsPRO.exe, 00000037.00000002.4162624461.00000000059D2000.00000002.00000001.01000000.0000001C.sdmp
Source:	Binary string: e:\newclientmail\trunk\code\errorreport\release\ErrorReport.pdb source: LetsPRO.exe, 00000005.00000000.1716952895.0000000000436000.00000002.00000001.01000000.00000005.sdmp, LetsPRO.exe, 00000005.00000002.1723561398.0000000000436000.00000002.00000001.01000000.00000005.sdmp, LetsPRO.exe, 0000000A.00000000.1717732510.0000000000436000.00000002.00000001.01000000.00000005.sdmp, LetsPRO.exe, 0000000A.00000002.1718436135.0000000000436000.00000002.00000001.01000000.00000005.sdmp, LetsPRO.exe, 0000000B.00000000.1717785516.0000000000436000.00000002.00000001.01000000.00000005.sdmp, LetsPRO.exe, 0000000B.00000002.1718664733.0000000000436000.00000002.00000001.01000000.00000005.sdmp
Source:	Binary string: E:\A\_work\156\s\corefx\bin\obj\AnyOS.AnyCPU.Release\System.Buffers\netfx\System.Buffers.pdb source: LetsPRO.exe, 00000037.00000002.4168359295.00000000067F2000.00000002.00000001.01000000.00000022.sdmp
Source:	Binary string: W.PDb source: haxGhXjmBFM.exe.1.dr
Source:	Binary string: D:\a\1\s\SDK\AppCenterCrashes\Microsoft.AppCenter.Crashes.WindowsDesktop\obj\Release\net461\Microsoft.AppCenter.Crashes.pdbSHA256, source: LetsPRO.exe, 00000037.00000002.4178819054.00000000300C2000.00000002.00000001.01000000.00000028.sdmp
Source:	Binary string: C:\WorkShop\WebSocket4Net\WebSocket4Net\obj\Release\WebSocket4Net.pdb* source: LetsPRO.exe, 00000037.00000002.4214834576.00000000387E2000.00000002.00000001.01000000.00000038.sdmp
Source:	Binary string: C:\Users\winsign\samuli\source\repos\tap-windows6\src\x64\Release\tap0901.pdb source: drvinst.exe, 00000023.00000003.1927968266.000002092AA5C000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000024.00000003.1942016589.0000014379274000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\s\LetsVPNInfraStructure\obj\Release\LetsVPNInfraStructure.pdb]KwK iK_CorDllMainmscoree.dll source: LetsPRO.exe, 00000037.00000002.4168992457.0000000006FB2000.00000002.00000001.01000000.00000023.sdmp
Source:	Binary string: C:\WorkShop\SuperSocket.ClientEngine\obj\Release\SuperSocket.ClientEngine.pdbR source: LetsPRO.exe, 00000037.00000002.4214552147.00000000387C2000.00000002.00000001.01000000.00000037.sdmp
Source:	Binary string: C:\Users\IEUser\pusher-websocket-dotnet\PusherClient\obj\release\net46\PusherClient.pdb source: LetsPRO.exe, 00000037.00000002.4213951978.00000000385D2000.00000002.00000001.01000000.00000036.sdmp
Source:	Binary string: D:\a\_work\1\s\corefx\bin\obj\AnyOS.AnyCPU.Release\System.Memory\netfx\System.Memory.pdb source: LetsPRO.exe, 00000037.00000002.4168580863.0000000006E72000.00000002.00000001.01000000.00000020.sdmp
Source:	Binary string: /_/Src/Newtonsoft.Json/obj/Release/net45/Newtonsoft.Json.pdbSHA256 source: LetsPRO.exe, 00000037.00000002.4164213776.0000000006032000.00000002.00000001.01000000.0000001D.sdmp
Source:	Binary string: E:\dailybuild_fix_5.4\wegame_client\build\lib\Release\common.pdb source: wegame.exe, 00000006.00000002.4142318714.000000006C825000.00000002.00000001.01000000.00000008.sdmp, wegame.exe, 00000006.00000003.1736539346.00000000031D0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\Users\ani\code\squirrel\squirrel.windows\build\Release\Win32\StubExecutable.pdb source: LetsPRO.exe, 00000003.00000000.1714533986.0000000000BDD000.00000002.00000001.01000000.00000003.sdmp, LetsPRO.exe, 00000003.00000002.1724304213.0000000000BDD000.00000002.00000001.01000000.00000003.sdmp, LetsPRO.exe, 00000007.00000000.1717340757.0000000000BDD000.00000002.00000001.01000000.00000003.sdmp, LetsPRO.exe, 00000007.00000002.1718433574.0000000000BDD000.00000002.00000001.01000000.00000003.sdmp, LetsPRO.exe, 00000009.00000002.1718643469.0000000000BDD000.00000002.00000001.01000000.00000003.sdmp, LetsPRO.exe, 00000009.00000000.1717405600.0000000000BDD000.00000002.00000001.01000000.00000003.sdmp, LetsPRO.exe, 00000036.00000000.2029609057.00000000004AD000.00000002.00000001.01000000.00000017.sdmp, LetsPRO.exe, 00000036.00000002.2041845468.00000000004AD000.00000002.00000001.01000000.00000017.sdmp
Source:	Binary string: /_/Src/Newtonsoft.Json/obj/Release/net45/Newtonsoft.Json.pdb source: LetsPRO.exe, 00000037.00000002.4164213776.0000000006032000.00000002.00000001.01000000.0000001D.sdmp
Source:	Binary string: compiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 /WX -DL_ENDIAN -DOPENSSL_PIC -D_WIN32_WINNT=0x0501 source: wegame.exe, 00000006.00000002.4142318714.000000006C825000.00000002.00000001.01000000.00000008.sdmp, wegame.exe, 00000006.00000003.1736539346.00000000031D0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\s\LetsVPN\obj\Release\LetsPRO.pdbm source: LetsPRO.exe, 00000037.00000000.2030391391.0000000000E62000.00000002.00000001.01000000.00000018.sdmp
Source:	Binary string: E:\dailybuild_fix_5.4\wegame_client\build\bin\Release\wegame.pdb source: wegame.exe, 00000006.00000002.4137406249.0000000000476000.00000002.00000001.01000000.00000004.sdmp, wegame.exe, 00000006.00000000.1716127775.0000000000476000.00000002.00000001.01000000.00000004.sdmp
Source:	Binary string: D:\a\1\s\LetsVPNInfraStructure\obj\Release\LetsVPNInfraStructure.pdb source: LetsPRO.exe, 00000037.00000002.4168992457.0000000006FB2000.00000002.00000001.01000000.00000023.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Runtime.CompilerServices.Unsafe\net461-Release\System.Runtime.CompilerServices.Unsafe.pdbBSJB source: LetsPRO.exe, 00000037.00000002.4168104099.0000000006772000.00000002.00000001.01000000.00000021.sdmp
Source:	Binary string: C:\Users\eric\dev\SQLitePCL.raw\src\SQLitePCLRaw.core\obj\Release\netstandard2.0\SQLitePCLRaw.core.pdbSHA256xpRb source: LetsPRO.exe, 00000037.00000002.4196069676.00000000371F2000.00000002.00000001.01000000.0000002F.sdmp
Source:	Binary string: C:\Users\eric\dev\SQLitePCL.raw\src\SQLitePCLRaw.provider.dynamic_cdecl\obj\Release\netstandard2.0\SQLitePCLRaw.provider.dynamic_cdecl.pdb source: LetsPRO.exe, 00000037.00000002.4196250023.0000000037212000.00000002.00000001.01000000.00000030.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Runtime.CompilerServices.Unsafe\net461-Release\System.Runtime.CompilerServices.Unsafe.pdb source: LetsPRO.exe, 00000037.00000002.4168104099.0000000006772000.00000002.00000001.01000000.00000021.sdmp
Source:	Binary string: C:\Users\eric\dev\SQLitePCL.raw\src\SQLitePCLRaw.provider.dynamic_cdecl\obj\Release\netstandard2.0\SQLitePCLRaw.provider.dynamic_cdecl.pdbSHA256 source: LetsPRO.exe, 00000037.00000002.4196250023.0000000037212000.00000002.00000001.01000000.00000030.sdmp
Source:	Binary string: E:\dailybuild_fix_5.4\wegame_client\build\lib\Release\adapt_for_imports.pdb source: wegame.exe, 00000006.00000002.4143381615.000000006C98C000.00000002.00000001.01000000.00000007.sdmp
Source:	Binary string: D:\a\1\s\SDK\AppCenterAnalytics\Microsoft.AppCenter.Analytics.WindowsDesktop\obj\Release\net461\Microsoft.AppCenter.Analytics.pdb source: LetsPRO.exe, 00000037.00000002.4178693283.00000000300B2000.00000002.00000001.01000000.00000026.sdmp
Source:	Binary string: c:\users\samuli\opt\tap-windows6-mattock\tapinstall\7600\objfre_wlh_amd64\amd64\tapinstall.pdbH source: tapinstall.exe, 0000001E.00000002.1912221093.00007FF7BEED1000.00000020.00000001.01000000.00000016.sdmp, tapinstall.exe, 0000001E.00000000.1910661790.00007FF7BEED1000.00000020.00000001.01000000.00000016.sdmp, tapinstall.exe, 00000020.00000000.1913117233.00007FF7BEED1000.00000020.00000001.01000000.00000016.sdmp, tapinstall.exe, 00000020.00000002.1953276492.00007FF7BEED1000.00000020.00000001.01000000.00000016.sdmp, tapinstall.exe, 00000032.00000002.1972779400.00007FF7BEED1000.00000020.00000001.01000000.00000016.sdmp, tapinstall.exe, 00000032.00000000.1970876937.00007FF7BEED1000.00000020.00000001.01000000.00000016.sdmp
Source:	Binary string: C:\WorkShop\SuperSocket.ClientEngine\obj\Release\SuperSocket.ClientEngine.pdb source: LetsPRO.exe, 00000037.00000002.4214552147.00000000387C2000.00000002.00000001.01000000.00000037.sdmp
Source:	Binary string: C:\Users\eric\dev\SQLitePCL.raw\src\SQLitePCLRaw.nativelibrary\obj\Release\netstandard2.0\SQLitePCLRaw.nativelibrary.pdbSHA256 source: LetsPRO.exe, 00000037.00000002.4195831415.0000000035422000.00000002.00000001.01000000.0000002E.sdmp
Source:	Binary string: C:\Users\IEUser\pusher-websocket-dotnet\PusherClient\obj\release\net46\PusherClient.pdbSHA256 source: LetsPRO.exe, 00000037.00000002.4213951978.00000000385D2000.00000002.00000001.01000000.00000036.sdmp
Source:	Binary string: E:\A\_work\1795\s\corefx\bin\obj\Windows_NT.AnyCPU.Release\System.Runtime.InteropServices.RuntimeInformation\net462\System.Runtime.InteropServices.RuntimeInformation.pdbxE source: LetsPRO.exe, 00000037.00000002.4168244500.00000000067E2000.00000002.00000001.01000000.0000001F.sdmp
Source:	Binary string: keyfuncencryptionPBE2PARAMkeylengthprfPBKDF2PARAMcrypto\asn1\p5_pbev2.ccrypto\evp\p5_crpt2.cassertion failed: keylen <= sizeof(key)crypto\hmac\hmac.ccrypto\pkcs12\p12_key.cxn--compiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 /WX -DL_ENDIAN -DOPENSSL_PIC -D_WIN32_WINNT=0x0501 source: wegame.exe, 00000006.00000003.1736539346.00000000031D0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\Users\eric\dev\SQLitePCL.raw\src\SQLitePCLRaw.core\obj\Release\netstandard2.0\SQLitePCLRaw.core.pdb source: LetsPRO.exe, 00000037.00000002.4196069676.00000000371F2000.00000002.00000001.01000000.0000002F.sdmp
Source:	Binary string: D:\git\wegame_client\dependences\Lua\include\lua51.pdb source: wegame.exe, 00000006.00000002.4141048756.000000006C57A000.00000002.00000001.01000000.00000009.sdmp
Source:	Binary string: D:\a\1\s\SDK\AppCenter\Microsoft.AppCenter.WindowsDesktop\obj\Release\net461\Microsoft.AppCenter.pdbSHA256X7 source: LetsPRO.exe, 00000037.00000002.4187562856.0000000034AB5000.00000004.00000020.00020000.00000000.sdmp, LetsPRO.exe, 00000037.00000002.4179081431.0000000030452000.00000002.00000001.01000000.00000027.sdmp
Source:	Binary string: C:\Users\eric\dev\SQLitePCL.raw\src\SQLitePCLRaw.nativelibrary\obj\Release\netstandard2.0\SQLitePCLRaw.nativelibrary.pdb source: LetsPRO.exe, 00000037.00000002.4195831415.0000000035422000.00000002.00000001.01000000.0000002E.sdmp

Source: System.Web.Services.Description.dll.8.dr

Static PE information: 0xBC7E1473 [Tue Mar 18 14:42:59 2070 UTC]

Source: C:\Program Files (x86)\haxGhXjmBFM\app-3.8.0\LetsPRO.exe

Code function: 5_2_0042C3DA LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,__invoke_watson,GetProcAddress,GetProcAddress,__invoke_watson,

5_2_0042C3DA

Source: beacon_sdk.dll.1.dr	Static PE information: section name: .QMGuid
Source: common.dll.1.dr	Static PE information: section name: .QMGuid
Source: Lua51.dll.1.dr	Static PE information: section name: .00cfg
Source: MSI3D02.tmp.1.dr	Static PE information: section name: .didat
Source: MSI3E8C.tmp.1.dr	Static PE information: section name: .didat
Source: MSI3EAC.tmp.1.dr	Static PE information: section name: .didat
Source: MSI3EDC.tmp.1.dr	Static PE information: section name: .didat

Source: C:\Program Files (x86)\haxGhXjmBFM\LetsPRO.exe	Code function: 3_2_00BC8835 push ecx; ret	3_2_00BC8848
Source: C:\Program Files (x86)\haxGhXjmBFM\LetsPRO.exe	Code function: 3_2_00BC8C76 push ecx; ret	3_2_00BC8C89
Source: C:\Program Files (x86)\haxGhXjmBFM\app-3.8.0\LetsPRO.exe	Code function: 5_2_004210E5 push ecx; ret	5_2_004210F8
Source: C:\Program Files (x86)\haxGhXjmBFM\app-3.8.0\LetsPRO.exe	Code function: 5_2_0042156D push ecx; ret	5_2_00421580
Source: C:\Program Files (x86)\Common Files\wegame.exe	Code function: 6_2_00469146 push ecx; ret	6_2_00469159
Source: C:\Program Files (x86)\Common Files\wegame.exe	Code function: 6_2_00467A8A push ecx; ret	6_2_00467A9D
Source: C:\Program Files (x86)\Common Files\wegame.exe	Code function: 6_2_6C5010FF push ecx; ret	6_2_6C506BB9
Source: C:\Program Files (x86)\Common Files\wegame.exe	Code function: 6_2_6C5010FF push ecx; ret	6_2_6C506BB9
Source: C:\Program Files (x86)\Common Files\wegame.exe	Code function: 6_2_6C5010FF push ecx; ret	6_2_6C506BB9
Source: C:\Program Files (x86)\Common Files\wegame.exe	Code function: 6_2_6C5010FF push ecx; ret	6_2_6C506BB9
Source: C:\Program Files (x86)\Common Files\wegame.exe	Code function: 6_2_6C5010FF push ecx; ret	6_2_6C506BB9
Source: C:\Program Files (x86)\Common Files\wegame.exe	Code function: 6_2_6C5010FF push ecx; ret	6_2_6C506BB9
Source: C:\Program Files (x86)\Common Files\wegame.exe	Code function: 6_2_6C5010FF push ecx; ret	6_2_6C506BB9
Source: C:\Program Files (x86)\Common Files\wegame.exe	Code function: 6_2_6C5010FF push ecx; ret	6_2_6C506BB9
Source: C:\Program Files (x86)\Common Files\wegame.exe	Code function: 6_2_6C5010FF push ecx; ret	6_2_6C506BB9
Source: C:\Program Files (x86)\Common Files\wegame.exe	Code function: 6_2_6C501037 push ecx; ret	6_2_6C576FC9
Source: C:\Program Files (x86)\Common Files\wegame.exe	Code function: 6_2_6C5010FF push ecx; ret	6_2_6C506BB9
Source: C:\Program Files (x86)\Common Files\wegame.exe	Code function: 6_2_6C5063DD push ebp; ret	6_2_6C50640E
Source: C:\Program Files (x86)\haxGhXjmBFM\app-3.8.0\LetsPRO.exe	Code function: 10_2_004210E5 push ecx; ret	10_2_004210F8
Source: C:\Program Files (x86)\haxGhXjmBFM\app-3.8.0\LetsPRO.exe	Code function: 10_2_0042156D push ecx; ret	10_2_00421580
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 24_2_02E55DD0 push esp; ret	24_2_02E55DE3
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 24_2_076566DB push FFFFFFE8h; iretd	24_2_076566DD

Source: msvcr100.dll.1.dr

Static PE information: section name: .text entropy: 6.910468675356735

Persistence and Installation Behavior

Contains functionality to infect the boot sector

Source: C:\Program Files (x86)\Common Files\wegame.exe	Code function: __EH_prolog3_GS,memset,__snprintf_s,CreateFileA,memset,memset,DeviceIoControl,memset,memset,memset,isalnum,isalnum,GetLastError,FindCloseChangeNotification, \\.\PhysicalDrive%d		6_2_6C614908
Source: C:\Program Files (x86)\Common Files\wegame.exe	Code function: __EH_prolog3_GS,memset,__snprintf_s,CreateFileA,memset,DeviceIoControl,memset,memset,DeviceIoControl,FindCloseChangeNotification, \\.\PhysicalDrive%d		6_2_6C61468C

Sample is not signed and drops a device driver

Source: C:\Program Files (x86)\haxGhXjmBFM.exe

File created: C:\Program Files (x86)\letsvpn\driver\tap0901.sys

Jump to behavior

Uses ipconfig to lookup or modify the Windows network settings

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /all

Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\Microsoft.Expression.Interactions.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\System.Net.Ping.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\System.Text.Encoding.Extensions.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\WindowsInput.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\SQLitePCLRaw.batteries_v2.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\System.Data.SqlClient.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\System.Windows.Interactivity.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\System.Resources.Writer.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\WpfAnimatedGif.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\System.Text.Encoding.CodePages.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\System.Linq.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\microsoft.identitymodel.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\System.Security.Cryptography.Pkcs.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\ja\System.Web.Services.Description.resources.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\Microsoft.AppCenter.Crashes.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Common Files\beacon_sdk.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\System.IO.Ports.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\System.Diagnostics.TraceSource.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\System.Security.Principal.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\System.Xml.XmlSerializer.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\System.Threading.Tasks.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\tr\System.Web.Services.Description.resources.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\System.Collections.Concurrent.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\LetsPRO.exe	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\Squirrel.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\System.Diagnostics.Tracing.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\ICSharpCode.AvalonEdit.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\System.Diagnostics.PerformanceCounter.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI3DDE.tmp	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsVPNDomainModel.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\System.Runtime.Serialization.Json.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\PusherClient.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\ru\System.Web.Services.Description.resources.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\System.IO.Pipes.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\System.Xml.XPath.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\System.IO.FileSystem.Primitives.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\Microsoft.Web.WebView2.WinForms.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\System.ComponentModel.Annotations.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\System.Globalization.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI3EDC.tmp	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\Microsoft.Win32.Registry.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\System.Runtime.Serialization.Xml.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Common Files\common.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\System.Runtime.Handles.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\System.Net.Sockets.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Common Files\adapt_for_imports.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\System.Drawing.Primitives.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\System.ValueTuple.dll	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{7fc39624-296a-4042-b309-10cc640cfd85}\tap0901.sys (copy)	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\ToastNotifications.Messages.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\System.AppContext.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\System.IO.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\es\System.Web.Services.Description.resources.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\System.Diagnostics.EventLog.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\System.Memory.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\haxGhXjmBFM.exe	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\Mono.Cecil.Pdb.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\System.Threading.Overlapped.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\FontAwesome.WPF.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\Microsoft.Win32.Primitives.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\System.Security.Cryptography.X509Certificates.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\System.Security.Cryptography.Cng.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\Mono.Cecil.Mdb.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\System.IO.IsolatedStorage.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\System.Reflection.Extensions.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\Microsoft.Web.WebView2.Core.dll	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\drivers\SET9E3C.tmp	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\System.ComponentModel.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\System.Web.Services.Description.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\SQLitePCLRaw.core.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\System.Threading.Timer.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\zh-Hans\System.Web.Services.Description.resources.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\System.Runtime.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\zh-MO\LetsPRO.resources.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Users\user\AppData\Local\Temp\nst47D0.tmp\nsDialogs.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\Hardcodet.Wpf.TaskbarNotification.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Users\user\AppData\Local\Temp\nst47D0.tmp\System.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\System.Security.Cryptography.Encoding.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\System.Drawing.Common.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\zh-TW\LetsPRO.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\haxGhXjmBFM\app-3.8.0\LetsPROCHS.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\Microsoft.AppCenter.Analytics.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\System.Security.Cryptography.ProtectedData.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\pt-BR\System.Web.Services.Description.resources.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\System.ComponentModel.Primitives.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\zh-SG\LetsPRO.resources.dll	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\drivers\tap0901.sys (copy)	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\System.Collections.NonGeneric.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\zh-HK\LetsPRO.resources.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\System.Globalization.Extensions.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\System.Xml.XmlDocument.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\SQLiteNetExtensionsAsync.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\CommunityToolkit.Mvvm.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\System.Net.NetworkInformation.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\System.Runtime.Extensions.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\ru\LetsPRO.resources.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\System.Buffers.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\zh-CN\LetsPRO.resources.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\System.ServiceModel.Syndication.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\System.Security.Cryptography.Csp.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\System.IO.Packaging.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\System.Diagnostics.Debug.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\ndp462-web.exe	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\System.Reflection.Primitives.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\fr\System.Web.Services.Description.resources.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\System.IO.FileSystem.Watcher.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\ko\System.Web.Services.Description.resources.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\System.Runtime.InteropServices.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\System.ServiceModel.Http.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\System.Net.Requests.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\SQLitePCLRaw.nativelibrary.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI3EAC.tmp	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\DeltaCompressionDotNet.PatchApi.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\System.IO.Compression.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\System.Diagnostics.TextWriterTraceListener.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\Utils.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\SQLite-net.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\System.ObjectModel.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\System.IO.Compression.ZipFile.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\DeltaCompressionDotNet.MsDelta.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\NuGet.Squirrel.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\System.Linq.Expressions.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\arm64\WebView2Loader.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\System.IO.MemoryMappedFiles.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\System.Net.Security.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\netstandard.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\ToastNotifications.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\System.Net.WebSockets.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\pl\System.Web.Services.Description.resources.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\System.Security.Claims.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\System.ServiceProcess.ServiceController.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\Newtonsoft.Json.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\System.Text.RegularExpressions.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\System.IO.FileSystem.DriveInfo.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\Microsoft.Win32.SystemEvents.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\System.IO.UnmanagedMemoryStream.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\Update.exe	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\System.ComponentModel.TypeConverter.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\System.Runtime.Serialization.Formatters.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\System.Threading.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\System.Numerics.Vectors.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\System.Threading.AccessControl.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\System.Diagnostics.Process.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\System.Configuration.ConfigurationManager.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\zh-Hant\System.Web.Services.Description.resources.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI3E8C.tmp	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\System.Data.OleDb.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\System.Management.Automation.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\System.Net.IPNetwork.dll	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{7fc39624-296a-4042-b309-10cc640cfd85}\SET98CF.tmp	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\WebSocket4Net.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\de\System.Web.Services.Description.resources.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\runtimes\win-x64\native\e_sqlite3.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\Mono.Cecil.Rocks.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\System.Xml.XPath.XDocument.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\x64\WebView2Loader.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\Microsoft.Bcl.AsyncInterfaces.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\System.Net.WebSockets.Client.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\haxGhXjmBFM\app-3.8.0\msvcr100.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\Mono.Cecil.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\System.Threading.Tasks.Parallel.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\System.Runtime.Serialization.Primitives.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\uninst.exe	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\System.ServiceModel.Primitives.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\MdXaml.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\System.Xml.ReaderWriter.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\System.Runtime.CompilerServices.Unsafe.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\System.ServiceModel.NetTcp.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\System.Threading.ThreadPool.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\DeltaCompressionDotNet.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\System.Data.Common.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\System.Net.NameResolution.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\log4net.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\runtimes\win-arm\native\e_sqlite3.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\System.ServiceModel.Duplex.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\System.Security.SecureString.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\System.CodeDom.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\System.Xml.XDocument.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\runtimes\win-x86\native\e_sqlite3.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\System.IO.FileSystem.AccessControl.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\System.Net.WebHeaderCollection.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\cs\System.Web.Services.Description.resources.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\System.Net.Http.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\Microsoft.Web.WebView2.Wpf.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\System.Threading.Thread.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\System.Dynamic.Runtime.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI3D02.tmp	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\System.Diagnostics.Tools.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\System.Collections.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\System.ComponentModel.EventBasedAsync.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\System.Globalization.Calendars.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\System.Linq.Parallel.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\System.Threading.Tasks.Extensions.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\System.Security.Cryptography.Primitives.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\SQLiteNetExtensions.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\System.Reflection.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Users\user\AppData\Local\Temp\nst47D0.tmp\nsExec.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\Microsoft.AppCenter.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\System.Data.Odbc.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\System.Security.Cryptography.Algorithms.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\System.Text.Encoding.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\System.IO.FileSystem.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\x86\WebView2Loader.dll	Jump to dropped file
Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe	File created: C:\Users\user\AppData\Local\Temp\{99f02b5e-0c7c-d542-ad44-27ce9be55c97}\SET97A6.tmp	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\SharpCompress.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\libwin.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\System.Linq.Queryable.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\System.Net.Primitives.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\System.Diagnostics.StackTrace.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\haxGhXjmBFM\LetsPRO.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\haxGhXjmBFM\app-3.8.0\LetsPRO.exe	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\driver\tap0901.sys	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\it\System.Web.Services.Description.resources.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\System.Security.AccessControl.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\System.Resources.Reader.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\System.Runtime.Numerics.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\System.Runtime.InteropServices.RuntimeInformation.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\haxGhXjmBFM\app-3.8.0\msvcp100.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\System.Diagnostics.Contracts.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Common Files\wegame.exe	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\SQLitePCLRaw.provider.dynamic_cdecl.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\System.Diagnostics.FileVersionInfo.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\System.Collections.Specialized.dll	Jump to dropped file
Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe	File created: C:\Users\user\AppData\Local\Temp\{99f02b5e-0c7c-d542-ad44-27ce9be55c97}\tap0901.sys (copy)	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\System.Resources.ResourceManager.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Common Files\Lua51.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\System.IO.Pipes.AccessControl.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\System.Console.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\SuperSocket.ClientEngine.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI3E0E.tmp	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsVPNInfraStructure.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\Microsoft.Win32.Registry.AccessControl.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\System.Security.Principal.Windows.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\System.ServiceModel.Security.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\System.Runtime.CompilerServices.VisualC.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\System.Security.Permissions.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Program Files (x86)\letsvpn\app-3.8.0\System.Security.Cryptography.Xml.dll	Jump to dropped file

Source: C:\Windows\System32\msiexec.exe

File created: C:\Program Files (x86)\haxGhXjmBFM.exe

Jump to dropped file

Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI3DDE.tmp	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\drivers\tap0901.sys (copy)	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{7fc39624-296a-4042-b309-10cc640cfd85}\tap0901.sys (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI3E8C.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI3E0E.tmp	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{7fc39624-296a-4042-b309-10cc640cfd85}\SET98CF.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI3D02.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI3EAC.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI3EDC.tmp	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\drivers\SET9E3C.tmp	Jump to dropped file

Source: C:\Program Files (x86)\Common Files\wegame.exe	Code function: 6_2_00458459 ?GetLastLoginedUin@common@ierd_tgp@@YA_KXZ,FindWindowW,GetTickCount,PostMessageA,SimpleUString::operator=,?scale_path2absolute_path@common@ierd_tgp@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@ABV34@@Z,GetPrivateProfileIntW,?get_log_instance@base@@YAPAVILogger@1@XZ,WritePrivateProfileStringW,SimpleUString::operator=,?scale_path2absolute_path@common@ierd_tgp@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@ABV34@@Z,?get_log_instance@base@@YAPAVILogger@1@XZ,?get_log_instance@base@@YAPAVILogger@1@XZ,?get_cfg_by_path@common@ierd_tgp@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAV?$basic_ptree@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@property_tree@boost@@_N@Z,GetTickCount,?get_qos_instance@qos@adapt_for_imports@ierd_tgp@@YAAAVQos@123@XZ,?GetCurrentStage@Qos@qos@adapt_for_imports@ierd_tgp@@QAE?AW4ProcessStage@234@XZ,?get_qos_instance@qos@adapt_for_imports@ierd_tgp@@YAAAVQos@123@XZ,?report@Qos@qos@adapt_for_imports@ierd_tgp@@QAE_NABUQos_data_base@234@W4Qos_occasion@234@@Z,Sleep,?get_log_instance@base@@YAPAVILogger@1@XZ,?get_log_instance@base@@YAPAVILogger@1@XZ,	6_2_00458459
Source: C:\Program Files (x86)\Common Files\wegame.exe	Code function: 6_2_0045A90F __EH_prolog3_GS,?GetUpdatedFilePath@silence_update@common@ierd_tgp@@SA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PB_W0@Z,?get_log_instance@base@@YAPAVILogger@1@XZ,?u8to16@common@ierd_tgp@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@4@@Z,?exists@filesystem@ierd_tgp@@YA_NABVpath@12@@Z,?remove_filename@path@filesystem@ierd_tgp@@QAEAAV123@XZ,GetPrivateProfileIntW,?u16to8@common@ierd_tgp@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@4@@Z,	6_2_0045A90F
Source: C:\Program Files (x86)\Common Files\wegame.exe	Code function: 6_2_00457BEC __EH_prolog3_catch_GS,?get_log_instance@base@@YAPAVILogger@1@XZ,?get_log_instance@base@@YAPAVILogger@1@XZ,?get_log_instance@base@@YAPAVILogger@1@XZ,?get_log_instance@base@@YAPAVILogger@1@XZ,SimpleUString::operator=,?Instance@CrashReportLoader@crash_report@@SAAAV12@XZ,?Instance@CrashReportLoader@crash_report@@SAAAV12@XZ,?AddCrashReportHelperFile@CrashReportLoader@crash_report@@QAEHPB_W00K@Z,?AddCrashReportHelperFile@CrashReportLoader@crash_report@@QAEHPB_W00K@Z,?Instance@CrashReportLoader@crash_report@@SAAAV12@XZ,?AddCrashReportHelperFile@CrashReportLoader@crash_report@@QAEHPB_W00K@Z,?get_log_instance@base@@YAPAVILogger@1@XZ,WaitForSingleObject,?file_exists@common@ierd_tgp@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z,?get_log_instance@base@@YAPAVILogger@1@XZ,??Bios_base@std@@QBE_NXZ,??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z,?get_log_instance@base@@YAPAVILogger@1@XZ,?get_log_instance@base@@YAPAVILogger@1@XZ,?get_log_instance@base@@YAPAVILogger@1@XZ,?get_log_instance@base@@YAPAVILogger@1@XZ,?get_qos_instance@qos@adapt_for_imports@ierd_tgp@@YAAAVQos@123@XZ,?SetCrashInfo@Qos@qos@adapt_for_imports@ierd_tgp@@QAEXABUCrashInfo@234@@Z,?get_log_instance@base@@YAPAVILogger@1@XZ,?GetLastLoginedUin@common@ierd_tgp@@YA_KXZ,FindWindowW,GetTickCount,PostMessageA,SimpleUString::operator=,?scale_path2absolute_path@common@ierd_tgp@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@ABV34@@Z,GetPrivateProfileIntW,?get_log_instance@base@@YAPAVILogger@1@XZ,WritePrivateProfileStringW,SimpleUString::operator=,?scale_path2absolute_path@common@ierd_tgp@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@ABV34@@Z,?get_log_instance@base@@YAPAVILogger@1@XZ,?get_log_instance@base@@YAPAVILogger@1@XZ,GetLastError,?get_log_instance@base@@YAPAVILogger@1@XZ,?get_log_instance@base@@YAPAVILogger@1@XZ,?get_cfg_by_path@common@ierd_tgp@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAV?$basic_ptree@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@property_tree@boost@@_N@Z,GetTickCount,?get_qos_instance@qos@adapt_for_imports@ierd_tgp@@YAAAVQos@123@XZ,?GetCurrentStage@Qos@qos@adapt_for_imports@ierd_tgp@@QAE?AW4ProcessStage@234@XZ,?get_qos_instance@qos@adapt_for_imports@ierd_tgp@@YAAAVQos@123@XZ,?report@Qos@qos@adapt_for_imports@ierd_tgp@@QAE_NABUQos_data_base@234@W4Qos_occasion@234@@Z,OutputDebugStringA,Sleep,?get_log_instance@base@@YAPAVILogger@1@XZ,?get_log_instance@base@@YAPAVILogger@1@XZ,	6_2_00457BEC

Boot Survival

Contains functionality to infect the boot sector

Source: C:\Program Files (x86)\Common Files\wegame.exe	Code function: __EH_prolog3_GS,memset,__snprintf_s,CreateFileA,memset,memset,DeviceIoControl,memset,memset,memset,isalnum,isalnum,GetLastError,FindCloseChangeNotification, \\.\PhysicalDrive%d		6_2_6C614908
Source: C:\Program Files (x86)\Common Files\wegame.exe	Code function: __EH_prolog3_GS,memset,__snprintf_s,CreateFileA,memset,DeviceIoControl,memset,memset,DeviceIoControl,FindCloseChangeNotification, \\.\PhysicalDrive%d		6_2_6C61468C

Creates multiple autostart registry keys

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_C366A24065C39A1BE76E148DC2D0A868
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run LetsPRO

Source: C:\Windows\System32\drvinst.exe

Registry key created: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\tap0901

Source: C:\Windows\System32\svchost.exe

Registry key value modified: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Linkage

Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\letsvpn	Jump to behavior
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\letsvpn\LetsVPN.lnk	Jump to behavior
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\letsvpn\Uninstall.lnk	Jump to behavior

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_C366A24065C39A1BE76E148DC2D0A868
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_C366A24065C39A1BE76E148DC2D0A868
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run LetsPRO
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run LetsPRO

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1

Source: C:\Program Files (x86)\haxGhXjmBFM\app-3.8.0\LetsPRO.exe	Code function: 5_2_0040A238 IsIconic,GetWindowPlacement,GetWindowRect,	5_2_0040A238
Source: C:\Program Files (x86)\haxGhXjmBFM\app-3.8.0\LetsPRO.exe	Code function: 5_2_004019A0 IsIconic,SendMessageW,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetClientRect,DrawIcon,	5_2_004019A0
Source: C:\Program Files (x86)\haxGhXjmBFM\app-3.8.0\LetsPRO.exe	Code function: 10_2_0040A238 IsIconic,GetWindowPlacement,GetWindowRect,	10_2_0040A238
Source: C:\Program Files (x86)\haxGhXjmBFM\app-3.8.0\LetsPRO.exe	Code function: 10_2_004019A0 IsIconic,SendMessageW,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetClientRect,DrawIcon,	10_2_004019A0

Source: C:\Program Files (x86)\haxGhXjmBFM\LetsPRO.exe

Code function: 3_2_00BC7B91 GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

3_2_00BC7B91

Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Registry key monitored for changes: HKEY_CURRENT_USER\SOFTWARE\Microsoft\SystemCertificates\CA

Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\CCBBF9E1485AF63CE47ABF8E9E648C2504FC319D Blob

Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\haxGhXjmBFM\app-3.8.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\haxGhXjmBFM\app-3.8.0\LetsPRO.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\haxGhXjmBFM\app-3.8.0\LetsPRO.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : associators of {\\user-PC\root\cimv2:Win32_DiskPartition.DeviceID="Disk #0, Partition #1"} where resultclass = Win32_DiskDrive
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_DiskDriveToDiskPartition where Dependent="Win32_DiskPartition.DeviceID=\"Disk #0, Partition #1\""
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : associators of {\\user-PC\root\cimv2:Win32_DiskPartition.DeviceID="Disk #0, Partition #1"} where resultclass = Win32_DiskDrive
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_DiskDriveToDiskPartition where Dependent="Win32_DiskPartition.DeviceID=\"Disk #0, Partition #1\""
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_DiskDrive
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_DiskDrive
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_DiskDrive
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : associators of {\\user-PC\root\cimv2:Win32_DiskPartition.DeviceID="Disk #0, Partition #1"} where resultclass = Win32_DiskDrive
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_DiskDriveToDiskPartition where Dependent="Win32_DiskPartition.DeviceID=\"Disk #0, Partition #1\""
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : associators of {\\user-PC\root\cimv2:Win32_DiskPartition.DeviceID="Disk #0, Partition #1"} where resultclass = Win32_DiskDrive
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_DiskDriveToDiskPartition where Dependent="Win32_DiskPartition.DeviceID=\"Disk #0, Partition #1\""

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_NetworkAdapter where ServiceName="tap0901"
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_NetworkAdapter where GUID="{2B9A5297-5294-4B1F-96F3-7829AB1F54EE}"
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	WMI Queries: IWbemServices::PutInstance - root\cimv2 : Win32_NetworkAdapter.DeviceID="10"
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select MACAddress From Win32_NetworkAdapter WHERE ((MACAddress Is Not NULL) AND (Manufacturer <> 'Microsoft'))
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_NetworkAdapter where ServiceName="tap0901"
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_NetworkAdapterConfiguration where SettingID="{2B9A5297-5294-4B1F-96F3-7829AB1F54EE}"
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_NetworkAdapterConfiguration.Index=10::EnableStatic
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from win32_networkadapterconfiguration where ServiceName = 'tap0901'
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_NetworkAdapterConfiguration.Index=10::EnableStatic
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_NetworkAdapter where ServiceName="tap0901"
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_NetworkAdapter where GUID="{2B9A5297-5294-4B1F-96F3-7829AB1F54EE}"
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	WMI Queries: IWbemServices::PutInstance - root\cimv2 : Win32_NetworkAdapter.DeviceID="10"
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_NetworkAdapter where ServiceName="tap0901"
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_NetworkAdapterConfiguration where SettingID="{2B9A5297-5294-4B1F-96F3-7829AB1F54EE}"

Queries sensitive service information (via WMI, Win32_LogicalDisk, often done to detect sandboxes)

Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_LogicalDisk where DeviceId = 'C:'
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : associators of {\\user-PC\ROOT\cimv2:Win32_LogicalDisk.DeviceID="C:"} where resultclass = Win32_DiskPartition
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_LogicalDiskToPartition where Dependent="Win32_LogicalDisk.DeviceID=\"C:\""
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_LogicalDisk where DeviceId = 'C:'
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : associators of {\\user-PC\ROOT\cimv2:Win32_LogicalDisk.DeviceID="C:"} where resultclass = Win32_DiskPartition
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_LogicalDiskToPartition where Dependent="Win32_LogicalDisk.DeviceID=\"C:\""
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_LogicalDisk where DeviceId = 'C:'
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : associators of {\\user-PC\ROOT\cimv2:Win32_LogicalDisk.DeviceID="C:"} where resultclass = Win32_DiskPartition
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_LogicalDiskToPartition where Dependent="Win32_LogicalDisk.DeviceID=\"C:\""
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_LogicalDisk where DeviceId = 'C:'
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : associators of {\\user-PC\ROOT\cimv2:Win32_LogicalDisk.DeviceID="C:"} where resultclass = Win32_DiskPartition
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_LogicalDiskToPartition where Dependent="Win32_LogicalDisk.DeviceID=\"C:\""

Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Memory allocated: 17F0000 memory reserve \| memory write watch
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Memory allocated: 3370000 memory reserve \| memory write watch
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Memory allocated: 5370000 memory reserve \| memory write watch

Source: C:\Program Files (x86)\Common Files\wegame.exe

Code function: 6_2_0045B61D __EH_prolog3_GS,?u8to16@common@ierd_tgp@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@4@@Z,GetCurrentProcessId,CreateToolhelp32Snapshot,memset,Process32FirstW,SimpleUString::operator=,?extract_name@common@ierd_tgp@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AAV34@@Z,OpenProcess,SetLastError,TerminateProcess,GetLastError,?get_log_instance@base@@YAPAVILogger@1@XZ,CloseHandle,Process32NextW,CloseHandle,

6_2_0045B61D

Source: C:\Program Files (x86)\Common Files\wegame.exe	Code function: ?get_first_mac@common@ierd_tgp@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ,__EH_prolog3_catch_GS,GetAdaptersInfo,GetAdaptersInfo,?get_log_instance@base@@YAPAVILogger@1@XZ,__Init_thread_footer,		6_2_6C61722F
Source: C:\Program Files (x86)\Common Files\wegame.exe	Code function: memset,GetSystemDirectoryA,PathAppendA,LoadLibraryA,GetProcAddress,GetAdaptersInfo,memset,FreeLibrary,memset,		6_2_6C614FDF

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Thread delayed: delay time: 300000

Source: C:\Program Files (x86)\Common Files\wegame.exe	Window / User API: threadDelayed 7119	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1748	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6618
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3007
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Window / User API: threadDelayed 6483
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Window / User API: threadDelayed 2344

Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.8.0\System.IO.Packaging.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.8.0\Microsoft.Expression.Interactions.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.8.0\System.Diagnostics.Debug.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.8.0\System.Net.Ping.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.8.0\System.Text.Encoding.Extensions.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\ndp462-web.exe	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.8.0\WindowsInput.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.8.0\SQLitePCLRaw.batteries_v2.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.8.0\System.IO.FileSystem.Watcher.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.8.0\System.Data.SqlClient.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.8.0\System.ServiceModel.Http.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.8.0\System.Net.Requests.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.8.0\SQLitePCLRaw.nativelibrary.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.8.0\System.Windows.Interactivity.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI3EAC.tmp	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.8.0\DeltaCompressionDotNet.PatchApi.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.8.0\System.IO.Compression.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.8.0\System.Diagnostics.TextWriterTraceListener.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.8.0\Utils.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.8.0\SQLite-net.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.8.0\System.IO.Compression.ZipFile.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.8.0\System.ObjectModel.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.8.0\System.Resources.Writer.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.8.0\NuGet.Squirrel.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.8.0\DeltaCompressionDotNet.MsDelta.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.8.0\WpfAnimatedGif.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.8.0\System.Linq.Expressions.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.8.0\System.Linq.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.8.0\arm64\WebView2Loader.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.8.0\System.Security.Cryptography.Pkcs.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.8.0\microsoft.identitymodel.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.8.0\System.Net.Security.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.8.0\netstandard.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.8.0\ToastNotifications.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.8.0\System.Net.WebSockets.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.8.0\System.Diagnostics.TraceSource.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.8.0\System.IO.Ports.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.8.0\System.Security.Claims.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.8.0\System.Security.Principal.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.8.0\System.ServiceProcess.ServiceController.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.8.0\Newtonsoft.Json.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.8.0\System.Text.RegularExpressions.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.8.0\System.IO.FileSystem.DriveInfo.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.8.0\Microsoft.Win32.SystemEvents.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.8.0\System.Xml.XmlSerializer.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.8.0\System.Threading.Tasks.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.8.0\System.Collections.Concurrent.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.8.0\System.IO.UnmanagedMemoryStream.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.8.0\Squirrel.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\Update.exe	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.8.0\System.ComponentModel.TypeConverter.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.8.0\System.Diagnostics.Tracing.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.8.0\System.Threading.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.8.0\System.Runtime.Serialization.Formatters.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.8.0\ICSharpCode.AvalonEdit.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.8.0\System.Numerics.Vectors.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.8.0\System.Diagnostics.PerformanceCounter.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI3DDE.tmp	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.8.0\System.Threading.AccessControl.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsVPNDomainModel.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.8.0\System.Diagnostics.Process.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.8.0\System.Runtime.Serialization.Json.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.8.0\PusherClient.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.8.0\System.Xml.XPath.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.8.0\System.Configuration.ConfigurationManager.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.8.0\System.Data.OleDb.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI3E8C.tmp	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.8.0\System.Management.Automation.dll	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	Dropped PE file which has not been started: C:\Windows\System32\DriverStore\Temp\{7fc39624-296a-4042-b309-10cc640cfd85}\SET98CF.tmp	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.8.0\System.Net.IPNetwork.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.8.0\WebSocket4Net.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.8.0\Microsoft.Web.WebView2.WinForms.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.8.0\System.ComponentModel.Annotations.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.8.0\runtimes\win-x64\native\e_sqlite3.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.8.0\System.Globalization.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.8.0\Microsoft.Win32.Registry.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI3EDC.tmp	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.8.0\Mono.Cecil.Rocks.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.8.0\System.Runtime.Serialization.Xml.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.8.0\System.Xml.XPath.XDocument.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.8.0\System.Net.Sockets.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.8.0\x64\WebView2Loader.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.8.0\System.Net.WebSockets.Client.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\haxGhXjmBFM\app-3.8.0\msvcr100.dll	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	Dropped PE file which has not been started: C:\Windows\System32\DriverStore\Temp\{7fc39624-296a-4042-b309-10cc640cfd85}\tap0901.sys (copy)	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.8.0\Mono.Cecil.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.8.0\System.ValueTuple.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.8.0\System.Threading.Tasks.Parallel.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.8.0\System.AppContext.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.8.0\System.IO.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\uninst.exe	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.8.0\MdXaml.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.8.0\System.Xml.ReaderWriter.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.8.0\System.ServiceModel.NetTcp.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.8.0\System.Threading.ThreadPool.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.8.0\System.Diagnostics.EventLog.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.8.0\System.Runtime.CompilerServices.Unsafe.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.8.0\DeltaCompressionDotNet.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.8.0\System.Memory.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.8.0\System.Net.NameResolution.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.8.0\runtimes\win-arm\native\e_sqlite3.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.8.0\log4net.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.8.0\System.ServiceModel.Duplex.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.8.0\Mono.Cecil.Pdb.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.8.0\System.Security.SecureString.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.8.0\System.Threading.Overlapped.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.8.0\System.CodeDom.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.8.0\System.Xml.XDocument.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.8.0\runtimes\win-x86\native\e_sqlite3.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.8.0\FontAwesome.WPF.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.8.0\System.IO.FileSystem.AccessControl.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.8.0\System.Net.WebHeaderCollection.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.8.0\System.Net.Http.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.8.0\Microsoft.Web.WebView2.Wpf.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.8.0\System.Threading.Thread.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.8.0\System.Dynamic.Runtime.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.8.0\System.Security.Cryptography.Cng.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI3D02.tmp	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.8.0\Mono.Cecil.Mdb.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.8.0\System.Diagnostics.Tools.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.8.0\System.IO.IsolatedStorage.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.8.0\System.Collections.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.8.0\System.ComponentModel.EventBasedAsync.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.8.0\System.Reflection.Extensions.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.8.0\System.Linq.Parallel.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.8.0\System.Globalization.Calendars.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.8.0\Microsoft.Web.WebView2.Core.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.8.0\System.Threading.Tasks.Extensions.dll	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	Dropped PE file which has not been started: C:\Windows\System32\drivers\SET9E3C.tmp	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.8.0\SQLiteNetExtensions.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.8.0\System.ComponentModel.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.8.0\System.Web.Services.Description.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.8.0\SQLitePCLRaw.core.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nst47D0.tmp\nsExec.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.8.0\System.Reflection.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.8.0\Microsoft.AppCenter.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.8.0\System.Data.Odbc.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.8.0\System.Security.Cryptography.Algorithms.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.8.0\System.Threading.Timer.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.8.0\System.Text.Encoding.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.8.0\System.IO.FileSystem.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.8.0\x86\WebView2Loader.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.8.0\System.Runtime.dll	Jump to dropped file
Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\{99f02b5e-0c7c-d542-ad44-27ce9be55c97}\SET97A6.tmp	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.8.0\SharpCompress.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nst47D0.tmp\nsDialogs.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.8.0\libwin.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.8.0\System.Linq.Queryable.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.8.0\Hardcodet.Wpf.TaskbarNotification.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.8.0\System.Diagnostics.StackTrace.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\driver\tap0901.sys	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nst47D0.tmp\System.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.8.0\System.Security.AccessControl.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.8.0\System.Resources.Reader.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.8.0\System.Runtime.Numerics.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.8.0\System.Security.Cryptography.Encoding.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.8.0\System.Runtime.InteropServices.RuntimeInformation.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.8.0\Microsoft.AppCenter.Analytics.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\haxGhXjmBFM\app-3.8.0\LetsPROCHS.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\haxGhXjmBFM\app-3.8.0\msvcp100.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.8.0\System.Diagnostics.Contracts.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.8.0\SQLitePCLRaw.provider.dynamic_cdecl.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.8.0\System.Diagnostics.FileVersionInfo.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.8.0\System.Collections.Specialized.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.8.0\System.Security.Cryptography.ProtectedData.dll	Jump to dropped file
Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\{99f02b5e-0c7c-d542-ad44-27ce9be55c97}\tap0901.sys (copy)	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.8.0\System.Resources.ResourceManager.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.8.0\System.IO.Pipes.AccessControl.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.8.0\System.Console.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.8.0\SuperSocket.ClientEngine.dll	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	Dropped PE file which has not been started: C:\Windows\System32\drivers\tap0901.sys (copy)	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.8.0\System.Collections.NonGeneric.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.8.0\System.Globalization.Extensions.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI3E0E.tmp	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.8.0\SQLiteNetExtensionsAsync.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.8.0\System.Xml.XmlDocument.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.8.0\System.Security.Principal.Windows.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.8.0\System.Net.NetworkInformation.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.8.0\Microsoft.Win32.Registry.AccessControl.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.8.0\System.ServiceModel.Security.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsVPNInfraStructure.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.8.0\CommunityToolkit.Mvvm.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.8.0\System.Security.Permissions.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.8.0\System.Runtime.CompilerServices.VisualC.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.8.0\System.Runtime.Extensions.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.8.0\System.Buffers.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.8.0\System.Security.Cryptography.Xml.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.8.0\System.ServiceModel.Syndication.dll	Jump to dropped file
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Dropped PE file which has not been started: C:\Program Files (x86)\letsvpn\app-3.8.0\System.Security.Cryptography.Csp.dll	Jump to dropped file

Source: C:\Program Files (x86)\haxGhXjmBFM\app-3.8.0\LetsPRO.exe

Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess

graph_5-27452

Source: C:\Program Files (x86)\haxGhXjmBFM\LetsPRO.exe	API coverage: 8.0 %
Source: C:\Program Files (x86)\haxGhXjmBFM\app-3.8.0\LetsPRO.exe	API coverage: 3.8 %
Source: C:\Program Files (x86)\haxGhXjmBFM\app-3.8.0\LetsPRO.exe	API coverage: 4.4 %

Source: C:\Program Files (x86)\Common Files\wegame.exe TID: 7804	Thread sleep time: -35595s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 8088	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7172	Thread sleep time: -30000s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 8476	Thread sleep time: -5534023222112862s >= -30000s
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe TID: 8828	Thread sleep time: -30000s >= -30000s
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe TID: 8916	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe TID: 8892	Thread sleep time: -2767011611056431s >= -30000s
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe TID: 8964	Thread sleep time: -6300000s >= -30000s

Source: C:\Program Files (x86)\Common Files\wegame.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT SerialNumber FROM Win32_BaseBoard
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_BaseBoard
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select SerialNumber From Win32_BIOS
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT SerialNumber FROM Win32_BIOS
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT SerialNumber FROM Win32_BIOS
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_BaseBoard
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT SerialNumber FROM Win32_BaseBoard

Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT UUID FROM Win32_ComputerSystemProduct
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystemProduct
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT UUID FROM Win32_ComputerSystemProduct
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystemProduct
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem

Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select ProcessorID From Win32_processor
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select ProcessorId From Win32_Processor
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select Manufacturer From Win32_Processor
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Processor
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select ProcessorID From Win32_processor
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select Manufacturer From Win32_Processor
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select ProcessorId From Win32_Processor

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Program Files (x86)\Common Files\wegame.exe

Thread sleep count: Count: 7119 delay: -5

Jump to behavior

Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File Volume queried: C:\Program Files (x86) FullSizeInformation	Jump to behavior
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	File Volume queried: C:\Program Files (x86) FullSizeInformation	Jump to behavior

Source: C:\Program Files (x86)\haxGhXjmBFM\LetsPRO.exe	Code function: 3_2_00BC4318 __EH_prolog3_GS,FindFirstFileW,FindNextFileW,FindClose,std::ios_base::_Ios_base_dtor,	3_2_00BC4318
Source: C:\Program Files (x86)\haxGhXjmBFM\app-3.8.0\LetsPRO.exe	Code function: 5_2_00404F4D __EH_prolog3,GetFullPathNameW,PathIsUNCW,GetVolumeInformationW,CharUpperW,FindFirstFileW,FindClose,lstrlenW,	5_2_00404F4D
Source: C:\Program Files (x86)\Common Files\wegame.exe	Code function: 6_2_0045CBDF __EH_prolog3_GS,memset,GetModuleFileNameW,?filename@path@filesystem@ierd_tgp@@QBE?AV123@XZ,?parent_path@path@filesystem@ierd_tgp@@QBE?AV123@XZ,memset,FindFirstFileW,memset,wcsncpy_s,wcsncat_s,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindClose,	6_2_0045CBDF
Source: C:\Program Files (x86)\Common Files\wegame.exe	Code function: 6_2_004570C9 __EH_prolog3_GS,memset,memset,FindFirstFileW,memset,wcscmp,wcscmp,memset,DeleteFileW,?get_log_instance@base@@YAPAVILogger@1@XZ,GetLastError,FindNextFileW,FindClose,RemoveDirectoryW,?get_log_instance@base@@YAPAVILogger@1@XZ,GetLastError,	6_2_004570C9
Source: C:\Program Files (x86)\Common Files\wegame.exe	Code function: 6_2_00457307 __EH_prolog3_GS,memset,GetEnvironmentVariableW,?get_log_instance@base@@YAPAVILogger@1@XZ,memset,GetModuleFileNameW,wcsrchr,SimpleUString::operator=,memset,GetFileAttributesW,memset,memset,FindFirstFileW,memset,wcscmp,SimpleUString::operator=,wcscmp,wcscmp,FindNextFileW,FindClose,?get_log_instance@base@@YAPAVILogger@1@XZ,	6_2_00457307
Source: C:\Program Files (x86)\Common Files\wegame.exe	Code function: 6_2_0040F710 _invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,memset,FindFirstFileW,wcscpy_s,_invalid_parameter_noinfo_noreturn,	6_2_0040F710
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Code function: 8_2_004059CC GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	8_2_004059CC
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Code function: 8_2_004065FD FindFirstFileW,FindClose,	8_2_004065FD
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Code function: 8_2_00402868 FindFirstFileW,	8_2_00402868
Source: C:\Program Files (x86)\haxGhXjmBFM\app-3.8.0\LetsPRO.exe	Code function: 10_2_00404F4D __EH_prolog3,GetFullPathNameW,PathIsUNCW,GetVolumeInformationW,CharUpperW,FindFirstFileW,FindClose,lstrlenW,	10_2_00404F4D

Source: C:\Program Files (x86)\haxGhXjmBFM\app-3.8.0\LetsPRO.exe

Code function: 5_2_004201A0 VirtualQuery,GetSystemInfo,__invoke_watson,GetModuleHandleA,GetProcAddress,VirtualAlloc,VirtualProtect,

5_2_004201A0

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Thread delayed: delay time: 300000

Source: wegame.exe, 00000006.00000002.4142318714.000000006C825000.00000002.00000001.01000000.00000008.sdmp	Binary or memory string: WQLSELECT * FROM Win32_NetworkAdapterConfiguration WHERE IPEnabled=TRUEroot\cimv2Win32_NetworkAdapterConfigurationSetDNSServerSearchOrderDNSServerSearchOrderIndexCaptionvmwarevirtualWin32_NetworkAdapterConfiguration.Index=%d[repair_dns] success.
Source: LetsPRO.exe, 00000037.00000002.4192171082.0000000034D36000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V Dynamic Memory Integration Service
Source: LetsPRO.exe, 00000037.00000002.4143541172.0000000003648000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Remove-NetEventVmNetworkAdapter
Source: LetsPRO.exe, 00000037.00000002.4187562856.0000000034BA4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: AlDHyper-V Virtual Machine Bus Pipes_\
Source: LetsPRO.exe, 00000037.00000002.4193390857.0000000034E0D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: X2Hyper-V VM Vid Partition
Source: LetsPRO.exe, 00000037.00000002.4187562856.0000000034C3C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware, Inc.
Source: svchost.exe, 00000025.00000003.1947828604.000001CB07517000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: "@ethernetwlanppipvmnetextension7A}
Source: LetsPRO.exe, 00000037.00000002.4190761918.0000000034CB1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: THyper-V Hypervisor Root Virtual Processor
Source: LetsPRO.exe, 00000037.00000002.4187562856.0000000034C3C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: stringComputer System ProductComputer System Product52Z18771434D56-1548-ED3D-AEE6-C75AECD93BF0VMware, Inc.Noney*
Source: LetsPRO.exe, 0000000A.00000002.1718865144.0000000000679000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllR
Source: LetsPRO.exe, 0000000B.00000002.1719096774.0000000000589000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllS
Source: LetsPRO.exe, 00000037.00000002.4187562856.0000000034ADD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: &Hyper-V Hypervisor
Source: svchost.exe, 0000000E.00000002.4142337286.00000177F8E5A000.00000004.00000020.00020000.00000000.sdmp, LetsPRO.exe, 00000037.00000002.4165069289.0000000006110000.00000004.00000020.00020000.00000000.sdmp, LetsPRO.exe, 00000037.00000002.4180752320.00000000309CF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: LetsPRO.exe, 00000037.00000002.4143541172.0000000003648000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $^q)Hyper-V Hypervisor Root Virtual Processor
Source: LetsPRO.exe, 00000037.00000002.4203867264.0000000037DBA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VHyper-V Dynamic Memory Integration Service0S
Source: LetsPRO.exe, 00000037.00000002.4187562856.0000000034BA4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: sWDHyper-V Hypervisor Root Partition']2d
Source: LetsPRO.exe, 00000037.00000002.4143541172.0000000003648000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Get-NetEventVmNetworkAdapter
Source: LetsPRO.exe, 00000037.00000002.4143541172.0000000003648000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V VM Vid Partition
Source: LetsPRO.exe, 00000037.00000002.4137864478.00000000016E4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V xvwtwlbhtgklnyc Bus
Source: LetsPRO.exe, 00000037.00000002.4137864478.0000000001654000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V xvwtwlbhtgklnyc Bus PipesI
Source: wegame.exe, 00000006.00000002.4138012300.0000000000762000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000038.00000002.4137542306.00000249B2069000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: LetsPRO.exe, 00000037.00000002.4166122797.00000000061A4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWc
Source: LetsPRO.exe, 00000037.00000002.4143541172.0000000003648000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $^q$Hyper-V Hypervisor Logical Processor
Source: lets-test.msi	Binary or memory string: S-1-0Null AuthorityS-1-0-0NobodyS-1-1World AuthorityS-1-2Local AuthorityS-1-2-0LocalS-1-2-1Console LogonS-1-3Creator AuthorityS-1-3-0Creator OwnerS-1-3-1Creator GroupS-1-3-2Creator Owner ServerS-1-3-3Creator Group ServerS-1-5-80-0All ServicesS-1-4Non-unique AuthorityS-1-5NT AuthorityS-1-5-1DialupS-1-5-2NetworkS-1-5-3BatchS-1-5-4InteractiveS-1-5-6ServiceS-1-5-7AnonymousS-1-5-8ProxyS-1-5-9Enterprise Domain ControllersS-1-5-10Principal SelfS-1-5-11Authenticated UsersS-1-5-12Restricted CodeS-1-5-13Terminal Server UsersS-1-5-14Remote Interactive LogonS-1-5-15This OrganizationS-1-5-17Local SystemS-1-5-19S-1-5-20AdministratorsS-1-5-32-545UsersS-1-5-32-546GuestsS-1-5-32-547Power UsersS-1-5-32-548Account OperatorsS-1-5-32-549Server OperatorsS-1-5-32-550Print OperatorsS-1-5-32-551Backup OperatorsS-1-5-32-552ReplicatorsS-1-5-64-10NTLM AuthenticationS-1-5-64-14SChannel AuthenticationS-1-5-64-21Digest AuthenticationS-1-5-80NT ServiceS-1-5-83-0NT VIRTUAL MACHINE\Virtual MachinesS-1-16-0Untrusted Mandatory LevelS-1-16-4096Low Mandatory LevelS-1-16-8192Medium Mandatory LevelS-1-16-8448Medium Plus Mandatory LevelS-1-16-12288High Mandatory LevelS-1-16-16384System Mandatory LevelS-1-16-20480Protected Process Mandatory LevelS-1-16-28672Secure Process Mandatory LevelS-1-5-32-554BUILTIN\Pre-Windows 2000 Compatible AccessS-1-5-32-555BUILTIN\Remote Desktop UsersS-1-5-32-556BUILTIN\Network Configuration OperatorsS-1-5-32-557BUILTIN\Incoming Forest Trust BuildersS-1-5-32-558BUILTIN\Performance Monitor UsersS-1-5-32-559BUILTIN\Performance Log UsersS-1-5-32-560BUILTIN\Windows Authorization Access GroupS-1-5-32-561BUILTIN\Terminal Server License ServersS-1-5-32-562BUILTIN\Distributed COM UsersS-1-5-32-569BUILTIN\Cryptographic OperatorsS-1-5-32-573BUILTIN\Event Log ReadersS-1-5-32-574BUILTIN\Certificate Service DCOM AccessS-1-5-32-575BUILTIN\RDS Remote Access ServersS-1-5-32-576BUILTIN\RDS Endpoint ServersS-1-5-32-577BUILTIN\RDS Management ServersS-1-5-32-578BUILTIN\Hyper-V AdministratorsS-1-5-32-579BUILTIN\Access Control Assistance Operators
Source: wegame.exe	Binary or memory string: vmware
Source: LetsPRO.exe, 00000037.00000002.4143541172.0000000003648000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $^q*Hyper-V Dynamic Memory Integration Service
Source: LetsPRO.exe, 00000037.00000002.4190761918.0000000034CB1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: JHyper-V Hypervisor Logical Processor
Source: svchost.exe, 0000000E.00000002.4138873670.00000177F382B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWP
Source: LetsPRO.exe, 00000037.00000002.4143541172.0000000003648000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Add-NetEventVmNetworkAdapter
Source: svchost.exe, 00000025.00000003.1947598417.000001CB07521000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: (@vmnetextension
Source: LetsPRO.exe, 00000037.00000002.4143541172.0000000003648000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $^q!Hyper-V Hypervisor Root Partition
Source: svchost.exe, 00000038.00000002.4137207566.00000249B2000000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: HvHostWdiSystemHostScDeviceEnumWiaRpctrkwksAudioEndpointBuilderhidservdot3svcUmRdpServiceDsSvcfhsvcvmickvpexchangevmicshutdownvmicguestinterfacevmicvmsessionsvsvcStorSvcWwanSvcvmicvssDevQueryBrokerNgcSvcsysmainNetmanTabletInputServicePcaSvcDisplayEnhancementServiceIPxlatCfgSvcDeviceAssociationServiceNcbServiceEmbeddedModeSensorServicewlansvcCscServiceWPDBusEnumMixedRealityOpenXRSvc
Source: LetsPRO.exe, 00000005.00000002.1724458157.0000000000500000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllL
Source: svchost.exe, 00000025.00000003.1947985539.000001CB0753A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: @vmnetextension
Source: LetsPRO.exe, 00000037.00000002.4143541172.0000000003648000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V Hypervisor
Source: LetsPRO.exe, 00000037.00000002.4143541172.0000000003648000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $^q!Hyper-V Virtual Machine Bus Pipes

Source: C:\Program Files (x86)\haxGhXjmBFM.exe

API call chain: ExitProcess graph end node

Source: C:\Windows\System32\msiexec.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Found API chain indicative of debugger detection

Source: C:\Program Files (x86)\Common Files\wegame.exe

Debugger detection routine: GetTickCount, GetTickCount, DecisionNodes, ExitProcess or Sleep

graph_6-74613

Source: C:\Program Files (x86)\haxGhXjmBFM\LetsPRO.exe

Code function: 3_2_00BCDAD2 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

3_2_00BCDAD2

Source: C:\Program Files (x86)\Common Files\wegame.exe

Code function: 6_2_004660C6 __EH_prolog3_catch_GS,GetCommandLineW,SimpleUString::operator=,MessageBoxA,strcmp,?stamp_init@@YAXXZ,?stamp_point@@YAXPBD@Z,?get_log_instance@base@@YAPAVILogger@1@XZ,?u16to8@common@ierd_tgp@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@4@@Z,?get_client_id@util_client_info@ierd_tgp@@YAHXZ,?extract_op_from_cmd@Sys_wrapper@common@ierd_tgp@@SA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PAV45@@Z,?get_process_count@util_multi_instance@ierd_tgp@@YAHPBD@Z,?set_same_client_type_multi_instance@util_multi_instance@ierd_tgp@@YAX_N@Z,?get_qos_instance@qos@adapt_for_imports@ierd_tgp@@YAAAVQos@123@XZ,?SetIsMultiInstance@Qos@qos@adapt_for_imports@ierd_tgp@@QAEX_N@Z,?get_coexist_name@util_multi_instance@ierd_tgp@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PBD@Z,OutputDebugStringA,CreateMutexA,GetLastError,?get_coexist_name@util_multi_instance@ierd_tgp@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PBD@Z,OpenEventA,SetEvent,CloseHandle,CloseHandle,CloseHandle,CloseHandle,?get_log_instance@base@@YAPAVILogger@1@XZ,GetCurrentProcess,TerminateProcess,?sync_proxy_settings@client_helper@net@ierd_tgp@@YAXXZ,_stricmp,_stricmp,?enable_static_detail_log@common@ierd_tgp@@YAX_N@Z,_stricmp,?enable_profile_on@common@ierd_tgp@@YAX_N@Z,_stricmp,?enable_offline_mode_on@common@ierd_tgp@@YAX_N@Z,_stricmp,?set_restart_after_update@common@ierd_tgp@@YAX_N@Z,?set_quick_login_uin@common@ierd_tgp@@YAXK@Z,?set_start_from_host@common@ierd_tgp@@YAX_N@Z,?extract_op_from_cmd@Sys_wrapper@common@ierd_tgp@@SA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PAV45@@Z,?enable_offline_mode_on@common@ierd_tgp@@YAX_N@Z,?set_offline_login_account@common@ierd_tgp@@YAX_K@Z,GetCommandLineW,?u16to8@common@ierd_tgp@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@4@@Z,?set_game_launcher_flag@common@ierd_tgp@@YAX_N@Z,?set_game_launcher_msg@common@ierd_tgp@@YAXAAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z,?get_log_instance@base@@YAPAVILogger@1@XZ,?get_log_instance@base@@YAPAVILogger@1@XZ,?get_log_instance@base@@YAPAVILogger@1@XZ,?get_log_instance@base@@YAPAVILogger@1@XZ,?get_qos_instance@qos@adapt_for_imports@ierd_tgp@@YAAAVQos@123@XZ,?set_launcher_info@Qos@qos@adapt_for_imports@ierd_tgp@@QAEXAAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@_K@Z,?get_log_instance@base@@YAPAVILogger@1@XZ,?get_log_instance@base@@YAPAVILogger@1@XZ,?is_offline_mode_on@common@ierd_tgp@@YA_NXZ,?set_game_launcher_flag@common@ierd_tgp@@YAX_N@Z,?set_game_launcher_msg@common@ierd_tgp@@YAXAAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z,?get_log_instance@base@@YAPAVILogger@1@XZ,?IsSubWegameProcess@util_multi_instance@ierd_tgp@@YA_NXZ,PathFileExistsW,PathFileExistsW,DeleteFileW,PathFileExistsW,?get_log_instance@base@@YAPAVILogge

6_2_004660C6

Source: C:\Program Files (x86)\Common Files\wegame.exe

6_2_0045B61D

Source: C:\Program Files (x86)\haxGhXjmBFM\app-3.8.0\LetsPRO.exe

Code function: 5_2_0042C3DA LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,__invoke_watson,GetProcAddress,GetProcAddress,__invoke_watson,

5_2_0042C3DA

Source: C:\Program Files (x86)\haxGhXjmBFM\LetsPRO.exe	Code function: 3_2_00BD5217 mov eax, dword ptr fs:[00000030h]		3_2_00BD5217
Source: C:\Program Files (x86)\haxGhXjmBFM\LetsPRO.exe	Code function: 3_2_00BCEDE2 mov eax, dword ptr fs:[00000030h]		3_2_00BCEDE2

Source: C:\Program Files (x86)\haxGhXjmBFM\LetsPRO.exe

Code function: 3_2_00BD605E GetProcessHeap,

3_2_00BD605E

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process token adjusted: Debug

Source: C:\Windows\System32\msiexec.exe

Process created: C:\Program Files (x86)\haxGhXjmBFM\LetsPRO.exe "C:\Program Files (x86)\haxGhXjmBFM\LetsPRO.exe"

Jump to behavior

Source: C:\Program Files (x86)\haxGhXjmBFM\LetsPRO.exe	Code function: 3_2_00BCDAD2 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_00BCDAD2
Source: C:\Program Files (x86)\haxGhXjmBFM\LetsPRO.exe	Code function: 3_2_00BC8A28 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_00BC8A28
Source: C:\Program Files (x86)\haxGhXjmBFM\LetsPRO.exe	Code function: 3_2_00BC8E32 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_00BC8E32
Source: C:\Program Files (x86)\haxGhXjmBFM\LetsPRO.exe	Code function: 3_2_00BC8FC5 SetUnhandledExceptionFilter,	3_2_00BC8FC5
Source: C:\Program Files (x86)\haxGhXjmBFM\app-3.8.0\LetsPRO.exe	Code function: 5_2_00420004 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	5_2_00420004
Source: C:\Program Files (x86)\haxGhXjmBFM\app-3.8.0\LetsPRO.exe	Code function: 5_2_00420965 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	5_2_00420965
Source: C:\Program Files (x86)\haxGhXjmBFM\app-3.8.0\LetsPRO.exe	Code function: 5_2_00426DF8 _raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	5_2_00426DF8
Source: C:\Program Files (x86)\haxGhXjmBFM\app-3.8.0\LetsPRO.exe	Code function: 5_2_00423ED8 SetUnhandledExceptionFilter,	5_2_00423ED8
Source: C:\Program Files (x86)\Common Files\wegame.exe	Code function: 6_2_0046823B SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	6_2_0046823B
Source: C:\Program Files (x86)\Common Files\wegame.exe	Code function: 6_2_00468F3B IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	6_2_00468F3B
Source: C:\Program Files (x86)\Common Files\wegame.exe	Code function: 6_2_0046909D SetUnhandledExceptionFilter,	6_2_0046909D
Source: C:\Program Files (x86)\Common Files\wegame.exe	Code function: 6_2_6C576C97 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	6_2_6C576C97
Source: C:\Program Files (x86)\Common Files\wegame.exe	Code function: 6_2_6C502171 SetUnhandledExceptionFilter,	6_2_6C502171
Source: C:\Program Files (x86)\Common Files\wegame.exe	Code function: 6_2_6C575E82 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	6_2_6C575E82
Source: C:\Program Files (x86)\haxGhXjmBFM\app-3.8.0\LetsPRO.exe	Code function: 10_2_00420004 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	10_2_00420004
Source: C:\Program Files (x86)\haxGhXjmBFM\app-3.8.0\LetsPRO.exe	Code function: 10_2_00420965 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	10_2_00420965
Source: C:\Program Files (x86)\haxGhXjmBFM\app-3.8.0\LetsPRO.exe	Code function: 10_2_00426DF8 _raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	10_2_00426DF8
Source: C:\Program Files (x86)\haxGhXjmBFM\app-3.8.0\LetsPRO.exe	Code function: 10_2_00423ED8 SetUnhandledExceptionFilter,	10_2_00423ED8

Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe

Memory allocated: page read and write | page guard

HIPS / PFW / Operating System Protection Evasion

Bypasses PowerShell execution policy

Source: C:\Program Files (x86)\haxGhXjmBFM.exe

Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe -inputformat none -ExecutionPolicy Bypass -Command "If ($env:PROCESSOR_ARCHITEW6432) { $env:PROCESSOR_ARCHITEW6432 } Else { $env:PROCESSOR_ARCHITECTURE }"

Executes Lua script

Source: C:\Windows\System32\msiexec.exe

File Created: C:\Program Files (x86)\Common Files\Lua51.dll

Jump to behavior

Maps a DLL or memory area into another process

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Section loaded: NULL target: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe protection: readonly

Source: C:\Program Files (x86)\haxGhXjmBFM\LetsPRO.exe	Process created: C:\Program Files (x86)\haxGhXjmBFM\app-3.8.0\LetsPRO.exe "C:\Program Files (x86)\haxGhXjmBFM\app-3.8.0\LetsPRO.exe"	Jump to behavior
Source: C:\Program Files (x86)\haxGhXjmBFM\LetsPRO.exe	Process created: C:\Program Files (x86)\haxGhXjmBFM\app-3.8.0\LetsPRO.exe "C:\Program Files (x86)\haxGhXjmBFM\app-3.8.0\LetsPRO.exe"	Jump to behavior
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe -inputformat none -ExecutionPolicy Bypass -Command "If ($env:PROCESSOR_ARCHITEW6432) { $env:PROCESSOR_ARCHITEW6432 } Else { $env:PROCESSOR_ARCHITECTURE }"	Jump to behavior
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -inputformat none -ExecutionPolicy Bypass -File "C:\Program Files (x86)\letsvpn\AddWindowsSecurityExclusion.ps1"	Jump to behavior
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Process created: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe "C:\Program Files (x86)\letsvpn\driver\tapinstall.exe" findall tap0901	Jump to behavior
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Process created: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe "C:\Program Files (x86)\letsvpn\driver\tapinstall.exe" install "C:\Program Files (x86)\letsvpn\driver\OemVista.inf" tap0901	Jump to behavior
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c netsh advfirewall firewall Delete rule name=lets	Jump to behavior
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c netsh advfirewall firewall Delete rule name=lets.exe	Jump to behavior
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c netsh advfirewall firewall Delete rule name=LetsPRO.exe	Jump to behavior
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c netsh advfirewall firewall Delete rule name=LetsPRO	Jump to behavior
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Process created: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe "C:\Program Files (x86)\letsvpn\driver\tapinstall.exe" findall tap0901	Jump to behavior
Source: C:\Program Files (x86)\haxGhXjmBFM\LetsPRO.exe	Process created: C:\Program Files (x86)\haxGhXjmBFM\app-3.8.0\LetsPRO.exe "C:\Program Files (x86)\haxGhXjmBFM\app-3.8.0\LetsPRO.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall Delete rule name=lets
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall Delete rule name=lets.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall Delete rule name=LetsPRO.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall Delete rule name=LetsPRO
Source: C:\Program Files (x86)\letsvpn\LetsPRO.exe	Process created: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe "C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe"
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C ipconfig /all
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C route print
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /all
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown

Source: LetsPRO.exe, 00000037.00000002.4201314539.0000000037A82000.00000002.00000001.01000000.00000033.sdmp	Binary or memory string: Shell_TrayWnd
Source: LetsPRO.exe, 00000037.00000002.4268427872.000000006852B000.00000002.00000001.01000000.00000024.sdmp	Binary or memory string: AddFontResourceWAdjustWindowRectAlready ReportedAssocIsDangerousAuditSetSecurityBITMAPINFOHEADERBringWindowToTopCRYPT_OBJID_BLOBCertControlStoreCheckRadioButtonCloseEnhMetaFileCoCreateInstanceCoGetCallContextCoGetInterceptorCoMarshalHresultCoTaskMemReallocCombineTransformConnectNamedPipeContent-EncodingContent-LanguageContent-Length: CopyEnhMetaFileWCreateDIBSectionCreateDirectoryWCreateHatchBrushCreateIpNetEntryCreateJobObjectWCreateMDIWindowWCreateNamedPipeWCreatePolygonRgnCreateSemaphoreWCreateSolidBrushCreateTimerQueueCryptDestroyHashCryptExportPKCS8CryptGetKeyParamCryptMsgGetParamCryptProtectDataCryptQueryObjectCryptSetKeyParamDAD_SetDragImageDPA_EnumCallbackDdeQueryConvInfoDdeSetUserHandleDeactivateActCtxDefMDIChildProcWDefineDosDeviceWDeleteColorSpaceDeleteIpNetEntryDeleteTimerQueueDestination-PortDispatchMessageWDnsNameCompare_WDrawCaptionTempWDrawFrameControlDuplicateTokenExEndBufferedPaintEngCreatePaletteEngDeletePaletteEngDeleteSurfaceEngGetDriverNameEngStretchBltROPEngUnlockSurfaceEnumChildWindowsEnumICMProfilesWExcludeUpdateRgnExtSelectClipRgnFONTOBJ_vGetInfoFRAME_SIZE_ERRORFindFirstFreeAceFindFirstVolumeWFlushFileBuffersGC scavenge waitGC worker (idle)GODEBUG: value "GdiGetBatchLimitGdiIsMetaPrintDCGdiSetBatchLimitGetAsyncKeyStateGetBestInterfaceGetCalendarInfoWGetClassLongPtrWGetClipboardDataGetComputerNameWGetConsoleAliasWGetConsoleTitleWGetConsoleWindowGetCurrentActCtxGetCurrentObjectGetCurrentThreadGetDIBColorTableGetDesktopWindowGetDllDirectoryWGetExpandedNameWGetFileSecurityWGetFullPathNameWGetGUIThreadInfoGetGestureConfigGetGlyphIndicesWGetGlyphOutlineWGetInterfaceInfoGetIpErrorStringGetKerningPairsWGetKeyboardStateGetLastInputInfoGetLogicalDrivesGetLongPathNameWGetMenuItemCountGetMenuItemInfoWGetMenuPosFromIDGetModuleHandleWGetNamedPipeInfoGetNetworkParamsGetOpenFileNameWGetPriorityClassGetProgmanWindowGetSaveFileNameWGetScrollBarInfoGetStringScriptsGetSysColorBrushGetSystemMetricsGetTaskmanWindowGetTcpStatisticsGetTempFileNameWGetThemeFilenameGetThemePartSizeGetThemePositionGetThemeSysColorGetThreadDesktopGetUdpStatisticsGetViewportExtExGetViewportOrgExGlobalDeleteAtomHANIMATIONBUFFERHost-Remote-ListIConnectionPointICreateErrorInfoILLoadFromStreamINTERFACE_HANDLEIOleAdviseHolderIOleInPlaceFrameIP_PREFIX_ORIGINIP_SUFFIX_ORIGINIPropertyStorageIUnknown_GetSiteIUnknown_SetSiteI_CryptDetachTlsI_RpcSendReceiveIcmpParseRepliesImageList_CreateImageList_DrawExImageList_RemoveImmConfigureIMEWImmCreateContextImmGetGuideLineWImmGetOpenStatusImmGetVirtualKeyImmRegisterWordWImmSetOpenStatusImperial_AramaicInitializeFlatSBInstRuneAnyNotNLInterfaceRemovedIntlStrEqWorkerWIpReleaseAddressIsBadHugeReadPtrIsDBCSLeadByteExIsDialogMessageWIsTokenUntrustedIsValidInterfaceJasonMarshalFailK32EnumProcessesLCIDToLocaleNameLPFNVIEWCALLBACKLPPERSISTSTORAGELPPRINTPAGERANGELPSHELLFLAGSTATELPSHFILEOPSTRUCTLPWPUPOSTMESSAGELPWSANSCLASSINFOLocalLinkAddressLocaleNameToLCIDLockWindowUpdateMIB_IPADDRROW_XPMIB_IPFORWARDROWMapVirtualKeyExWMeroitic_CursiveMonitorF

Source: C:\Program Files (x86)\haxGhXjmBFM\LetsPRO.exe

Code function: 3_2_00BC8C8B cpuid

3_2_00BC8C8B

Source: C:\Program Files (x86)\haxGhXjmBFM\LetsPRO.exe	Code function: EnumSystemLocalesW,	3_2_00BD8096
Source: C:\Program Files (x86)\haxGhXjmBFM\LetsPRO.exe	Code function: EnumSystemLocalesW,	3_2_00BD808C
Source: C:\Program Files (x86)\haxGhXjmBFM\LetsPRO.exe	Code function: EnumSystemLocalesW,	3_2_00BD80E1
Source: C:\Program Files (x86)\haxGhXjmBFM\LetsPRO.exe	Code function: GetLocaleInfoW,	3_2_00BD219D
Source: C:\Program Files (x86)\haxGhXjmBFM\LetsPRO.exe	Code function: EnumSystemLocalesW,	3_2_00BD817C
Source: C:\Program Files (x86)\haxGhXjmBFM\LetsPRO.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	3_2_00BD8207
Source: C:\Program Files (x86)\haxGhXjmBFM\LetsPRO.exe	Code function: EnumSystemLocalesW,	3_2_00BD1CFD
Source: C:\Program Files (x86)\haxGhXjmBFM\LetsPRO.exe	Code function: GetLocaleInfoW,	3_2_00BD845C
Source: C:\Program Files (x86)\haxGhXjmBFM\LetsPRO.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	3_2_00BD8584
Source: C:\Program Files (x86)\haxGhXjmBFM\LetsPRO.exe	Code function: GetLocaleInfoW,	3_2_00BD868C
Source: C:\Program Files (x86)\haxGhXjmBFM\LetsPRO.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	3_2_00BD875F
Source: C:\Program Files (x86)\haxGhXjmBFM\app-3.8.0\LetsPRO.exe	Code function: _wcscpy_s,GetLocaleInfoW,__snprintf_s,LoadLibraryW,	5_2_004058F3
Source: C:\Program Files (x86)\haxGhXjmBFM\app-3.8.0\LetsPRO.exe	Code function: GetLocaleInfoA,	5_2_0043200D
Source: C:\Program Files (x86)\haxGhXjmBFM\app-3.8.0\LetsPRO.exe	Code function: GetThreadLocale,GetLocaleInfoA,GetACP,	5_2_00433AF1
Source: C:\Program Files (x86)\haxGhXjmBFM\app-3.8.0\LetsPRO.exe	Code function: GetThreadLocale,GetLocaleInfoA,GetACP,	5_2_00433AFF
Source: C:\Program Files (x86)\haxGhXjmBFM\app-3.8.0\LetsPRO.exe	Code function: _wcscpy_s,GetLocaleInfoW,__snprintf_s,LoadLibraryW,	10_2_004058F3
Source: C:\Program Files (x86)\haxGhXjmBFM\app-3.8.0\LetsPRO.exe	Code function: GetLocaleInfoA,	10_2_0043200D
Source: C:\Program Files (x86)\haxGhXjmBFM\app-3.8.0\LetsPRO.exe	Code function: GetThreadLocale,GetLocaleInfoA,GetACP,	10_2_00433AF1
Source: C:\Program Files (x86)\haxGhXjmBFM\app-3.8.0\LetsPRO.exe	Code function: GetThreadLocale,GetLocaleInfoA,GetACP,	10_2_00433AFF

Source: C:\Program Files (x86)\Common Files\wegame.exe

Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0

Jump to behavior

Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\haxGhXjmBFM.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Program Files (x86)\letsvpn\driver\tapinstall.exe	Queries volume information: C:\Program Files (x86)\letsvpn\driver\tap0901.cat VolumeInformation
Source: C:\Windows\System32\drvinst.exe	Queries volume information: C:\Windows\System32\DriverStore\Temp\{7fc39624-296a-4042-b309-10cc640cfd85}\tap0901.cat VolumeInformation
Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Queries volume information: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Queries volume information: C:\Program Files (x86)\letsvpn\app-3.8.0\Utils.dll VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Queries volume information: C:\Program Files (x86)\letsvpn\app-3.8.0\log4net.dll VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Queries volume information: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsVPNDomainModel.dll VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Queries volume information: C:\Program Files (x86)\letsvpn\app-3.8.0\Newtonsoft.Json.dll VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Queries volume information: C:\Program Files (x86)\letsvpn\app-3.8.0\CommunityToolkit.Mvvm.dll VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\netstandard\v4.0_2.0.0.0__cc7b13ffcd2ddd51\netstandard.dll VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Queries volume information: C:\Program Files (x86)\letsvpn\app-3.8.0\System.Runtime.InteropServices.RuntimeInformation.dll VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Queries volume information: C:\Program Files (x86)\letsvpn\app-3.8.0\System.Memory.dll VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Queries volume information: C:\Program Files (x86)\letsvpn\app-3.8.0\System.Runtime.CompilerServices.Unsafe.dll VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Queries volume information: C:\Program Files (x86)\letsvpn\app-3.8.0\System.Buffers.dll VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Queries volume information: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsVPNInfraStructure.dll VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Queries volume information: C:\Program Files (x86)\letsvpn\app-3.8.0\Microsoft.AppCenter.Analytics.dll VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Queries volume information: C:\Program Files (x86)\letsvpn\app-3.8.0\Microsoft.AppCenter.dll VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Queries volume information: C:\Program Files (x86)\letsvpn\app-3.8.0\Microsoft.AppCenter.Crashes.dll VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Queries volume information: C:\Program Files (x86)\letsvpn\app-3.8.0\SQLitePCLRaw.batteries_v2.dll VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Queries volume information: C:\Program Files (x86)\letsvpn\app-3.8.0\SQLitePCLRaw.core.dll VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Queries volume information: C:\Program Files (x86)\letsvpn\app-3.8.0\SQLitePCLRaw.provider.dynamic_cdecl.dll VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Queries volume information: C:\Program Files (x86)\letsvpn\app-3.8.0\SQLitePCLRaw.nativelibrary.dll VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Deployment\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Deployment.dll VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework-SystemXml\v4.0_4.0.0.0__b77a5c561934e089\PresentationFramework-SystemXml.dll VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\UIAutomationTypes\v4.0_4.0.0.0__31bf3856ad364e35\UIAutomationTypes.dll VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\UIAutomationProvider\v4.0_4.0.0.0__31bf3856ad364e35\UIAutomationProvider.dll VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Queries volume information: C:\Program Files (x86)\letsvpn\app-3.8.0\Hardcodet.Wpf.TaskbarNotification.dll VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Queries volume information: C:\Program Files (x86)\letsvpn\app-3.8.0\PusherClient.dll VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Queries volume information: C:\Program Files (x86)\letsvpn\app-3.8.0\WebSocket4Net.dll VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Queries volume information: C:\Program Files (x86)\letsvpn\app-3.8.0\SuperSocket.ClientEngine.dll VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.WSMan.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.WSMan.Management.dll VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Queries volume information: C:\Program Files (x86)\letsvpn\app-3.8.0\SQLite-net.dll VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Queries volume information: C:\Program Files (x86)\letsvpn\app-3.8.0\System.Net.Http.dll VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.dll VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.dll VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Xml\v4.0_4.0.0.0__b77a5c561934e089\System.XML.dll VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package00~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package00~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package00~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package00~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package00~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package00~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package00~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package00~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package00~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package00~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package00~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package00~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package00~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package00~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package00~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package00~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package00~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package00~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package00~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package00~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package00~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation
Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation

Source: C:\Program Files (x86)\haxGhXjmBFM\LetsPRO.exe

Code function: 3_2_00BC9087 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

3_2_00BC9087

Source: C:\Program Files (x86)\haxGhXjmBFM\app-3.8.0\LetsPRO.exe

Code function: 5_2_0042A39B __lock,__invoke_watson,__invoke_watson,__invoke_watson,____lc_codepage_func,_strlen,__malloc_crt,_strlen,_strcpy_s,__invoke_watson,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,WideCharToMultiByte,__invoke_watson,__invoke_watson,

5_2_0042A39B

Source: C:\Program Files (x86)\haxGhXjmBFM\app-3.8.0\LetsPRO.exe

Code function: 5_2_00405B0B __EH_prolog3,GetModuleHandleW,GetModuleHandleW,GetProcAddress,GetProcAddress,ConvertDefaultLocale,ConvertDefaultLocale,ConvertDefaultLocale,GetProcAddress,ConvertDefaultLocale,GetProcAddress,ConvertDefaultLocale,GetModuleFileNameW,GetVersion,RegOpenKeyExW,RegQueryValueExW,_sscanf,ConvertDefaultLocale,ConvertDefaultLocale,GetProcAddress,ConvertDefaultLocale,RegCloseKey,GetModuleHandleW,EnumResourceLanguagesW,ConvertDefaultLocale,ConvertDefaultLocale,GetProcAddress,ConvertDefaultLocale,_memset,

5_2_00405B0B

Source: C:\Program Files (x86)\Common Files\wegame.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Modifies the windows firewall

Source: C:\Program Files (x86)\haxGhXjmBFM.exe

Process created: C:\Windows\SysWOW64\cmd.exe cmd /c netsh advfirewall firewall Delete rule name=lets

Uses netsh to modify the Windows network and firewall settings

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall Delete rule name=lets

Source: C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe

Registry key created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\CCBBF9E1485AF63CE47ABF8E9E648C2504FC319D Blob

Stealing of Sensitive Information

Modifies the DNS server

Source: C:\Windows\System32\svchost.exe

Registry value created:

Source: C:\Program Files (x86)\Common Files\wegame.exe	Code function: 6_2_0045D537 __EH_prolog3_catch_GS,?get_cfg_by_path@common@ierd_tgp@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAV?$basic_ptree@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@property_tree@boost@@_N@Z,?get_qos_instance@qos@adapt_for_imports@ierd_tgp@@YAAAVQos@123@XZ,?set_qos_id@Qos@qos@adapt_for_imports@ierd_tgp@@QAEXK@Z,?get_qos_instance@qos@adapt_for_imports@ierd_tgp@@YAAAVQos@123@XZ,?set_ver@Qos@qos@adapt_for_imports@ierd_tgp@@QAEXABUversion_t@common@4@@Z,?get_qos_instance@qos@adapt_for_imports@ierd_tgp@@YAAAVQos@123@XZ,?get_machine_id@Application@common@ierd_tgp@@SA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ,?set_machine_id@Qos@qos@adapt_for_imports@ierd_tgp@@QAEXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z,?get_qos_instance@qos@adapt_for_imports@ierd_tgp@@YAAAVQos@123@XZ,?set_qm_report_guid@Qos@qos@adapt_for_imports@ierd_tgp@@QAEXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z,?set_machine_guid_async@Application@common@ierd_tgp@@SAXXZ,?get_qos_instance@qos@adapt_for_imports@ierd_tgp@@YAAAVQos@123@XZ,?get_session_id@Application@common@ierd_tgp@@QAE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ,?set_session_id@Qos@qos@adapt_for_imports@ierd_tgp@@QAEXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z,?get_qos_instance@qos@adapt_for_imports@ierd_tgp@@YAAAVQos@123@XZ,?get_client_id@util_client_info@ierd_tgp@@YAHXZ,?set_client_version_type@Qos@qos@adapt_for_imports@ierd_tgp@@QAEXH@Z,?GetLastLoginedUin@common@ierd_tgp@@YA_KXZ,?get_qos_instance@qos@adapt_for_imports@ierd_tgp@@YAAAVQos@123@XZ,?set_uid@Qos@qos@adapt_for_imports@ierd_tgp@@QAEXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z,?get_exe_path_ex@Application@common@ierd_tgp@@SA?AVpath@filesystem@3@XZ,?parent_path@path@filesystem@ierd_tgp@@QBE?AV123@XZ,?get_qos_instance@qos@adapt_for_imports@ierd_tgp@@YAAAVQos@123@XZ,?set_channel_id@Qos@qos@adapt_for_imports@ierd_tgp@@QAEXABH@Z,?get_qos_instance@qos@adapt_for_imports@ierd_tgp@@YAAAVQos@123@XZ,?set_bind_game_id@Qos@qos@adapt_for_imports@ierd_tgp@@QAEXAB_K@Z,?extract_op_from_cmd@Sys_wrapper@common@ierd_tgp@@SA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PAH@Z,?get_qos_instance@qos@adapt_for_imports@ierd_tgp@@YAAAVQos@123@XZ,?SetStartForID@Qos@qos@adapt_for_imports@ierd_tgp@@QAEX_K@Z,	6_2_0045D537
Source: C:\Program Files (x86)\Common Files\wegame.exe	Code function: 6_2_004462AA ?to_json@jsonbind@@YAHPAXAAVValue@Json@@@Z,	6_2_004462AA
Source: C:\Program Files (x86)\Common Files\wegame.exe	Code function: 6_2_0045D63F ?get_qos_instance@qos@adapt_for_imports@ierd_tgp@@YAAAVQos@123@XZ,?set_qos_id@Qos@qos@adapt_for_imports@ierd_tgp@@QAEXK@Z,?get_qos_instance@qos@adapt_for_imports@ierd_tgp@@YAAAVQos@123@XZ,?set_ver@Qos@qos@adapt_for_imports@ierd_tgp@@QAEXABUversion_t@common@4@@Z,?get_qos_instance@qos@adapt_for_imports@ierd_tgp@@YAAAVQos@123@XZ,?get_machine_id@Application@common@ierd_tgp@@SA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ,?set_machine_id@Qos@qos@adapt_for_imports@ierd_tgp@@QAEXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z,?get_qos_instance@qos@adapt_for_imports@ierd_tgp@@YAAAVQos@123@XZ,?set_qm_report_guid@Qos@qos@adapt_for_imports@ierd_tgp@@QAEXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z,?set_machine_guid_async@Application@common@ierd_tgp@@SAXXZ,?get_qos_instance@qos@adapt_for_imports@ierd_tgp@@YAAAVQos@123@XZ,?get_session_id@Application@common@ierd_tgp@@QAE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ,?set_session_id@Qos@qos@adapt_for_imports@ierd_tgp@@QAEXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z,?get_qos_instance@qos@adapt_for_imports@ierd_tgp@@YAAAVQos@123@XZ,?get_client_id@util_client_info@ierd_tgp@@YAHXZ,?set_client_version_type@Qos@qos@adapt_for_imports@ierd_tgp@@QAEXH@Z,?GetLastLoginedUin@common@ierd_tgp@@YA_KXZ,?get_qos_instance@qos@adapt_for_imports@ierd_tgp@@YAAAVQos@123@XZ,?set_uid@Qos@qos@adapt_for_imports@ierd_tgp@@QAEXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z,?get_exe_path_ex@Application@common@ierd_tgp@@SA?AVpath@filesystem@3@XZ,?parent_path@path@filesystem@ierd_tgp@@QBE?AV123@XZ,?get_qos_instance@qos@adapt_for_imports@ierd_tgp@@YAAAVQos@123@XZ,?set_channel_id@Qos@qos@adapt_for_imports@ierd_tgp@@QAEXABH@Z,?get_qos_instance@qos@adapt_for_imports@ierd_tgp@@YAAAVQos@123@XZ,?set_bind_game_id@Qos@qos@adapt_for_imports@ierd_tgp@@QAEXAB_K@Z,?extract_op_from_cmd@Sys_wrapper@common@ierd_tgp@@SA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PAH@Z,?get_qos_instance@qos@adapt_for_imports@ierd_tgp@@YAAAVQos@123@XZ,?SetStartForID@Qos@qos@adapt_for_imports@ierd_tgp@@QAEX_K@Z,	6_2_0045D63F
Source: C:\Program Files (x86)\Common Files\wegame.exe	Code function: 6_2_00445DFD ?from_json@jsonbind@@YAHPAXABVValue@Json@@@Z,	6_2_00445DFD

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Replication Through Removable Media	331 Windows Management Instrumentation	1 LSASS Driver	1 LSASS Driver	221 Disable or Modify Tools	21 Input Capture	2 System Time Discovery	Remote Services	11 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	2 Native API	1 DLL Side-Loading	1 DLL Side-Loading	11 Deobfuscate/Decode Files or Information	LSASS Memory	11 Peripheral Device Discovery	Remote Desktop Protocol	21 Input Capture	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 Command and Scripting Interpreter	3 Windows Service	1 Access Token Manipulation	31 Obfuscated Files or Information	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	1 Clipboard Data	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	111 Registry Run Keys / Startup Folder	3 Windows Service	1 Software Packing	NTDS	178 System Information Discovery	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	1 Bootkit	112 Process Injection	1 Timestomp	LSA Secrets	1 Query Registry	SSH	Keylogging	14 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	111 Registry Run Keys / Startup Folder	1 DLL Side-Loading	Cached Domain Credentials	471 Security Software Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 File Deletion	DCSync	371 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	42 Masquerading	Proc Filesystem	3 Process Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 Modify Registry	/etc/passwd and /etc/shadow	11 Application Window Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	371 Virtualization/Sandbox Evasion	Network Sniffing	11 System Network Configuration Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	1 Access Token Manipulation	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption
Gather Victim Org Information	DNS Server	Compromise Software Supply Chain	Windows Command Shell	Scheduled Task	Scheduled Task	112 Process Injection	Keylogging	Process Discovery	Taint Shared Content	Screen Capture	DNS	Exfiltration Over Physical Medium	Resource Hijacking
Determine Physical Locations	Virtual Private Server	Compromise Hardware Supply Chain	Unix Shell	Systemd Timers	Systemd Timers	1 Bootkit	GUI Input Capture	Permission Groups Discovery	Replication Through Removable Media	Email Collection	Proxy	Exfiltration over USB	Network Denial of Service

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner
C:\Program Files (x86)\haxGhXjmBFM\app-3.8.0\LetsPROCHS.dll	100%	Joe Sandbox ML
C:\Program Files (x86)\Common Files\Lua51.dll	0%	ReversingLabs
C:\Program Files (x86)\Common Files\adapt_for_imports.dll	0%	ReversingLabs
C:\Program Files (x86)\Common Files\beacon_sdk.dll	0%	ReversingLabs
C:\Program Files (x86)\Common Files\common.dll	0%	ReversingLabs
C:\Program Files (x86)\Common Files\wegame.exe	0%	ReversingLabs
C:\Program Files (x86)\haxGhXjmBFM.exe	0%	ReversingLabs
C:\Program Files (x86)\haxGhXjmBFM\LetsPRO.exe	0%	ReversingLabs
C:\Program Files (x86)\haxGhXjmBFM\app-3.8.0\msvcp100.dll	0%	ReversingLabs
C:\Program Files (x86)\haxGhXjmBFM\app-3.8.0\msvcr100.dll	0%	ReversingLabs
C:\Program Files (x86)\letsvpn\LetsPRO.exe	0%	ReversingLabs
C:\Program Files (x86)\letsvpn\Update.exe	0%	ReversingLabs
C:\Program Files (x86)\letsvpn\app-3.8.0\CommunityToolkit.Mvvm.dll	0%	ReversingLabs
C:\Program Files (x86)\letsvpn\app-3.8.0\DeltaCompressionDotNet.MsDelta.dll	0%	ReversingLabs
C:\Program Files (x86)\letsvpn\app-3.8.0\DeltaCompressionDotNet.PatchApi.dll	0%	ReversingLabs
C:\Program Files (x86)\letsvpn\app-3.8.0\DeltaCompressionDotNet.dll	0%	ReversingLabs
C:\Program Files (x86)\letsvpn\app-3.8.0\FontAwesome.WPF.dll	0%	ReversingLabs
C:\Program Files (x86)\letsvpn\app-3.8.0\Hardcodet.Wpf.TaskbarNotification.dll	0%	ReversingLabs
C:\Program Files (x86)\letsvpn\app-3.8.0\ICSharpCode.AvalonEdit.dll	0%	ReversingLabs
C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe	3%	ReversingLabs
C:\Program Files (x86)\letsvpn\app-3.8.0\LetsVPNDomainModel.dll	0%	ReversingLabs
C:\Program Files (x86)\letsvpn\app-3.8.0\LetsVPNInfraStructure.dll	0%	ReversingLabs
C:\Program Files (x86)\letsvpn\app-3.8.0\MdXaml.dll	0%	ReversingLabs
C:\Program Files (x86)\letsvpn\app-3.8.0\Microsoft.AppCenter.Analytics.dll	0%	ReversingLabs
C:\Program Files (x86)\letsvpn\app-3.8.0\Microsoft.AppCenter.Crashes.dll	0%	ReversingLabs
C:\Program Files (x86)\letsvpn\app-3.8.0\Microsoft.AppCenter.dll	0%	ReversingLabs
C:\Program Files (x86)\letsvpn\app-3.8.0\Microsoft.Bcl.AsyncInterfaces.dll	0%	ReversingLabs
C:\Program Files (x86)\letsvpn\app-3.8.0\Microsoft.Expression.Interactions.dll	0%	ReversingLabs
C:\Program Files (x86)\letsvpn\app-3.8.0\Microsoft.Web.WebView2.Core.dll	0%	ReversingLabs
C:\Program Files (x86)\letsvpn\app-3.8.0\Microsoft.Web.WebView2.WinForms.dll	0%	ReversingLabs
C:\Program Files (x86)\letsvpn\app-3.8.0\Microsoft.Web.WebView2.Wpf.dll	0%	ReversingLabs
C:\Program Files (x86)\letsvpn\app-3.8.0\Microsoft.Win32.Primitives.dll	0%	ReversingLabs
C:\Program Files (x86)\letsvpn\app-3.8.0\Microsoft.Win32.Registry.AccessControl.dll	0%	ReversingLabs
C:\Program Files (x86)\letsvpn\app-3.8.0\Microsoft.Win32.Registry.dll	0%	ReversingLabs
C:\Program Files (x86)\letsvpn\app-3.8.0\Microsoft.Win32.SystemEvents.dll	0%	ReversingLabs
C:\Program Files (x86)\letsvpn\app-3.8.0\Mono.Cecil.Mdb.dll	0%	ReversingLabs
C:\Program Files (x86)\letsvpn\app-3.8.0\Mono.Cecil.Pdb.dll	0%	ReversingLabs
C:\Program Files (x86)\letsvpn\app-3.8.0\Mono.Cecil.Rocks.dll	0%	ReversingLabs
C:\Program Files (x86)\letsvpn\app-3.8.0\Mono.Cecil.dll	0%	ReversingLabs
C:\Program Files (x86)\letsvpn\app-3.8.0\Newtonsoft.Json.dll	0%	ReversingLabs
C:\Program Files (x86)\letsvpn\app-3.8.0\NuGet.Squirrel.dll	0%	ReversingLabs
C:\Program Files (x86)\letsvpn\app-3.8.0\PusherClient.dll	0%	ReversingLabs
C:\Program Files (x86)\letsvpn\app-3.8.0\SQLite-net.dll	0%	ReversingLabs
C:\Program Files (x86)\letsvpn\app-3.8.0\SQLiteNetExtensions.dll	0%	ReversingLabs
C:\Program Files (x86)\letsvpn\app-3.8.0\SQLiteNetExtensionsAsync.dll	0%	ReversingLabs
C:\Program Files (x86)\letsvpn\app-3.8.0\SQLitePCLRaw.batteries_v2.dll	0%	ReversingLabs
C:\Program Files (x86)\letsvpn\app-3.8.0\SQLitePCLRaw.core.dll	0%	ReversingLabs
C:\Program Files (x86)\letsvpn\app-3.8.0\SQLitePCLRaw.nativelibrary.dll	0%	ReversingLabs
C:\Program Files (x86)\letsvpn\app-3.8.0\SQLitePCLRaw.provider.dynamic_cdecl.dll	0%	ReversingLabs
C:\Program Files (x86)\letsvpn\app-3.8.0\SharpCompress.dll	0%	ReversingLabs
C:\Program Files (x86)\letsvpn\app-3.8.0\Squirrel.dll	0%	ReversingLabs
C:\Program Files (x86)\letsvpn\app-3.8.0\SuperSocket.ClientEngine.dll	0%	ReversingLabs
C:\Program Files (x86)\letsvpn\app-3.8.0\System.AppContext.dll	0%	ReversingLabs
C:\Program Files (x86)\letsvpn\app-3.8.0\System.Buffers.dll	0%	ReversingLabs

Source	Detection	Scanner	Label
https://g.live.com/odclientsettings/ProdV2.C:	0%	URL Reputation	safe
https://g.live.com/odclientsettings/Prod.C:	0%	URL Reputation	safe
https://aka.ms/pscore6lB	0%	URL Reputation	safe
https://nuget.org/nuget.exe	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
http://pesterbdd.com/images/Pester.png	0%	URL Reputation	safe
http://schemas.xmlsoap.org/soap/encoding/	0%	URL Reputation	safe
http://www.apache.org/licenses/LICENSE-2.0.html	0%	URL Reputation	safe
https://contoso.com/Icon	0%	URL Reputation	safe
http://nsis.sf.net/NSIS_ErrorError	0%	URL Reputation	safe
http://crl.micro	0%	URL Reputation	safe
http://schemas.xmlsoap.org/wsdl/	0%	URL Reputation	safe
https://www.newtonsoft.com/jsonschema	0%	URL Reputation	safe
http://ocsp.sectigo.com0	0%	URL Reputation	safe
https://contoso.com/License	0%	URL Reputation	safe
https://curl.haxx.se/docs/http-cookies.html	0%	URL Reputation	safe
http://www.openssl.org/support/faq.html	0%	URL Reputation	safe
https://contoso.com/	0%	URL Reputation	safe
http://nuget.org/NuGet.exe	0%	URL Reputation	safe
https://sectigo.com/CPS0	0%	URL Reputation	safe
http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#	0%	URL Reputation	safe
http://james.newtonking.com/projects/json	0%	URL Reputation	safe
https://chrome.cloudflare-dns.com/dns-query	0%	URL Reputation	safe
http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y	0%	URL Reputation	safe
https://intercom.help/letsvpn-world/en/articles/2907649-%E9%80%9A%E8%BF%87%E7%94%B3%E8%BF%B0%E6%89%B	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://www.winimage.com/zLibDll	0%	URL Reputation	safe
https://www.nuget.org/packages/Newtonsoft.Json.Bson	0%	URL Reputation	safe
https://aka.ms/toolkit/dotnet	0%	Avira URL Cloud	safe
https://letsvpn.world/registerterm.html	0%	Avira URL Cloud	safe
http://ue.qq.com/mur/?a=survey&b=15087&c=1&d=15272af955762c32696995ddcabc396a-s-f	0%	Avira URL Cloud	safe
https://postPost223.61.70.52	0%	Avira URL Cloud	safe
http://ue.qq.com/mur/?a=survey&b=15087&c=1&d=15272af955762c32696995ddcabc396a	0%	Avira URL Cloud	safe
https://nit.crash1ytics.com/app33/devicechecking	0%	Avira URL Cloud	safe
http://logging.apache.org/log4net/release/faq.html#trouble-EventLog	0%	Avira URL Cloud	safe
https://pngimg.com/uploads/light/light_PNG14440.png	0%	Avira URL Cloud	safe
http://crl1.comsign.co.il/crl/comsignglobalrootca.crl0	0%	Avira URL Cloud	safe
http://www.hardcodet.net/taskbar	0%	Avira URL Cloud	safe
https://intercom.help/letsvpn-world/en/articles/2830420-special-settings-for-killer-networking-produ	0%	Avira URL Cloud	safe
https://rdrt.jkjtdfbs.com/letsvpn-world/en/articles/8262690-special-settings-for-intel-connectivity-	0%	Avira URL Cloud	safe
https://d1dmgcawtbm6l9.cloudfront.net/rest-apiinvalid	0%	Avira URL Cloud	safe
https://in.appcenter.ms./logs?api-version=1.0.0	0%	Avira URL Cloud	safe
https://intercom.help/letsvpn-world/en/collections/Killer	0%	Avira URL Cloud	safe
http://ws-ap1.pusher.com/app/4fc436ef36f4026102d7?protocol=5&client=pusher-dotnet-client&version=1.1.2	0%	Avira URL Cloud	safe
http://schemas.fontawesome.io/icons/	0%	Avira URL Cloud	safe
https://intercom.help/letsvpn-world/en/articles/3081101-adjust-the-settings-for-ipv6	0%	Avira URL Cloud	safe
http://wpfanimatedgif.codeplex.com	0%	Avira URL Cloud	safe
https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6	0%	Avira URL Cloud	safe
https://nit.crash1ytics.com/app33/devicehttps://nit.crash1ytics.com/app33/deviceHu	0%	Avira URL Cloud	safe
http://crl.sectigo.com/SectigoPublicCo	0%	Avira URL Cloud	safe
https://intercom.help/letsvpn-world/en/collections/1611781-%E4%B8%AD%E6%96%87%E5%B8%AE%E5%8A%A9	0%	Avira URL Cloud	safe
http://www.winimage.com/zLibDll1.2.5	0%	Avira URL Cloud	safe
https://d1dmgcawtbm6l9.cloudfront.net/rest-apiedns_client_subnet=0.0.0.0%2F0&name=d1dmgcawtbm6l9.clo	0%	Avira URL Cloud	safe
http://acraiz.icpbrasil.gov.br/DPCacraiz.pdf0?	0%	Avira URL Cloud	safe
https://github.com/CommunityToolkit/dotnet	0%	Avira URL Cloud	safe
https://intercom.help/letsvpn-world/en/articles/2926044-what-if-i-reached-maximum-connection-limit	0%	Avira URL Cloud	safe
https://github.com/dotnet/corefx/tree/7601f4f6225089ffb291dc7d58293c7bbf5c5d4f	0%	Avira URL Cloud	safe
http://www.dnie.es/dpc0	0%	Avira URL Cloud	safe
http://crl.xrampsecurity.com/XGCA.crl0	0%	Avira URL Cloud	safe
http://crl.ver)	0%	Avira URL Cloud	safe
https://github.com/Pester/Pester	0%	Avira URL Cloud	safe
https://intercom.help/letsvpn-world/en/articles/2925752-how-to-download-letsvpn	0%	Avira URL Cloud	safe
https://nit.crash1ytics.com-	0%	Avira URL Cloud	safe
https://intercom.help/letsvpn-world/en/articles/2780068-%E5%A6%82%E4%BD%95%E4%B8%8B%E8%BD%BD%E5%BE%9	0%	Avira URL Cloud	safe
https://0.0.0.0%2F0	0%	Avira URL Cloud	safe
https://intercom.help/letsvpn-world/en/collections/1628560-help-documents	0%	Avira URL Cloud	safe
https://github.com/dotnet/corefx/tree/7601f4f6225089ffb291dc7d58293c7bbf5c5d4f8	0%	Avira URL Cloud	safe
https://nit.crash1ytics.comhttpCode=-2	0%	Avira URL Cloud	safe
https://letsvpn.world/terms.html	0%	Avira URL Cloud	safe
http://www.firmaprofesional.com/cps0	0%	Avira URL Cloud	safe
https://nit.crash1ytics.com/app33/devicehttps://nit.crash1ytics.com/app33/device	0%	Avira URL Cloud	safe
https://d1dmgcawtbm6l9.cloudfront.net/rest-api?edns_client_subnet=0.0.0.0%2F0&name=nal.fqoqehwib.com.&type=1	0%	Avira URL Cloud	safe
https://intercom.help/letsvpn-world/-N	0%	Avira URL Cloud	safe
https://letsvpn.world/privacy.html	0%	Avira URL Cloud	safe
https://in.appcenter.ms/logs?api-version=1.0.0	0%	Avira URL Cloud	safe
https://g.live.com/odclientsettings/ProdV2	0%	Avira URL Cloud	safe
https://widget.intercom.io/widget/	0%	Avira URL Cloud	safe
https://d3jb1hiazbhf2r.cloudfront.net/letsvpn-world/en/articles/8263068-how-to-delete-hosts-in-windo	0%	Avira URL Cloud	safe
https://d1dmgcawtbm6l9.cloudfront.net/rest-api?edns_client_subnet=0.0.0.0%2F0&name=chr.alipayassets.com.&type=1	0%	Avira URL Cloud	safe
https://nit.crash1ytics.com/app33/device	0%	Avira URL Cloud	safe
https://github.com/dotnet/corefx/tree/32b491939fbd125f304031c35038b1e14b4e39588	0%	Avira URL Cloud	safe
https://d3jb1hiazbhf2r.cloudfront.net/letsvpn-world/en/articles/3401886-special-settings-for-smartby	0%	Avira URL Cloud	safe
http://tqos.wegamex.com.hk/	0%	Avira URL Cloud	safe
https://github.com/JamesNK/Newtonsoft.Json	0%	Avira URL Cloud	safe
https://github.com/dotnet/corefx/tree/32b491939fbd125f304031c35038b1e14b4e3958	0%	Avira URL Cloud	safe
https://nit.crash1ytics.com	0%	Avira URL Cloud	safe
http://ocsp.sectig	0%	Avira URL Cloud	safe
https://d1dmgcawtbm6l9.cloudfront.net/rest-api?edns_client_subnet=0.0.0.0%2F0&name=nit.crash1ytics.com.&type=1	0%	Avira URL Cloud	safe
https://USUS2.Session-IdCERTIFICATE	0%	Avira URL Cloud	safe
http://acraiz.icpbrasil.gov.br/LCRacraizv2.crl0	0%	Avira URL Cloud	safe
https://clients2.googleusercontent.com/crx/blobs/Af2yII2B0rZ8cHZ0zhAQMpE5nnHa-luPaKnkV2HzRYHJSUKQp47BzdeiX0Igp7uG9ixLd9f-dn93AlqvBwPDqfl_F5H1vnj2K-nXA2wr_RToPGmP3S9lmWq3G-LCKHiOc8oAxlKa5TcGVwrsFgTq79yNDjEULjiD5Cwy/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_79_1_0.crx	0%	Avira URL Cloud	safe
https://d1dmgcawtbm6l9.cloudfront.net/rest-api	0%	Avira URL Cloud	safe
http://pki.digidentity.eu/validatie0	0%	Avira URL Cloud	safe
https://d3jb1hiazbhf2r.cloudfront.net/letsvpn-world/en/articles/8262801-special-settings-for-killer-	0%	Avira URL Cloud	safe
https://d3jb1hiazbhf2r.cloudfront.net/letsvpn-world/en/articles/8262720-special-settings-for-host-ne	0%	Avira URL Cloud	safe
https://intercom.help/letsvpn-world/en/articles/3710603-about-logging-in-out-anomalies	0%	Avira URL Cloud	safe
http://crl.m	0%	Avira URL Cloud	safe
https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96	0%	Avira URL Cloud	safe
https://in.appcenter.ms	0%	Avira URL Cloud	safe
http://crl.sectigo.com/SectigoPublicC4t	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
chrome.cloudflare-dns.com	162.159.61.3	true	false	unknown
d1dmgcawtbm6l9.cloudfront.net	3.164.160.102	true	false	unknown
sni1gl.wpc.nucdn.net	152.199.21.175	true	false	unknown
ied-tqos.wegamex.com.hk	103.7.30.61	true	false	unknown
nal.fqoqehwib.com	104.112.172.245	true	false	unknown
www.wshifen.com	103.235.46.96	true	false	unknown
socket-ap1-ingress-1471706552.ap-southeast-1.elb.amazonaws.com	54.169.168.67	true	false	unknown
www.google.com	142.250.186.164	true	false	unknown
nit.crash1ytics.com	142.242.204.31	true	false	unknown
yandex.com	77.88.55.88	true	false	unknown
tqos.wegamex.com.hk	103.7.30.83	true	false	unknown
googlehosted.l.googleusercontent.com	142.250.186.129	true	false	unknown
s-part-0032.t-0009.t-msedge.net	13.107.246.60	true	false	unknown
chr.alipayassets.com	85.222.79.57	true	false	unknown
in.appcenter.ms	unknown	unknown	false	unknown
ws-ap1.pusher.com	unknown	unknown	false	unknown
www.baidu.com	unknown	unknown	false	unknown
clients2.googleusercontent.com	unknown	unknown	false	unknown
www.yandex.com	unknown	unknown	false	unknown
crt.sectigo.com	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://ws-ap1.pusher.com/app/4fc436ef36f4026102d7?protocol=5&client=pusher-dotnet-client&version=1.1.2	false	Avira URL Cloud: safe	unknown
https://d1dmgcawtbm6l9.cloudfront.net/rest-api?edns_client_subnet=0.0.0.0%2F0&name=nal.fqoqehwib.com.&type=1	false	Avira URL Cloud: safe	unknown
https://d1dmgcawtbm6l9.cloudfront.net/rest-api?edns_client_subnet=0.0.0.0%2F0&name=chr.alipayassets.com.&type=1	false	Avira URL Cloud: safe	unknown
http://tqos.wegamex.com.hk/	false	Avira URL Cloud: safe	unknown
https://d1dmgcawtbm6l9.cloudfront.net/rest-api?edns_client_subnet=0.0.0.0%2F0&name=nit.crash1ytics.com.&type=1	false	Avira URL Cloud: safe	unknown
https://clients2.googleusercontent.com/crx/blobs/Af2yII2B0rZ8cHZ0zhAQMpE5nnHa-luPaKnkV2HzRYHJSUKQp47BzdeiX0Igp7uG9ixLd9f-dn93AlqvBwPDqfl_F5H1vnj2K-nXA2wr_RToPGmP3S9lmWq3G-LCKHiOc8oAxlKa5TcGVwrsFgTq79yNDjEULjiD5Cwy/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_79_1_0.crx	false	Avira URL Cloud: safe	unknown
https://chrome.cloudflare-dns.com/dns-query	false	URL Reputation: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://intercom.help/letsvpn-world/en/articles/2907649-%E9%80%9A%E8%BF%87%E7%94%B3%E8%BF%B0%E6%89%B	LetsPRO.exe, 00000037.00000000.2030391391.0000000000E62000.00000002.00000001.01000000.00000018.sdmp	false	Avira URL Cloud: safe	unknown
https://pngimg.com/uploads/light/light_PNG14440.png	LetsPRO.exe, 00000037.00000000.2030391391.0000000000E62000.00000002.00000001.01000000.00000018.sdmp	false	Avira URL Cloud: safe	unknown
https://aka.ms/toolkit/dotnet	LetsPRO.exe, 00000037.00000002.4167809675.0000000006742000.00000002.00000001.01000000.0000001E.sdmp	false	Avira URL Cloud: safe	unknown
http://ue.qq.com/mur/?a=survey&b=15087&c=1&d=15272af955762c32696995ddcabc396a-s-f	wegame.exe, 00000006.00000002.4137406249.0000000000476000.00000002.00000001.01000000.00000004.sdmp, wegame.exe, 00000006.00000000.1716127775.0000000000476000.00000002.00000001.01000000.00000004.sdmp	false	Avira URL Cloud: safe	unknown
http://logging.apache.org/log4net/release/faq.html#trouble-EventLog	LetsPRO.exe, 00000037.00000002.4163447409.0000000005D52000.00000002.00000001.01000000.0000001B.sdmp	false	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/ProdV2.C:	svchost.exe, 0000000E.00000003.1727303694.00000177F8D23000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1727303694.00000177F8D42000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1727303694.00000177F8D87000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1727303694.00000177F8D74000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.1727303694.00000177F8D68000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://ue.qq.com/mur/?a=survey&b=15087&c=1&d=15272af955762c32696995ddcabc396a	wegame.exe, wegame.exe, 00000006.00000002.4137406249.0000000000476000.00000002.00000001.01000000.00000004.sdmp, wegame.exe, 00000006.00000000.1716127775.0000000000476000.00000002.00000001.01000000.00000004.sdmp	false	Avira URL Cloud: safe	unknown
https://letsvpn.world/registerterm.html	LetsPRO.exe, 00000037.00000000.2030391391.0000000000E62000.00000002.00000001.01000000.00000018.sdmp	false	Avira URL Cloud: safe	unknown
https://nit.crash1ytics.com/app33/devicechecking	LetsPRO.exe, 00000037.00000002.4172640122.000000000FC86000.00000004.00001000.00020000.00000000.sdmp, LetsPRO.exe, 00000037.00000002.4173917688.000000000FD0C000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://postPost223.61.70.52	LetsPRO.exe, 00000037.00000002.4177372856.000000000FF72000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl1.comsign.co.il/crl/comsignglobalrootca.crl0	LetsPRO.exe, 00000037.00000002.4187562856.0000000034B38000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/Prod.C:	svchost.exe, 0000000E.00000003.1727303694.00000177F8CF2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://intercom.help/letsvpn-world/en/articles/2830420-special-settings-for-killer-networking-produ	LetsPRO.exe, 00000037.00000000.2030391391.0000000000E62000.00000002.00000001.01000000.00000018.sdmp	false	Avira URL Cloud: safe	unknown
http://www.hardcodet.net/taskbar	LetsPRO.exe, 00000037.00000002.4201314539.0000000037A82000.00000002.00000001.01000000.00000033.sdmp, LetsPRO.exe, 00000037.00000000.2030391391.0000000000E62000.00000002.00000001.01000000.00000018.sdmp	false	Avira URL Cloud: safe	unknown
https://d1dmgcawtbm6l9.cloudfront.net/rest-apiinvalid	LetsPRO.exe, 00000037.00000002.4268427872.000000006852B000.00000002.00000001.01000000.00000024.sdmp	false	Avira URL Cloud: safe	unknown
https://aka.ms/pscore6lB	powershell.exe, 0000000C.00000002.1728755337.00000000047A8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1728755337.0000000004799000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000018.00000002.1893721239.0000000004C11000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://rdrt.jkjtdfbs.com/letsvpn-world/en/articles/8262690-special-settings-for-intel-connectivity-	LetsPRO.exe, 00000037.00000000.2030391391.0000000000E62000.00000002.00000001.01000000.00000018.sdmp	false	Avira URL Cloud: safe	unknown
https://nuget.org/nuget.exe	powershell.exe, 00000018.00000002.1898978574.0000000005C86000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000037.00000002.4153902708.00000000045B2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://intercom.help/letsvpn-world/en/collections/Killer	LetsPRO.exe, 00000037.00000000.2030391391.0000000000E62000.00000002.00000001.01000000.00000018.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.fontawesome.io/icons/	LetsPRO.exe, 00000037.00000002.4143541172.0000000003371000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000037.00000000.2030391391.0000000000E62000.00000002.00000001.01000000.00000018.sdmp	false	Avira URL Cloud: safe	unknown
https://in.appcenter.ms./logs?api-version=1.0.0	LetsPRO.exe, 00000037.00000002.4179081431.0000000030452000.00000002.00000001.01000000.00000027.sdmp	false	Avira URL Cloud: safe	unknown
https://intercom.help/letsvpn-world/en/articles/3081101-adjust-the-settings-for-ipv6	LetsPRO.exe, 00000037.00000000.2030391391.0000000000E62000.00000002.00000001.01000000.00000018.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 0000000C.00000002.1728755337.000000000476C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000018.00000002.1893721239.0000000004C11000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000037.00000002.4143541172.0000000003371000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://wpfanimatedgif.codeplex.com	LetsPRO.exe, 00000037.00000000.2030391391.0000000000E62000.00000002.00000001.01000000.00000018.sdmp	false	Avira URL Cloud: safe	unknown
https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6	svchost.exe, 0000000E.00000003.1727303694.00000177F8D42000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://nit.crash1ytics.com/app33/devicehttps://nit.crash1ytics.com/app33/deviceHu	LetsPRO.exe, 00000037.00000002.4172640122.000000000FC86000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://intercom.help/letsvpn-world/en/collections/1611781-%E4%B8%AD%E6%96%87%E5%B8%AE%E5%8A%A9	LetsPRO.exe, 00000037.00000000.2030391391.0000000000E62000.00000002.00000001.01000000.00000018.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.sectigo.com/SectigoPublicCo	LetsPRO.exe, 00000037.00000002.4166122797.0000000006193000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.winimage.com/zLibDll1.2.5	wegame.exe, 00000006.00000002.4137406249.0000000000476000.00000002.00000001.01000000.00000004.sdmp, wegame.exe, 00000006.00000000.1716127775.0000000000476000.00000002.00000001.01000000.00000004.sdmp	false	Avira URL Cloud: safe	unknown
https://d1dmgcawtbm6l9.cloudfront.net/rest-apiedns_client_subnet=0.0.0.0%2F0&name=d1dmgcawtbm6l9.clo	LetsPRO.exe, 00000037.00000002.4171712622.000000000FC22000.00000004.00001000.00020000.00000000.sdmp, LetsPRO.exe, 00000037.00000002.4173917688.000000000FD44000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://acraiz.icpbrasil.gov.br/DPCacraiz.pdf0?	LetsPRO.exe, 00000037.00000002.4187562856.0000000034B38000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://pesterbdd.com/images/Pester.png	LetsPRO.exe, 00000037.00000002.4143541172.0000000003648000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/soap/encoding/	powershell.exe, 00000018.00000002.1893721239.0000000004D66000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000037.00000002.4143541172.0000000003648000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0.html	LetsPRO.exe, 00000037.00000002.4143541172.0000000003648000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000037.00000002.4187562856.0000000034AB5000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://intercom.help/letsvpn-world/en/articles/2926044-what-if-i-reached-maximum-connection-limit	LetsPRO.exe, 00000037.00000000.2030391391.0000000000E62000.00000002.00000001.01000000.00000018.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/CommunityToolkit/dotnet	LetsPRO.exe, 00000037.00000002.4167809675.0000000006742000.00000002.00000001.01000000.0000001E.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/dotnet/corefx/tree/7601f4f6225089ffb291dc7d58293c7bbf5c5d4f	LetsPRO.exe, 00000037.00000002.4168359295.00000000067F2000.00000002.00000001.01000000.00000022.sdmp	false	Avira URL Cloud: safe	unknown
http://www.dnie.es/dpc0	LetsPRO.exe, 00000037.00000002.4187562856.0000000034B38000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contoso.com/Icon	LetsPRO.exe, 00000037.00000002.4153902708.00000000045B2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://crl.ver)	svchost.exe, 0000000E.00000002.4142093238.00000177F8E00000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://nsis.sf.net/NSIS_ErrorError	haxGhXjmBFM.exe, 00000008.00000002.2032480091.000000000040A000.00000004.00000001.01000000.00000006.sdmp, haxGhXjmBFM.exe, 00000008.00000003.1973465998.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, haxGhXjmBFM.exe, 00000008.00000000.1717959233.000000000040A000.00000008.00000001.01000000.00000006.sdmp, haxGhXjmBFM.exe.1.dr	false	URL Reputation: safe	unknown
https://github.com/Pester/Pester	LetsPRO.exe, 00000037.00000002.4143541172.0000000003648000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.micro	powershell.exe, 00000018.00000002.1893014368.0000000002F54000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000018.00000002.1905703178.00000000073F5000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://crl.xrampsecurity.com/XGCA.crl0	LetsPRO.exe, 00000037.00000002.4187562856.0000000034B38000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://intercom.help/letsvpn-world/en/articles/2925752-how-to-download-letsvpn	LetsPRO.exe, 00000037.00000000.2030391391.0000000000E62000.00000002.00000001.01000000.00000018.sdmp	false	Avira URL Cloud: safe	unknown
https://nit.crash1ytics.com-	LetsPRO.exe, 00000037.00000002.4173917688.000000000FD0C000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/wsdl/	powershell.exe, 00000018.00000002.1893721239.0000000004D66000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000037.00000002.4143541172.0000000003648000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.newtonsoft.com/jsonschema	LetsPRO.exe, 00000037.00000002.4164213776.0000000006032000.00000002.00000001.01000000.0000001D.sdmp	false	URL Reputation: safe	unknown
https://intercom.help/letsvpn-world/en/articles/2780068-%E5%A6%82%E4%BD%95%E4%B8%8B%E8%BD%BD%E5%BE%9	LetsPRO.exe, 00000037.00000000.2030391391.0000000000E62000.00000002.00000001.01000000.00000018.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/dotnet/corefx/tree/7601f4f6225089ffb291dc7d58293c7bbf5c5d4f8	LetsPRO.exe, 00000037.00000002.4168398162.00000000067F6000.00000002.00000001.01000000.00000022.sdmp	false	Avira URL Cloud: safe	unknown
https://intercom.help/letsvpn-world/en/collections/1628560-help-documents	LetsPRO.exe, 00000037.00000002.4143541172.0000000003371000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000037.00000000.2030391391.0000000000E62000.00000002.00000001.01000000.00000018.sdmp	false	Avira URL Cloud: safe	unknown
https://nit.crash1ytics.comhttpCode=-2	LetsPRO.exe, 00000037.00000002.4176710420.000000000FF1B000.00000004.00001000.00020000.00000000.sdmp, LetsPRO.exe, 00000037.00000002.4173917688.000000000FD0C000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ocsp.sectigo.com0	LetsPRO.exe, 00000037.00000002.4166122797.0000000006193000.00000004.00000020.00020000.00000000.sdmp, LetsPRO.exe, 00000037.00000002.4180752320.00000000309B5000.00000004.00000020.00020000.00000000.sdmp, LetsPRO.exe, 00000037.00000002.4187562856.0000000034BA4000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://0.0.0.0%2F0	LetsPRO.exe, 00000037.00000002.4172640122.000000000FC92000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://letsvpn.world/terms.html	LetsPRO.exe, 00000037.00000000.2030391391.0000000000E62000.00000002.00000001.01000000.00000018.sdmp	false	Avira URL Cloud: safe	unknown
https://nit.crash1ytics.com/app33/devicehttps://nit.crash1ytics.com/app33/device	LetsPRO.exe, 00000037.00000002.4177372856.000000000FF72000.00000004.00001000.00020000.00000000.sdmp, LetsPRO.exe, 00000037.00000002.4173917688.000000000FD0C000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contoso.com/License	LetsPRO.exe, 00000037.00000002.4153902708.00000000045B2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.firmaprofesional.com/cps0	LetsPRO.exe, 00000037.00000002.4187562856.0000000034B38000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://intercom.help/letsvpn-world/-N	haxGhXjmBFM.exe, 00000008.00000002.2033229713.0000000000739000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://curl.haxx.se/docs/http-cookies.html	wegame.exe, wegame.exe, 00000006.00000002.4142318714.000000006C825000.00000002.00000001.01000000.00000008.sdmp, wegame.exe, 00000006.00000003.1736539346.00000000031D0000.00000004.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://letsvpn.world/privacy.html	LetsPRO.exe, 00000037.00000000.2030391391.0000000000E62000.00000002.00000001.01000000.00000018.sdmp	false	Avira URL Cloud: safe	unknown
http://www.openssl.org/support/faq.html	wegame.exe, 00000006.00000002.4143954280.000000006CECB000.00000002.00000001.01000000.0000000C.sdmp	false	URL Reputation: safe	unknown
https://g.live.com/odclientsettings/ProdV2	svchost.exe, 0000000E.00000003.1727303694.00000177F8D42000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://in.appcenter.ms/logs?api-version=1.0.0	LetsPRO.exe, 00000037.00000002.4143541172.0000000003648000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://widget.intercom.io/widget/	LetsPRO.exe, 00000037.00000000.2030391391.0000000000E62000.00000002.00000001.01000000.00000018.sdmp	false	Avira URL Cloud: safe	unknown
https://d3jb1hiazbhf2r.cloudfront.net/letsvpn-world/en/articles/8263068-how-to-delete-hosts-in-windo	LetsPRO.exe, 00000037.00000000.2030391391.0000000000E62000.00000002.00000001.01000000.00000018.sdmp	false	Avira URL Cloud: safe	unknown
https://contoso.com/	LetsPRO.exe, 00000037.00000002.4153902708.00000000045B2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://nit.crash1ytics.com/app33/device	LetsPRO.exe, 00000037.00000002.4175179086.000000000FD84000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/dotnet/corefx/tree/32b491939fbd125f304031c35038b1e14b4e39588	LetsPRO.exe, 00000037.00000002.4168580863.0000000006E72000.00000002.00000001.01000000.00000020.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/JamesNK/Newtonsoft.Json	LetsPRO.exe, 00000037.00000002.4164213776.0000000006032000.00000002.00000001.01000000.0000001D.sdmp	false	Avira URL Cloud: safe	unknown
http://nuget.org/NuGet.exe	powershell.exe, 00000018.00000002.1898978574.0000000005C86000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000037.00000002.4153902708.00000000045B2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://d3jb1hiazbhf2r.cloudfront.net/letsvpn-world/en/articles/3401886-special-settings-for-smartby	LetsPRO.exe, 00000037.00000000.2030391391.0000000000E62000.00000002.00000001.01000000.00000018.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/dotnet/corefx/tree/32b491939fbd125f304031c35038b1e14b4e3958	LetsPRO.exe, 00000037.00000002.4168580863.0000000006E72000.00000002.00000001.01000000.00000020.sdmp	false	Avira URL Cloud: safe	unknown
https://sectigo.com/CPS0	LetsPRO.exe, 00000037.00000002.4142762410.0000000001A47000.00000004.00000020.00020000.00000000.sdmp, LetsPRO.exe, 00000037.00000002.4166122797.0000000006193000.00000004.00000020.00020000.00000000.sdmp, LetsPRO.exe, 00000037.00000002.4180752320.00000000309B5000.00000004.00000020.00020000.00000000.sdmp, LetsPRO.exe, 00000037.00000002.4187562856.0000000034BA4000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://ocsp.sectig	LetsPRO.exe, 00000037.00000002.4142762410.0000000001A47000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://nit.crash1ytics.com	LetsPRO.exe, 00000037.00000002.4173917688.000000000FD0C000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://USUS2.Session-IdCERTIFICATE	LetsPRO.exe, 00000037.00000002.4173822346.000000000FD00000.00000004.00001000.00020000.00000000.sdmp, LetsPRO.exe, 00000037.00000002.4177372856.000000000FF72000.00000004.00001000.00020000.00000000.sdmp, LetsPRO.exe, 00000037.00000002.4177807037.000000000FFB2000.00000004.00001000.00020000.00000000.sdmp, LetsPRO.exe, 00000037.00000002.4176380888.000000000FEAA000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://acraiz.icpbrasil.gov.br/LCRacraizv2.crl0	LetsPRO.exe, 00000037.00000002.4187562856.0000000034B38000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#	LetsPRO.exe, 00000037.00000002.4142762410.0000000001A47000.00000004.00000020.00020000.00000000.sdmp, LetsPRO.exe, 00000037.00000002.4180752320.00000000309B5000.00000004.00000020.00020000.00000000.sdmp, LetsPRO.exe, 00000037.00000002.4187562856.0000000034BA4000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://d1dmgcawtbm6l9.cloudfront.net/rest-api	LetsPRO.exe, 00000037.00000002.4171712622.000000000FC22000.00000004.00001000.00020000.00000000.sdmp, LetsPRO.exe, 00000037.00000002.4173917688.000000000FD44000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://pki.digidentity.eu/validatie0	LetsPRO.exe, 00000037.00000002.4180752320.00000000309B5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://d3jb1hiazbhf2r.cloudfront.net/letsvpn-world/en/articles/8262801-special-settings-for-killer-	LetsPRO.exe, 00000037.00000000.2030391391.0000000000E62000.00000002.00000001.01000000.00000018.sdmp	false	Avira URL Cloud: safe	unknown
http://james.newtonking.com/projects/json	LetsPRO.exe, 00000037.00000002.4164213776.0000000006032000.00000002.00000001.01000000.0000001D.sdmp	false	URL Reputation: safe	unknown
https://d3jb1hiazbhf2r.cloudfront.net/letsvpn-world/en/articles/8262720-special-settings-for-host-ne	LetsPRO.exe, 00000037.00000000.2030391391.0000000000E62000.00000002.00000001.01000000.00000018.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.m	LetsPRO.exe, 00000037.00000002.4183661580.0000000030CEF000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://intercom.help/letsvpn-world/en/articles/3710603-about-logging-in-out-anomalies	LetsPRO.exe, 00000037.00000000.2030391391.0000000000E62000.00000002.00000001.01000000.00000018.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y	LetsPRO.exe, 00000037.00000002.4142762410.0000000001A47000.00000004.00000020.00020000.00000000.sdmp, LetsPRO.exe, 00000037.00000002.4180752320.00000000309B5000.00000004.00000020.00020000.00000000.sdmp, LetsPRO.exe, 00000037.00000002.4187562856.0000000034BA4000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96	svchost.exe, 0000000E.00000003.1727303694.00000177F8D42000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://in.appcenter.ms	LetsPRO.exe, 00000037.00000002.4143541172.0000000003648000.00000004.00000800.00020000.00000000.sdmp, LetsPRO.exe, 00000037.00000002.4179081431.0000000030452000.00000002.00000001.01000000.00000027.sdmp	false	Avira URL Cloud: safe	unknown
http://www.jiyu-kobo.co.jp/	LetsPRO.exe, 00000037.00000002.4194258639.0000000034EB2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.winimage.com/zLibDll	wegame.exe, 00000006.00000002.4137406249.0000000000476000.00000002.00000001.01000000.00000004.sdmp, wegame.exe, 00000006.00000000.1716127775.0000000000476000.00000002.00000001.01000000.00000004.sdmp	false	URL Reputation: safe	unknown
https://www.nuget.org/packages/Newtonsoft.Json.Bson	LetsPRO.exe, 00000037.00000002.4164213776.0000000006032000.00000002.00000001.01000000.0000001D.sdmp	false	URL Reputation: safe	unknown
http://crl.sectigo.com/SectigoPublicC4t	LetsPRO.exe, 00000037.00000002.4166122797.0000000006193000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
183.60.146.66	unknown	China	134763	CT-DONGGUAN-IDCCHINANETGuangdongprovincenetworkCN	false
103.7.30.61	ied-tqos.wegamex.com.hk	China	132203	TENCENT-NET-AP-CNTencentBuildingKejizhongyiAvenueCN	false
103.7.30.83	tqos.wegamex.com.hk	China	132203	TENCENT-NET-AP-CNTencentBuildingKejizhongyiAvenueCN	false
35.227.223.56	unknown	United States	15169	GOOGLEUS	false
108.138.24.13	unknown	United States	16509	AMAZON-02US	false
152.195.19.97	unknown	United States	15133	EDGECASTUS	false
103.235.46.96	www.wshifen.com	Hong Kong	55967	BAIDUBeijingBaiduNetcomScienceandTechnologyCoLtd	false
13.107.246.60	s-part-0032.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
23.98.101.155	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
162.159.61.3	chrome.cloudflare-dns.com	United States	13335	CLOUDFLARENETUS	false
172.64.41.3	unknown	United States	13335	CLOUDFLARENETUS	false
3.164.160.102	d1dmgcawtbm6l9.cloudfront.net	United States	16509	AMAZON-02US	false
142.251.35.170	unknown	United States	15169	GOOGLEUS	false
142.250.186.129	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.250.186.164	www.google.com	United States	15169	GOOGLEUS	false
77.88.55.88	yandex.com	Russian Federation	13238	YANDEXRU	false
54.169.168.67	socket-ap1-ingress-1471706552.ap-southeast-1.elb.amazonaws.com	United States	16509	AMAZON-02US	false

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1476283
Start date and time:	2024-07-18 22:56:14 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 14m 52s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	65
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	lets-test.msi
Detection:	MAL
Classification:	mal84.troj.spyw.evad.winMSI@118/595@27/19
EGA Information:	Successful, ratio: 85.7%
HCA Information:	Successful, ratio: 97% Number of executed functions: 192 Number of non-executed functions: 216
Cookbook Comments:	Found application associated with file extension: .msi Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, Conhost.exe, dllhost.exe, SIHClient.exe, backgroundTaskHost.exe, conhost.exe, WmiPrvSE.exe
Excluded IPs from analysis (whitelisted): 13.107.42.16, 142.250.186.78, 204.79.197.239, 13.107.21.239, 184.28.90.27, 104.18.38.233, 172.64.149.23, 2.23.209.140, 2.23.209.130, 2.23.209.187, 2.23.209.182, 2.23.209.133, 2.23.209.179, 2.23.209.149, 2.23.209.189, 20.57.103.21, 4.152.45.219, 152.199.19.161, 4.153.25.42, 142.250.80.67, 142.250.65.163, 142.251.32.99, 142.250.176.195
Excluded domains from analysis (whitelisted): wildcardtlu.azureedge.net, cdp-f-ssl-tlu-net.trafficmanager.net, crt.comodoca.com.cdn.cloudflare.net, config.edge.skype.com.trafficmanager.net, slscr.update.microsoft.com, in2-gw2-03-3d6c3051.eastus2.cloudapp.azure.com, edgeassetservice.afd.azureedge.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, star.sf.tlu.dl.delivery.mp.microsoft.com.delivery.microsoft.com, clients2.google.com, e86303.dscx.akamaiedge.net, ocsp.digicert.com, www.bing.com.edgekey.net, config-edge-skype.l-0007.l-msedge.net, e16604.g.akamaiedge.net, msedge.b.tlu.dl.delivery.mp.microsoft.com, www.gstatic.com, l-0007.l-msedge.net, prod.fs.microsoft.com.akadns.net, wildcardtlu.ec.azureedge.net, config.edge.skype.com, star.b.tlu.dl.delivery.mp.microsoft.com.delivery.microsoft.com, www.bing.com, cdp-f-tlu-net.trafficmanager.net, edge-microsoft-com.dual-a-0036.a-msedge.net, fs.microsoft.com, in1-gw2-01-3d6c3051.eastus2.cloudapp.azure.com, wildcar
Execution Graph export aborted for target powershell.exe, PID 7968 because it is empty
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Report size getting too big, too many NtWriteVirtualMemory calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: lets-test.msi

Simulations

Behavior and APIs

Time	Type	Description
16:57:10	API Interceptor	2x Sleep call for process: svchost.exe modified
16:57:24	API Interceptor	16x Sleep call for process: powershell.exe modified
16:57:42	API Interceptor	6556509x Sleep call for process: LetsPRO.exe modified
16:59:20	API Interceptor	3331x Sleep call for process: wegame.exe modified
21:57:09	Task Scheduler	Run new task: haxGhXjmBFM path: C:\Program Files (x86)\haxGhXjmBFM\LetsPRO.exe
21:57:09	Task Scheduler	Run new task: pdRbyqJqGUY path: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe s>--no-startup-window --win-session-start
21:57:09	Task Scheduler	Run new task: tRyVurwmBkV path: C:\Program Files (x86)\Common Files\wegame.exe
21:57:20	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_C366A24065C39A1BE76E148DC2D0A868 "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
21:57:28	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_C366A24065C39A1BE76E148DC2D0A868 "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
21:57:46	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run LetsPRO "C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe" /silent
21:57:54	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run LetsPRO "C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe" /silent

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
183.60.146.66	zx.exe	Get hash	malicious	Unknown	Browse
	zx.exe	Get hash	malicious	Unknown	Browse
	zx.exe	Get hash	malicious	Unknown	Browse
	zx.exe	Get hash	malicious	Unknown	Browse
	zx.exe	Get hash	malicious	Unknown	Browse
	zx.exe	Get hash	malicious	Unknown	Browse
103.7.30.61	setup#U67e5#U8be2_pf2024.exe	Get hash	malicious	GhostRat, Nitol	Browse
103.7.30.83	setup#U67e5#U8be2_pf2024.exe	Get hash	malicious	GhostRat, Nitol	Browse
108.138.24.13	zx.exe	Get hash	malicious	Unknown	Browse
152.195.19.97	http://ustteam.com/	Get hash	malicious	Unknown	Browse	www.ust.com/
103.235.46.96	6o63snaetO.exe	Get hash	malicious	Unknown	Browse	www.baidu.com/
	http://metamask-zhwallet.org/	Get hash	malicious	Unknown	Browse	www.baidu.com/img/flexible/logo/plus_logo_web_2.png
	Tas10.dll	Get hash	malicious	BlackMoon	Browse	www.baidu.com/
	Tas8.dll	Get hash	malicious	BlackMoon	Browse	www.baidu.com/
	Tas8_WL.dll	Get hash	malicious	BlackMoon	Browse	www.baidu.com/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ied-tqos.wegamex.com.hk	setup#U67e5#U8be2_pf2024.exe	Get hash	malicious	GhostRat, Nitol	Browse	103.7.30.61
chrome.cloudflare-dns.com	SecuriteInfo.com.Riskware.OfferCore.5002.4698.exe	Get hash	malicious	PrivateLoader	Browse	172.64.41.3
	https://app.pandadoc.com/document/01fc0506672a338844b1e0a33f8f8c691e8b5536	Get hash	malicious	Unknown	Browse	172.64.41.3
	SecuriteInfo.com.decompression.bomb.9781.1949.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	MicrosoftInst.exe	Get hash	malicious	GhostRat	Browse	162.159.61.3
	cc00980_.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	ziprar.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	PEDIDO DE COMPRA URGENTEs#U034fx#U034fl#U034fx#U034f..exe	Get hash	malicious	FormBook	Browse	172.64.41.3
	https://ury.io/aVPeBa	Get hash	malicious	Unknown	Browse	172.64.41.3
	CC-CREDIT CARD-itineraries.exe	Get hash	malicious	FormBook	Browse	162.159.61.3
	bt2eTjYGOb.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
d1dmgcawtbm6l9.cloudfront.net	zx.exe	Get hash	malicious	Unknown	Browse	18.239.15.216
	zx.exe	Get hash	malicious	Unknown	Browse	3.164.160.24
	zx.exe	Get hash	malicious	Unknown	Browse	108.138.24.13
	zx.exe	Get hash	malicious	Unknown	Browse	108.138.24.227
	zx.exe	Get hash	malicious	Unknown	Browse	18.154.80.50
	zx.exe	Get hash	malicious	Unknown	Browse	18.239.15.44
sni1gl.wpc.nucdn.net	https://app.pandadoc.com/document/01fc0506672a338844b1e0a33f8f8c691e8b5536	Get hash	malicious	Unknown	Browse	152.199.21.175
	ziprar.exe	Get hash	malicious	Unknown	Browse	152.199.21.175
	PEDIDO DE COMPRA URGENTEs#U034fx#U034fl#U034fx#U034f..exe	Get hash	malicious	FormBook	Browse	152.199.21.175
	df.exe	Get hash	malicious	Unknown	Browse	152.195.19.97
	CC-CREDIT CARD-itineraries.exe	Get hash	malicious	FormBook	Browse	152.199.21.175
	s6ue6dcFAI.exe	Get hash	malicious	Babadeda	Browse	152.199.21.175
	LJERbwcloq.exe	Get hash	malicious	Babadeda	Browse	152.199.21.175
	LJERbwcloq.exe	Get hash	malicious	Babadeda	Browse	152.199.21.175
	z46Ordendecompraurgente___s__x__l__x___.exe	Get hash	malicious	Coinhive, FormBook, Xmrig	Browse	152.199.21.175
	#U7a3d#U67e5#U4f01#U4e1a#U540d#U5355#U518c-#U7ec8#U7aef.exe	Get hash	malicious	Unknown	Browse	152.199.21.175
nal.fqoqehwib.com	zx.exe	Get hash	malicious	Unknown	Browse	33.86.72.19
	zx.exe	Get hash	malicious	Unknown	Browse	99.34.124.121
	zx.exe	Get hash	malicious	Unknown	Browse	99.34.124.121
	zx.exe	Get hash	malicious	Unknown	Browse	99.34.124.121
	zx.exe	Get hash	malicious	Unknown	Browse	104.112.172.245
	zx.exe	Get hash	malicious	Unknown	Browse	10.176.38.125

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AMAZON-02US	Meredith Machinery LLC Meredith PR LLC.msg	Get hash	malicious	Unknown	Browse	13.32.110.123
	https://ctfoodshare.org	Get hash	malicious	HTMLPhisher	Browse	52.33.181.156
	http://site.foodshare.org/site/DocServer	Get hash	malicious	HTMLPhisher	Browse	18.244.28.54
	https://email.email.pandadoc.net/c/eJxUz81qGzEQwPGnWd3W6Gsl7UEHF7MJSVtoUmicSxmNRraId7VV5KbJ0xcf0o_b8GcGfhN9MCokx2LB80xL-56jv4b6tt-eQ9gHmNRH_XjnHtWOkRdWCqW40IIdvVCGSxuVMoNRWgHymJxGsA6dS0Kw7CWXmlvhxCgGLTYowpiElgovMfFOc5ohnzYrLBFiwc1CjZ38sbX1uVPbTk6dnGBd_y5gmTs5vWM7OVEwpIU1NMaEIJV0hEmD4BSJj0nbEawka9hSWk4ZoeWyXJ4EF5KlIfUBU-x1pNi7IYVeq0DGWFQiRVbqAZb89ufo5nD1mj5_ife742173f0Y7j_MtGXVx0ovGyzlaYal0_xAp9zgomXNv2v_GfsG9UD_lUpzXiLVvpUey7yeqBH76SV7KfXpeQWkCyCpr7el6PNx--nqpn77dXf9sMeH3wEAAP__TvmT1g	Get hash	malicious	Unknown	Browse	35.163.144.222
	SecuriteInfo.com.Riskware.OfferCore.5002.4698.exe	Get hash	malicious	PrivateLoader	Browse	52.27.94.100
	file.exe	Get hash	malicious	Unknown	Browse	3.165.136.111
	SecuriteInfo.com.Riskware.OfferCore.5002.4698.exe	Get hash	malicious	PrivateLoader	Browse	143.204.205.88
	jklarm	Get hash	malicious	Unknown	Browse	44.231.219.156
	https://t.infomail.microsoft.com/r/?id=h707ecfa5,69ca6c1c,69ccacb0&e=b2NpZD1jbW1hbmlleDN4Mg&s=TT2m-Y1733ga9dYQbmzwO7CS0-MhXWa3NfkkfpZX75E	Get hash	malicious	Unknown	Browse	18.200.174.228
	https://a.kerika.com/acc_39TXETMEnauTtVtsNzbfFJ/c/brd_4nvvo2ooyq8HxjaMzCxzZb/cnvs_BfJOZ	Get hash	malicious	Tycoon2FA	Browse	52.219.95.2
CT-DONGGUAN-IDCCHINANETGuangdongprovincenetworkCN	zx.exe	Get hash	malicious	Unknown	Browse	183.60.146.66
	zx.exe	Get hash	malicious	Unknown	Browse	183.60.146.66
	zx.exe	Get hash	malicious	Unknown	Browse	183.60.146.66
	zx.exe	Get hash	malicious	Unknown	Browse	183.60.146.66
	y7cm9CKSN9.elf	Get hash	malicious	Mirai	Browse	42.157.152.230
	zx.exe	Get hash	malicious	Unknown	Browse	183.60.146.66
	zx.exe	Get hash	malicious	Unknown	Browse	183.60.146.66
	jew.x86.elf	Get hash	malicious	Unknown	Browse	42.157.129.7
	http://www.bitdefenderlogin.com/	Get hash	malicious	Unknown	Browse	183.61.243.1
	SecuriteInfo.com.Trojan.Siggen23.13161.15240.4676.exe	Get hash	malicious	Unknown	Browse	183.61.243.1
TENCENT-NET-AP-CNTencentBuildingKejizhongyiAvenueCN	https://www.cognitoforms.com/EngendaGroupLimited/EngendaGroupLimited	Get hash	malicious	HTMLPhisher	Browse	49.51.78.226
	Fatura20240617.exe	Get hash	malicious	FormBook	Browse	124.156.166.165
	NEW RFQ - Viasat LSDR.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	124.156.237.71
	REV-New Order 20240717.pif.exe	Get hash	malicious	Remcos	Browse	170.106.47.94
	yHIoCL9LQV.elf	Get hash	malicious	Mirai	Browse	170.106.89.57
	http://whats-lic.com/	Get hash	malicious	Unknown	Browse	129.226.81.93
	https://acrobat.adobe.com/id/urn:aaid:sc:eu:ee698a8c-0f5f-4d49-8e57-941bebba7ea3	Get hash	malicious	HTMLPhisher	Browse	162.62.150.176
	https://ado4784be78498pdf.standard.us-east-1.oortech.com/INV367387COPY.shtml	Get hash	malicious	HTMLPhisher	Browse	170.106.47.94
	http://43.249.172.195:888/112s	Get hash	malicious	Unknown	Browse	203.205.254.157
	mlk3kK6uLZ.exe	Get hash	malicious	Amadey, Mars Stealer, PureLog Stealer, Quasar, RedLine, Stealc, Vidar	Browse	170.106.76.24
TENCENT-NET-AP-CNTencentBuildingKejizhongyiAvenueCN	https://www.cognitoforms.com/EngendaGroupLimited/EngendaGroupLimited	Get hash	malicious	HTMLPhisher	Browse	49.51.78.226
	Fatura20240617.exe	Get hash	malicious	FormBook	Browse	124.156.166.165
	NEW RFQ - Viasat LSDR.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	124.156.237.71
	REV-New Order 20240717.pif.exe	Get hash	malicious	Remcos	Browse	170.106.47.94
	yHIoCL9LQV.elf	Get hash	malicious	Mirai	Browse	170.106.89.57
	http://whats-lic.com/	Get hash	malicious	Unknown	Browse	129.226.81.93
	https://acrobat.adobe.com/id/urn:aaid:sc:eu:ee698a8c-0f5f-4d49-8e57-941bebba7ea3	Get hash	malicious	HTMLPhisher	Browse	162.62.150.176
	https://ado4784be78498pdf.standard.us-east-1.oortech.com/INV367387COPY.shtml	Get hash	malicious	HTMLPhisher	Browse	170.106.47.94
	http://43.249.172.195:888/112s	Get hash	malicious	Unknown	Browse	203.205.254.157
	mlk3kK6uLZ.exe	Get hash	malicious	Amadey, Mars Stealer, PureLog Stealer, Quasar, RedLine, Stealc, Vidar	Browse	170.106.76.24

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Program Files (x86)\Common Files\adapt_for_imports.dll	sutup-Chrome.13.26.x64.msi	Get hash	malicious	BlackMoon	Browse
C:\Program Files (x86)\Common Files\Lua51.dll	sutup-Chrome.13.26.x64.msi	Get hash	malicious	BlackMoon	Browse
C:\Program Files (x86)\Common Files\beacon_sdk.dll	sutup-Chrome.13.26.x64.msi	Get hash	malicious	BlackMoon	Browse
C:\Program Files (x86)\Common Files\common.dll	sutup-Chrome.13.26.x64.msi	Get hash	malicious	BlackMoon	Browse

Created / dropped Files

C:\Config.Msi\61335e.rbs

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	modified
Size (bytes):	665482
Entropy (8bit):	6.537040712088255
Encrypted:	false
SSDEEP:	12288:oPJHi1yIMG5OraPJHi1yIMG5OrKPJHi1yIMG5Ork:yHit95CcHit95CsHit95Ck
MD5:	338B748B61069B5105A5F3AB1473E559
SHA1:	6FF2485ADDA3E218C54E36EE0B0109D002B7934D
SHA-256:	1B097D468BDFC8B280A2E2464247293F496683D6D582CDBCA6B542AC39247C58
SHA-512:	21CEF317CF0B5FBBF55A5937DAA765E96B80D5061E04183C8D9C1C7C157232BA4DD6D0AB87F8E34A0AEC658B26B03770DBB4525CDB1AAD5D0DEE48D26B9391A0
Malicious:	false
Preview:	...@IXOS.@.....@$..X.@.....@.....@.....@.....@.....@......&.{5FD627E3-9BD5-491C-92C5-2934CD5F1E11}..1etsvpn..lets-test.msi.@.....@.....@.....@........&.{D5081896-4C2D-4C53-BFE1-6025F1920CD2}.....@.....@.....@.....@.......@.....@.....@.......@......1etsvpn......Rollback..ck(W.V...d\O:...[1]..RollbackCleanup..ck(W Rd..Y.N.e.N...e.N:. .[.1.].....ProcessComponents..ck(W.f.e.~.N.l.Q..&.{595B7CE7-E971-4D65-AA8A-F0476F19E124}&.{5FD627E3-9BD5-491C-92C5-2934CD5F1E11}.@......&.{92C80294-11B4-4FF7-9FC6-3CFF2DDD4C89}&.{5FD627E3-9BD5-491C-92C5-2934CD5F1E11}.@......&.{CCF87755-7111-436F-BC7B-EF0479ACBAA4}&.{5FD627E3-9BD5-491C-92C5-2934CD5F1E11}.@......&.{1B0C81AF-0EF7-485A-9CC5-EE499F9FFDE6}&.{5FD627E3-9BD5-491C-92C5-2934CD5F1E11}.@......&.{0DE0322F-6139-4956-87EC-E84A0167D325}&.{5FD627E3-9BD5-491C-92C5-2934CD5F1E11}.@......&.{FD51F2A8-9CC5-437F-8365-091692735C74}&.{5FD627E3-9BD5-491C-92C5-2934CD5F1E11}.@......&.{EAD2CF5C-FD05-4FAE-A506-A111996F29BB}&.{5FD627E3-9BD5-491C-92C5-2934CD5F1E11}.@......&.

C:\Program Files (x86)\Common Files\Lua51.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	560008
Entropy (8bit):	5.909191877084503
Encrypted:	false
SSDEEP:	6144:xMbrcPhnaq5rl9C2p3lgpwVjrjowwZGg81UFotKrwIzSCiMmkEelsXtWWkwEEp4w:rT5rTvDMwb6KZZsEFtawEEp1ui7v
MD5:	0527DF9BDAAEA7250291EFCB5B33B709
SHA1:	1B6B3511C30AA66A0A0258578A4B695DB2FBDE36
SHA-256:	7FA367A644670ED94A01BC0927996D93B82EA2658BB7D84C99C648F12B6A61F1
SHA-512:	D8F49F954112E744B161246759AA0A6B106125A9B936E98C3F57C4535B1E7866ADFFE3E1699412EF8D549A84121F9492F67BB504B91FFFD384BBC2E89611631B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: sutup-Chrome.13.26.x64.msi, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......(.0.l.^\l.^\l.^\e..\~.^\>._]n.^\x._]o.^\l._\..^\>.[]g.^\>.Z]f.^\>.]]e.^\l.^\m.^\.Z]Q.^\.^]m.^\.\]m.^\Richl.^\................PE..L...+.Bc...........!................i................................................9....@.........................@...."...D.......................X...3...p..........8...........................(...@............@...............................text...@........................... ..`.rdata..^...........................@..@.data........0......................@....idata.......@....... ..............@..@.00cfg.......`.......4..............@..@.reloc...!...p..."...6..............@..B................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Common Files\adapt_for_imports.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	414600
Entropy (8bit):	6.498913790154161
Encrypted:	false
SSDEEP:	6144:A185Y9Pd04VB/XrghF6fraV5A8B2NNy7gTC+kTXcEXS+aM22PQ+d83qUspBOXUUi:y/GFnZH9woGojR39mbEGM8M
MD5:	D9F36FF27DC0D08FD384A99BB801A24A
SHA1:	886287B85E2B57E05E61EE582DD1595F7E620765
SHA-256:	96AEA19B11327AE4200396E84F06A4746A926F43B688C22E60B370DED1CF6D58
SHA-512:	032F0F0E6200383DD9A4A7628E1EF5B67EA6FCFD3A872CD2FA0B952CCC3286B10550526C01E0294068E7D3995714EFDF798607A51CF4681B8295B8D8493963DD
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: sutup-Chrome.13.26.x64.msi, Detection: malicious, Browse
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.........VFA.8.A.8.A.8.+.=.E.8.+.<...8.....D.8...<.J.8...;.J.8...=.X.8...9.E.8.H..B.8.H..i.8...9.B.8.A.9.?.8...=.J.8...8.@.8.....@.8...:.@.8.RichA.8.................PE..L....Zwd...........!.................w..............................................D.....@.`............................'..H........................ ...3.......L..`f..T...................Xg.......f..@............................................text............................... ..`.rdata...q.......r..................@..@.data....M...@....... ..............@....rsrc...............................@..@.reloc...L.......N..................@..B........................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Common Files\beacon_sdk.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1537416
Entropy (8bit):	6.78098762929255
Encrypted:	false
SSDEEP:	24576:+PonniDaQDrTwkQLAxDQKbt3R0ydNywVvpg8yq4lVfuzGUHttBXf+ib7STJMaUmA:gonniDasrTk+tB5xxg8ASzzjcibmTJTE
MD5:	C83DD90D61BAE5CF1D4B0620649726D6
SHA1:	CDB21AF237425523D230A1738C4111776B3E8318
SHA-256:	B5DF19432F50AD434CA860173C9EB0DC6FDFACA48F75A3B416D038C213D089DA
SHA-512:	480CB660931EECE9FEE17FCB60B5C467CEB033D7D2F9FC0CF37B82DBC7443918935BA5A24AAEB8A284C95820ECCAB382E67342E6F0038C4D36B36F51D04DC412
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: sutup-Chrome.13.26.x64.msi, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........o.S...S...S.......Y.......^.......K.......W...S...]...S...7...Z..x...............X.......O.......R.......R.......R...RichS...........PE..L....(_c...........!.................k..............................................V.....@......................... =..\|....G.......................B...3.......... ...T...........................x...@...............X............................text.............................. ..`.rdata.............................@..@.data....\...p...6...V..............@....QMGuid.............................@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................

C:\Program Files (x86)\Common Files\common.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3880328
Entropy (8bit):	6.770205397989409
Encrypted:	false
SSDEEP:	98304:ZnL1LHHgG/M90itlALhFlHovpaz82uukT:Z5gG/M9I5UaY7
MD5:	856D1285704805940B8379E81B18F3EB
SHA1:	AAE6852E7F86A8163CA5A63178A7CCEB1C50FF67
SHA-256:	2E21F70ADCBE5FE3D51EB9236FC23E071E675C802BFEEC2CA5C0A41EEF35E9A2
SHA-512:	50B61C980C176F2F32BD4E353187D5DB9F3D3D7D01486105DA95D7E7BF153386D2808DC94909B4998E05ACCEBE6CC388ECAD8246D236A89529F9A1274B34885C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: sutup-Chrome.13.26.x64.msi, Detection: malicious, Browse
Preview:	MZ......................@...................................X...........!..L.!This program cannot be run in DOS mode....$........!.<.@.o.@.o.@.o.).n.B.o.6Do.@.o.(.n.@.o.(.n.@.o..)o.@.o.(.n.@.o.(.n.@.o.(.n.@.o.(.n.@.o.8mo.@.o6).n.@.o.).n.@.o0).n.@.o.8}o.@.o.@.o.C.o0).n.@.o0).n.@.o0).n.@.o0).o.@.o.@yo.@.o0).n.@.oRich.@.o........................PE..L....Zwd...........!.....:)..,...............P)...............................;.......<...@.`.......................`.5.Lm....6......P9...............;..3...p9.@).. c2.T....................d2.....xc2.@............P).x............................text...<8)......:)................. ..`.rdata.......P)......>).............@..@.data........`7..r...H7.............@....QMGuid......@9.......8.............@....rsrc........P9.......8.............@..@.reloc..@)...p9..*....8.............@..B........................................................................................................................................................................

C:\Program Files (x86)\Common Files\log\wegame.20240718-184033-778.log

Download File

Process:	C:\Program Files (x86)\Common Files\wegame.exe
File Type:	data
Category:	dropped
Size (bytes):	270
Entropy (8bit):	5.874184942203336
Encrypted:	false
SSDEEP:	6:pZAl/iBLLKBjHEfe1fFNkb6tactam5jD9bDnu:EKBLL0jkosstaS3u
MD5:	E8B9158E21614E5C89FE104EE5344504
SHA1:	0BF09D18B4A83B18C1F715C3FD05338379F0B51D
SHA-256:	40C9696273C0F7345E3CBA4E26CCD583E6DBE102BFFFAD7DB0EDF2E6E41946E3
SHA-512:	9D27464B071C48E5E71163AA85DF6D70A9022FAC9B6DB4B675C46A6072AEFC2FCC47B366EF3FD9BEBF007F7F2FE619F29C47E1F0E0AF10B251A557E7ECD4DAC3
Malicious:	false
Preview:	.......f....e.......V.4..;m8..A...M..r.....E...mr.".....0..q...Q.E;.H..yt....2].d.....................................................................Z.1.....k...e.,.6......t>..rO.k...z...4.uabJ........E.EI^.....~..G...i..#&.[S2.....~?[.z...h...a....t@CO...

C:\Program Files (x86)\Common Files\log\wegame.mem.log

Download File

Process:	C:\Program Files (x86)\Common Files\wegame.exe
File Type:	data
Category:	dropped
Size (bytes):	3145890
Entropy (8bit):	0.05324348387951082
Encrypted:	false
SSDEEP:	192:ntz+6HPzVXoFRwbeN5Ybh63qQ36w8pT5S7d2xWvJxTjM8WVkp6V6i/EC:A6HpIrg6Dh8p1S7dJhxkvVo6R8C
MD5:	5F6977A1E841B18D46DE8AD82D9D7AAE
SHA1:	217B53C671C115D45664DEF4C4EA00413F82CB42
SHA-256:	E195CC0B6358F1E46088A72C6C9345283322A3220FEDDFB75030154BF7A42191
SHA-512:	9A2637CC33249962751905F6A14310B5D6402E3D6F87DB6A19671340C9659C36BDB3823A144E7E23CD12A85C58A2E43C0AEC2D08FF02C3F966E862E5EA869626
Malicious:	false
Preview:	.......f....e.............L.yl.j/......=....v.ZL..f..z.m.B.....9[.e..y.......`...................................................................%{.x4.>..>...is....BI-Sk.....~.w............p....d_g.qlDw...l........,.f..4.k..<.....C..G.....'.g1....y..1.mE(a...#.-3.......50...q....{...K............ek.@\.......P..k..$.7,.s..Y..tmB.6~...%..._r.Y]].d.q.-xH.2(6..p....E.R1;...E.iv.....o........H.].;...tPL>.&.w....0....51.......M....^.....K..Rv..Pe.o...F..?".....Z.".<..\|Z..9..q.....x..1Ci..qa...'.M...#.4. .....$5...Q.j..3.D....{./y@..x.?f.u>e.@5.N.r/.7..p!.q....{...K............@.....wt....P..k..$.7,.s<!.K..0.mB.6~....?...Y..1.h...1...3.0.U,..x...L..k..K.....q<F7...Z...j..l......\|@.{.u.y.{.fH..M....h...n.........-5@.;P........iE......?.2...6.9...=..q......e#G.3..#w.-.[YY...?F.o.. !(j..eT}..BHg.od3%......p....E.R1;...E.iv.....o........H.].;...tPL>.&.w....0....51.......M....^.........(W...K....+p..1P.....>.g.7.p..w........CZ...].w..u...;....4s'.g

C:\Program Files (x86)\Common Files\wegame.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1427336
Entropy (8bit):	6.155905635785417
Encrypted:	false
SSDEEP:	24576:LRCJ0FRnE2wKTK/t9sWQTxybUJu0PQGGL0xkFeyD6JB:NEkE2xK/t9RQTZJ2GGAcPDu
MD5:	063AF51C19F29BCDFD26C1BEBDC9ACE6
SHA1:	810817459E322BA44815DF62702B9C8FE04B26FB
SHA-256:	C6EF12669E1D0A3D0F54AD7CD516D5CF2DDF81EDC350C3AAFAA51C8EA9226A73
SHA-512:	5FFFF7F49B68004EB8F02522724B45D9C6CFA5CB45FF1C5F3CD93F1C65F0CADC322CC09A777B933C64650A7666C6204B67F9B1ADF266BA2D1CE537C17F4A99A9
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......>0..zQ..zQ..zQ...9..xQ..(9..wQ..(9..pQ..(9..^Q..(9..~Q..s)^.\Q...8..OQ...8..xQ...8...Q..zQ..&S...8...Q...82.{Q..zQZ.{Q...8..{Q..RichzQ..........................PE..L...Y[wd..........#......D...L..............`....@........................................`................................=.......0..(................3..........pG..T...................hH.......G..@............`...............................text....C.......D.................. ..`.rdata..~L...`...N...H..............@..@.data....{.......4..................@....rsrc...(....0......................@..@................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\haxGhXjmBFM.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	15186952
Entropy (8bit):	7.996968485787673
Encrypted:	true
SSDEEP:	393216:vhgJwsBmw97Le7jnnlGg4rKTYyH25JQZePHDKZ1:vwwxwN6nnIVzyH2Y0PHDU
MD5:	9C44BE4CEAC0C983A812FD8459511FD0
SHA1:	BD5AAAD4ACD523CD2855E8B50A8380365D81E041
SHA-256:	B6750A3631413D71D7EA10292A11E5D0560AFB6CCD4AD4BAA75D7DC80842F153
SHA-512:	372DDEB1045D49E8F98F17BCCFFB0E3EDC2179E541F8A4493300517327E514C7BF64557250E0F84F7366310A3D7A58A8D5480596F9BE075B3F5D9411A49B4D09
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1...Pf..Pf..Pf._9..Pf..Pg.LPf._;..Pf.sV..Pf..V`..Pf.Rich.Pf.........................PE..L...<.oZ.................h...........3............@..........................@.......w....@..........................................p..................x&...........................................................................................text...'f.......h.................. ..`.rdata...............l..............@..@.data...............................@....ndata... ...P...........................rsrc........p......................@..@................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\haxGhXjmBFM\LetsPRO.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	245880
Entropy (8bit):	6.886887925864286
Encrypted:	false
SSDEEP:	6144:KZzvhs2Z4n1E7g34XtVYAOfTdxz44JsQwhUMht:KJ+2Z4nShVY5HUbUit
MD5:	EA9E2F517B1CC2DBE7F78302DD7FB593
SHA1:	CB326EEEE062BFC20BE4D07FA989B001811FC03C
SHA-256:	B1037F963C91AB0F586349D5AEDE8E25686784F46F031DFC422E0D69A9939F48
SHA-512:	D8D38E5243FF8F8E3F790C3587BF0360AFD7DD185886DA86AD7AD6111EED121E91ECA18BAC9563EA4E6984C46F88639F58A2073884567CA982383EC2CF32F0EB
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........e..O.S.O.S.O.S.).R.O.S.).R.O.S.).R.O.S.'.R.O.S.'.R.O.S.'.R.O.S.).R.O.S.O.S.O.S5&.R.O.S5&.S.O.S.O.S.O.S5&.R.O.SRich.O.S........................PE..L.....p_............................+.............@.......................................@.....................................<.......L...............x&.......!......p...............................@...............,............................text...8........................... ..`.rdata..V...........................@..@.data....#..........................@....rsrc...L...........................@..@.reloc...!......."...x..............@..B........................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\haxGhXjmBFM\app-3.8.0\1

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	10804224
Entropy (8bit):	7.999983829265583
Encrypted:	true
SSDEEP:	196608:5cO1GZZHhFifrj+PnApJXIrj72JqlkaVDBTwHOR+h3kkk94ns9RG0p9y:5cOkHhY/bI20bNtwHOR6k99RG0by
MD5:	047215F598FF28ADF22EE24E164B2A5C
SHA1:	9C9363520F904FF8909A979A24B0A8730F506118
SHA-256:	65BC5A87FAE2056B4BDE6A41A9C74A3AA02D276E12A5BF8428213FE74A95A791
SHA-512:	3CCC926C6BC176849695E4230878D06AB0518B5AFFD8B9DDF4165D10B78CD3EDE9D119485486B2DC5D1124E76EC0CC9D275E5D0C7DFA63AA6044009E4C009755
Malicious:	false
Preview:	...#v.,g.6...9..p9...0...j.....L{....Z"T...X..F.r....p....4jTx..zqw.0,.2/4..:......./9q.c..2Wu..67...j.b...'.....OA\?j...z..Y..4....n34.)...o..=7.Q.T..F..q...d.......,.......]9.1.d...;..^<G...`..3.W.@.}L......[...D....8.8./+...p.7......9.m....&u..+.v....U.4...Z(^.Wk...)n...Qlv\|..U...;T=....3d.}....\../i ..m..V.>....!7_+..bC.....3....0.@.....`.l"..a2.a..y$..9..^..+....G.R.\|......M..o...M..4......%.....".....QO...[.v....M#.6e.k.8..d......k0..t.x.X!..,.j.vq{..1....2....s"m.........AI.....56..X...?.....I2y..[.$/L=.w.i...B.#S.....D..q)...d.Rakb......K.P..Nz...<.'....W2...7.'x-.z:...r.7..H..,..e.X...j.O.....V.E.R..ew...D.f.R...a......%}..uK"[6..v&A9.I.....Q8`.L......=b.....R._..W.Q.\:K,PGc..{u=..f.(.W..5"........~....?.=..uV...<i@.W0....E;.Y.8f.J..C.%..'...*CDc%....s....8..1..UT3.........[uaj&f.7........G".#).x.u..1.P...).H.......?A^3.D.G...Q...x9Ok.O....$.).l....?...-..../0.`'}.=m...s.....W..v..a(.'..%...o..3....B..^..T...Pi.y..&...#vsu......]f. ..

C:\Program Files (x86)\haxGhXjmBFM\app-3.8.0\2

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	10259456
Entropy (8bit):	7.999981843254581
Encrypted:	true
SSDEEP:	196608:FujahOnE0i9tvR2qD6NloPtwvqkvqWNK9yvttaKoLsR8br4a25+3sf:A2hLdf2g64P6vqkvkyAsc4a2asf
MD5:	69253681AD20E6606DFE7F596C7D9D5E
SHA1:	C0F72DD60F97C3A1AC4F064DA13DC250BE5DDDB1
SHA-256:	5368D1AB0A0371716E2E502882A8D8E4E222A3BD2732D60498491DFD7BE7ACE8
SHA-512:	015F2C506D434B6824EFFE361E34732B9354A9C45274CE0EAC529A7E7D546EF0E9157049AF54C7A81D4D7853AC9FB9F0A72851413ED714353D4B762D3593BB28
Malicious:	false
Preview:	...#v.,g.6...9..p9...0...j.....L{....Z"T...X..F.r....p....4jTx..zqw.0,.2/4..:......./9q.c..2Wu..67...j.b...'.....OA\?j...z..Y..4.m...n34.)...o..=7.Q.T..F..q...d(......,.......]9.1.d...;..^<G...`..#.V.@.}L......[...D....8.8./+...p.7......9.m.....u..+.v....U.4...Z(^.Wk...)n...m\|..U...;T=....3d.}....\../i ..m..V.>....!7_+..bC...%.3....0.@.....`.l"..a2.a..y$..9..^..+....G.R.\|......M..o...M..4......%.....!.....QO...[.v....M#.6e.k.8..d......k...t...X!..,.j.vq{..1....2....s"mJv...b.;.A......56..X...?.....I2y..[...4=.w.M....$#S.....D..q)...d.Rakb.......K.P...B.....'Y...W2...7.'x-.z:...r.7..H..p..e..{..j.O....V.E.R..ew...D.f.R...a......%}..uK"[6..v&A9.I.....Q8`.L......=b.....R._..W.Q.\:K,PGc..{u=..f.(.W..5"........~....?.=..uV...<i@.W0....E;.Y.8f.J..C.%..'...CDc%....s....8..1..UT3.........[uaj&f.7........G".#).x.u..1.P...).H.......?A^3.D.G...Q...x9Ok.O....$.).l....?...-..../0.`'}.=m...s.....W..v..a(.'..%...o..3....B..^..T...Pi.y..&...#vsu......]f. ..

C:\Program Files (x86)\haxGhXjmBFM\app-3.8.0\3

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	10003968
Entropy (8bit):	7.999978004677632
Encrypted:	true
SSDEEP:	196608:kh7QEwPYmoL7xtYVlw3eIiMwuMnZK/mqm/Q4kHrTFDcw7lNS8:+76/ofxanwpMnZK/tm/PcrZQWZ
MD5:	2AB15E06FBBC57756C08A8AD60D94961
SHA1:	990B96CC681232692C425D642F81420D41B917AE
SHA-256:	7DAA6333CEEE2C03B98EBE5AAEA3808920C3689C2708024BF61AFCE30613C21B
SHA-512:	BEF37FE0046110BCB2C0F51D9373A80855ED5F1A979788438F2919B87B227FE5FD2B0178C4FBC7B31B2EB79A8098F1CEDA393540645CE3E3A6947062D23567ED
Malicious:	false
Preview:	...#v.,g.6...9..p9...0...j.....L{....Z"T...X..F.r....p....4jTx..zqw.0,.2/4..:......./9q.c..2Wu..67...j.b...'.....OA\?j...z..Y..4.Uf..n34.)...o..=7.Q.T..F..p...d.f.....,.......]9.1.d...;..^<G...`..#.V.@.}L......[...D....8.8./+...p.7......9.m..n.?u..+.v....U.4...Z(^.Wk...)n...mR\|..U...;T=....3d.}....\../i ..m..V.>....!7_+..bC...%.#....0.@.....`.l"..a2.a..y$..9..^..+...G.R.\|......M..o...M..4......%....J$.....QO...[.v....M#.6e.k.8..d......k...t.x.X!..,.j.vq{..1....2....s"..e....c;.A......56..X...?.....I2y..[.fCj=.w....."$#S.....D..q)...d.Rakb.......K.P..F.....'....W2...7.'x-.z:...r.7..H.....e..w..j.O....V.E.R..ew...D.f.R...a......%}..uK"[6..v&A9.I.....Q8`.L......=b.....R._..W.Q.\:K,PGc..{u=..f.(.W..5"........~....?.=..uV...<i@.W0....E;.Y.8f.J..C.%..'...*CDc%....s....8..1..UT3.........[uaj&f.7........G".#).x.u..1.P...).H.......?A^3.D.G...Q...x9Ok.O....$.).l....?...-..../0.`'}.=m...s.....W..v..a(.'..%...o..3....B..^..T...Pi.y..&...#vsu......]f. ..

C:\Program Files (x86)\haxGhXjmBFM\app-3.8.0\LetsPRO.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	361472
Entropy (8bit):	6.2699558627001295
Encrypted:	false
SSDEEP:	6144:q3+3g/FnWgWsC/pFkmKexfC+zJbp7hwEGT5xZX5W24D:q3+3/pFKexfCyJl7hwEG75q
MD5:	2D822C8477099A4F8D149F19836312D1
SHA1:	99AD21DC488A792B4AEC261ACDC07653977CB1AC
SHA-256:	86D7138D7BDB97A56E33453EA11D77EAB605AB915E0A6CEB8C01CD905ECFBEA7
SHA-512:	8596D868920911145EF0BA4F62D2F6202984B73C13C53F0CC84674532745C9376F3DA72AE4E8E46CCF1FAFE951BFCA51795887AD41E0B83D50CC38D1AF4B5428
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......>.%7z.Kdz.Kdz.Kd...dq.Kd...dg.Kdz.Jd6.Kd]u6dc.Kd]u&d.Kd]u%d.Kd]u9dr.Kd]u7d{.Kd]u3d{.KdRichz.Kd........PE..L....{.^.................P...................`....@.....................................................................................X............`...$..........`f..................................@............`......,...@....................text....M.......P.................. ..`.rdata..&....`.......`..............@..@.data....i...@...0...@..............@....rsrc...X............p..............@..@........................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\haxGhXjmBFM\app-3.8.0\LetsPROCHS.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	5.230295397408638
Encrypted:	false
SSDEEP:	768:S3njn3FlxxCWfgi1HMr6LpJhDLSk3/M+b92cBYDM+:Injn3NxnXHtLpJhDLX3/fs9D
MD5:	49BA91865BCA5529A7EDDB369CB365E2
SHA1:	3FA9885F53183A9033B758DFB5758C10CB2B1565
SHA-256:	62D7DCD1B08D0BD2CB8B65A0374A810F2BD3D78679B6DD6A97AAFC1D6A215A58
SHA-512:	04E410B19FAAA1A9B7BDC71726EB13A2478B75EFEE681E571F42AD214B8A2B3EFC47C1E687E6242858DC81F5F711E31DD6B4032679DE877474B3BC72576EE07C
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......yY..=8..=8..=8.._'..?8..84..?8..84..)8..84...8..0..>8..=8..r8......>8..=8..<8...'..?8..84..<8..84..<8..Rich=8..........................PE..L.....f...........!.....p...P.......&..........................................................................................<....................................................................................................................text....b.......p.................. ..`.rdata........... ..................@..@.data...............................@....reloc..p...........................@..B........................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\haxGhXjmBFM\app-3.8.0\msvcp100.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	422040
Entropy (8bit):	6.600223717807955
Encrypted:	false
SSDEEP:	12288:AOb8zxr1aWPaHX7dGP5HrhUgiW6QR7t5qv3Ooc8UHkC2ebe:AOb8Fpa6aHX7dGP5Ov3Ooc8UHkC2ei
MD5:	ED40615AA67499E2D2DA8389BA9B331A
SHA1:	09780D2C9D75878F7A9BB94599F3DC9386CF3789
SHA-256:	CD28DAEDA3C8731030E2077E6ECCBB609E2098919B05FF310BEF8DCE1DCE2D8D
SHA-512:	47D94C5F4829A0F901B57084C22B24ADEFB4AEC2F7B8DF9EA838E485DBC607AA837ED6D3C7186159499C44A3FF488FB04F770C624649A406854D82CD3BAF72EE
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........e..d...d...d.......d.......d...d..Cd..K*...d.......d.......d.......d.......d.......d.......d.......d..Rich.d..........................PE..L....{.X.........."!.................<.............x................................1Q....@.................................<...<.... ...............V.......0..D;..p................................/..@...............p............................text...u........................... ..`.data...$:.......,..................@....rsrc........ ......................@..@.reloc...S...0...T..................@..B........................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\haxGhXjmBFM\app-3.8.0\msvcr100.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	774808
Entropy (8bit):	6.905201555700815
Encrypted:	false
SSDEEP:	12288:amCy3y9cSWI5vMBEWL3XU8+n6ODOlMFgvXmteA5RLTDz7sHA9p++/pj:amCy3acqvM6WL3XU8+n6ODxgf4eUH7Tt
MD5:	EF3E115C225588A680ACF365158B2F4A
SHA1:	ECDA6D3B4642D2451817833B39248778E9C2CBB0
SHA-256:	25D1CC5BE93C7A0B58855AD1F4C9DF3CFB9EC87E5DC13DB85B147B1951AC6FA8
SHA-512:	D51F51336B7A34EB6C8F429597C3D685EB53853EE5E9D4857C40FC7BE6956F1B8363D8D34BEBAD15CCCEAE45A6EB69F105F2DF6A672F15FB0E6F8D0BB1AFB91A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......:.y.~...~...~...w...}...~.......eD.....eD..+...eD..J...eD......eD......eD......eD......Rich~...................PE..L....{.X.........."!................,........0.....x................................tW....@.........................XI......d...(...............................$L..."..8............................E..@............................................text...!........................... ..`.data....Z...0...N..................@....rsrc................f..............@..@.reloc..$L.......N...j..............@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\letsvpn\AddWindowsSecurityExclusion.ps1

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	318
Entropy (8bit):	4.740682303463164
Encrypted:	false
SSDEEP:	6:IPeGgdEYC5BeGgdEEFmJovkBPeGgdEEFrGvkBPeGgdEEFwn0ZkBPeGgdEEFQr4MF:ISuFAuEcJxSuEJGQSuEyPSuESr1SuE6
MD5:	B34636A4E04DE02D079BA7325E7565F0
SHA1:	F32C1211EAC22409BB195415CB5A8063431F75CD
SHA-256:	A9901397D39C0FC74ADFDB95DD5F95C3A14DEF3F9D58EF44AB45FC74A56D46DF
SHA-512:	6EB3255E3C89E2894F0085095FB5F6AB97349F0ED63C267820C82916F43A0AC014A94F98C186FF5D54806469A00C3C700A34D26DE90AFB090B80AC824A05AA2F
Malicious:	false
Preview:	Add-MpPreference -ExclusionPath "C:\Program Files (x86)\letsvpn"..Add-MpPreference -ExclusionProcess "LetsPRO.exe"..Add-MpPreference -ExclusionProcess "tapinstall.exe"..Add-MpPreference -ExclusionProcess "uninst.exe"..Add-MpPreference -ExclusionProcess "Update.exe"..Add-MpPreference -ExclusionProcess "ndp462-web.exe"

C:\Program Files (x86)\letsvpn\LetsPRO.exe

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	245880
Entropy (8bit):	6.886887925864286
Encrypted:	false
SSDEEP:	6144:KZzvhs2Z4n1E7g34XtVYAOfTdxz44JsQwhUMht:KJ+2Z4nShVY5HUbUit
MD5:	EA9E2F517B1CC2DBE7F78302DD7FB593
SHA1:	CB326EEEE062BFC20BE4D07FA989B001811FC03C
SHA-256:	B1037F963C91AB0F586349D5AEDE8E25686784F46F031DFC422E0D69A9939F48
SHA-512:	D8D38E5243FF8F8E3F790C3587BF0360AFD7DD185886DA86AD7AD6111EED121E91ECA18BAC9563EA4E6984C46F88639F58A2073884567CA982383EC2CF32F0EB
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........e..O.S.O.S.O.S.).R.O.S.).R.O.S.).R.O.S.'.R.O.S.'.R.O.S.'.R.O.S.).R.O.S.O.S.O.S5&.R.O.S5&.S.O.S.O.S.O.S5&.R.O.SRich.O.S........................PE..L.....p_............................+.............@.......................................@.....................................<.......L...............x&.......!......p...............................@...............,............................text...8........................... ..`.rdata..V...........................@..@.data....#..........................@....rsrc...L...........................@..@.reloc...!......."...x..............@..B........................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\letsvpn\Update.exe

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1909368
Entropy (8bit):	5.908603687545887
Encrypted:	false
SSDEEP:	24576:DWltPuAnUCiag6CKM2zCy9sQuOjj1VgZej6GeS4lNrCze5qhYp4t9m245u:Kt3UCiag6CKM2zCyZuOjJaxSS5qhD
MD5:	BCCAB4171C138F69AFC883FEB75855D9
SHA1:	6D237686EEF63C9CB462EA014DA6418DA6AF1AD3
SHA-256:	1A88CB513D5AB867059A260EC2A25F914C450375C54BE2D8EACAE3D69CB5CF36
SHA-512:	0CC25E66B458FBE7A6B107CD2C55F7D14CC5F616118C02AF7F5FE46EBABAB85DC00D8932C9FC44896B1143D5BB8945962A9116D2FE77193EE8D17BD939148192
Malicious:	true
Yara Hits:	Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Program Files (x86)\letsvpn\Update.exe, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...5.p_............................>.... ........@.. .......................`......e.....@.....................................W.... ..................x&...@....................................................... ............... ..H............text...D.... ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B................ .......H.......LU..............,.................................................{......{......{....r.(......}......}......}........0..S........u......,G(.....{.....{....o....,/(.....{.....{....o....,.(.....{.....{....o.......0..K....... .A. )UU.Z(.....{....o....X )UU.Z(.....{....o....X )UU.Z(.....{....o....X..0...........r...p......%..{.......%q.........-.&.+.......o.....%..{.......%q.........-.&.+.......o.....%..{.......%q.........-.&.+.......o.....(........{......{....

C:\Program Files (x86)\letsvpn\app-3.8.0\CommunityToolkit.Mvvm.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	111736
Entropy (8bit):	6.285103598805169
Encrypted:	false
SSDEEP:	1536:wARI0MvSAA6U7ks4jhOWE8i6wrNMRjYAZlfNASZfSOi3jAwrx1:wWMpA6Agg8ahQYAZlFnUjhX
MD5:	983F5C1A6F9F50046521D5E393DB6527
SHA1:	80DA035F9D297D541E76EF2EC888E337C1A1291C
SHA-256:	4CDD18EA19E997BD83AC7AF716F7E371A84814CB631A5271E3FFAD7C08B83080
SHA-512:	8792E61BDACACD49DBB42CBA5F1DA33E92DC3AECFE9CE06727833565E570C3025DEC08D94D88088A8002D73D401DE61D9C1EE9CF2752024696853C5E0E01419F
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................" ..0..~............... ........... ..............................C.....`.................................a...O.......................x&..............T............................................ ............... ..H............text....\|... ...~.................. ..`.rsrc...............................@..@.reloc..............................@..B........................H.........................................................................{9.....{:...V.(;.....}9.....}:......0..A........u#.......4.,/(<....{9....{9...o=...,.(>....{:....{:...o?...... ..1 )UU.Z(<....{9...o@...X )UU.Z(>....{:...oA...X...0..b........r...p......%..{9......%q&....&...-.&.+...&...oB....%..{:......%q'....'...-.&.+...'...oB....(C.....{D.....{E...V.(;.....}D.....}E....0..A........u(.......4.,/(<....{D....{D...o=...,.(>....{E....{E...o?...... ...[ )UU.

C:\Program Files (x86)\letsvpn\app-3.8.0\DeltaCompressionDotNet.MsDelta.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	15480
Entropy (8bit):	6.856111272026683
Encrypted:	false
SSDEEP:	384:Vu/ZC45lzjNynsAw/98E9VF3AM+ozD4OHn:I/Z/lNAw/KENAMxzxn
MD5:	91B08E5F17BAD72376BBCB356510E295
SHA1:	59A6E5AE1C0A82D1D34C5638628C5D05B228CEAA
SHA-256:	29FAD127B5BA7ACBC284DBEFCCDEC8319C924BDA826FD134F3FD155E8D78B55B
SHA-512:	182ECBA1E421406013D9B101FAE188EE8508F067CFDF2AB41662C1D04BB577AAE208A9AB832D9780873C13522B5E52313EE180A867EAE870981FB4F44FE6C1EF
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...X.6S...........!.................-... ...@....... ...............................?....@..................................,..S....@..................x&...`.......+............................................... ............... ..H............text...$.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................-......H.......$!..l...................P .......................................h....X\|f.........+.j$....r.~.3i....m2.....'.\|..OZ.ep..)t?...P6c.<<Qe.M...M.0.B.(+.v.Kk!...Y.....H..7r.[(.r....J_.!.....l.0..,...............~.......j.j.j....... .(....-.s....zN.j...(....-.s....z..(....*BSJB............v2.0.50727......l.......#~..(... ...#Strings....H.......#US.P.......#GUID...`.......#Blob...........W?........%3....................................................................

C:\Program Files (x86)\letsvpn\app-3.8.0\DeltaCompressionDotNet.PatchApi.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	14968
Entropy (8bit):	6.8724284481921325
Encrypted:	false
SSDEEP:	192:nZ4RJdXpeNynC5c77bgfU5izh/y2sE9jBF3A5K+ohAbbvutmH:Z4Td5eNynsAw/98E9VF3AM+ohQmtmH
MD5:	531E7AF0A5DA8BEA25788BF0E0872DB4
SHA1:	E4AA85461F3DD312E0DD0AA8DEBE36933C210A17
SHA-256:	15F6B76F16DD7D7172E898A95A6B7A0C9A225C97180FCE76414E49280156A511
SHA-512:	D4750B68EA11303C034EDBED9814FE3953D7F9CCB2326EE1F7A3DAB4B0581B52220CF8D959E8BF3CB1AD15A95CFBC9C12FF6ACDA998DC338DE7CB0D90142BC4E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...X.6S...........!.................... ...@....... ...............................9....@....................................K....@..................x&...`......H)............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.......................H........!..D...................P .......................................!{.`DzN?...dr..1..9..NN/...[..t...2......C.......x..YCU......=....{.9W.J......^S.N;...iY........RBA......{..u..\~..1/M..^....~....(....-.s....zJ....(....-.s....z..(.....BSJB............v2.0.50727......l.......#~......`...#Strings....\|.......#US.........#GUID...........#Blob...........G7........%3......................................................................y............... .......y.....

C:\Program Files (x86)\letsvpn\app-3.8.0\DeltaCompressionDotNet.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	14456
Entropy (8bit):	6.834844211395946
Encrypted:	false
SSDEEP:	192:yYN8BSNynC5c77bgfU5izh/y2sE9jBF3A5K+org2J0yNtToT:yYMSNynsAw/98E9VF3AM+orLxTQ
MD5:	A59BA3472ED736E9BFB129743A345B61
SHA1:	D5AB09582378B32CBD6756F425528001182E07AF
SHA-256:	C2F35AD75058A919A3D7D2861E5DD400ED40F4BD1715B86BFB388B7C959E062E
SHA-512:	8792ED692F80308209B5CE2BB045AC777E4E1A4CE2647534792133786467B5BD9A91EAFFABB46A143D366546FD8E0DD03A12787E5557F2D566E4F0ED0BAC30E3
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...X.6S...........!.................(... ...@....... ..............................N.....@..................................'..W....@..................x&...`.......&............................................... ............... ..H............text...$.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................(......H........ ......................P ......................................%.&...Fm........f...Dj..[..(...:w........s4H.. ...p.+^z...;_....~.k...\|... ..q..+.cv.VZ.A.[[\|..m.0...w.._m.<0...d-.[.R.BSJB............v2.0.50727......l.......#~...... ...#Strings.... .......#US.(.......#GUID...8.......#Blob...........G.........%3............................................................................3.....G.....U.....n.........'...................................%.7.........

C:\Program Files (x86)\letsvpn\app-3.8.0\FontAwesome.WPF.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	219256
Entropy (8bit):	7.166815347300311
Encrypted:	false
SSDEEP:	6144:qxP7/P97ilHDqO01ktQOzB4YjDnX08RYA3fP5SChdR7:qxPpilHD+kQA4uk8RYA3fPdR7
MD5:	D8F7D0B6700F7F492B6320D5EEB883E1
SHA1:	93C8EFCA2E2827E90778B7D6361264F563C51CDC
SHA-256:	22529B1F03AAD3822CA97ABB77987E4291FF934F28A79D96F8C89765AEC9AB4D
SHA-512:	F1D0241634D2B1CC8B8BEDE97079787446B1DDEFC1C16C8CCE11CF46087C8DB0A27D6558ADDFC7F51A19B0F59C308CA02C2FD900A90F9CAE34D50C8348489DA9
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....nX...........!.....(...........G... ........@.. ...................................@.................................`G..K....`...............2..x&...........F............................................... ............... ..H............text....'... ...(.................. ..`.rsrc........`.....................@..@.reloc...............0..............@..B.................G......H........C..............D1......LC......................................F.~....o...........J.~..........o......0..E........u....-..t.......(....u....-...(............~....o...........o........0..T.......r...ps....re..ps.........r...p.....(.........(.................s....s....(.........*.0..G.............o....u....%-.&s......o....(...+(...+..,..#........o....+G.o....#........s....o...........o..........#.......?#.......?s....o....s.....s....%#........s....o....% h...ls...

C:\Program Files (x86)\letsvpn\app-3.8.0\Hardcodet.Wpf.TaskbarNotification.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	54904
Entropy (8bit):	6.146590353320115
Encrypted:	false
SSDEEP:	768:LfgAOG37OIh4Pqr8OvsQu4wwC9ZBMvAw/KENAMxQ45c:Lfgng6Ie1OvI4wwC98vAwrxQWc
MD5:	3EBDBAA742FBCE1F1DE3BFD8996D283E
SHA1:	983D3E363E320EC8FF7AD0033D2A82DCB7F1AB52
SHA-256:	35FCC46EB6A285114CEB2D4507F9ADD056C2F35D7F6806FEE8C89F6A07D4F1A6
SHA-512:	B8A1A54BB93207F131590FABB366C8CFD7DF1689C4B2FD0276BC20B1311F557B366D1E7864EE59F0AEEAE7EE2C5B55E738D1EA5B623787F65B4E170190DD9929
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...Kn.V...........!..................... ........... ....................... ......H.....`.....................................O.......X...............x&........................................................... ............... ..H............text........ ...................... ..`.rsrc...X...........................@..@.reloc..............................@..B........................H........O...s...........................................................0..b............(....-P....=....s......o....o.......(.....o....o.......(....s....s............,..o.....~..............7R.......0..).......(.......(....-.#.......?..( ......(!.......0..).......(.......(....-.#.......?..( ......("...*....0............s......o.....o...........o....-...(#....X...($.....+p.o.....3...(#......($.....(%...Y.Y..+J.o.....3...(#......(&.....(%...X.X..+$.o.....3...(#.....('...Y.

C:\Program Files (x86)\letsvpn\app-3.8.0\ICSharpCode.AvalonEdit.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	627320
Entropy (8bit):	6.133885864296396
Encrypted:	false
SSDEEP:	6144:wTTh6UXqQ0l0l2b4GQnn9lXNbOpIeQjDfjJcxm04FSh+0Nsj8X+iKbH2Yjotihp:oaQ0SnPNb8IbJImZo4LPp
MD5:	59CF0CA396CCEF48A9715D18B7E8ED63
SHA1:	0770040E8D5E5E21189340D04CE69B7700B19D3F
SHA-256:	A5FF5871F601002FA2C6B9D15B8494DB02759B998A62DD743043EC95ECC2E49B
SHA-512:	BC8CAAC647BBCB72FB2A5370506FDAE6EDF09551319883D7891FE6683F0451F0E6BD32E728665512AD3E8A6B043AD6603CFC9139B6DDE34404A18BC7BCDA4AAD
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....L..........." ..0..b.............. ........... ..............................e;....`.....................................O....................l..x&..............T............................................ ............... ..H............text....`... ...b.................. ..`.rsrc................d..............@..@.reloc...............j..............@..B.......................H...........<N...........a..`...(.........................................{w.....{x...V.(y.....}w.....}x......0..;........u;.....,/(z....{w....{w...o{...,.(\|....{x....{x...o}..... .7.^ )UU.Z(z....{w...o~...X )UU.Z(\|....{x...o....X.0...........r...p......%..{w..........>.....>...-.q>........>...-.&.+...>...o.....%..{x..........?.....?...-.q?........?...-.&.+...?...o.....(......{......{....V.(y.....}......}.......0..;........u@.....,/(z....{.....{....o{...,.(\|....{...

C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1481848
Entropy (8bit):	6.898867238546087
Encrypted:	false
SSDEEP:	12288:eRr7wtQGMT81pwbucOoEhbM5e++XJNMyfHPsb/yXfU6Qfd+NZDMxvJONjHtJEyZ1:eRrC2MyvgbFXs6QV+NaTAjHtKfYqF75M
MD5:	38973DBBFAD9619FDE39FAB919EB9A04
SHA1:	09C0B7EC430092C41A576565D8CF8E9DF40E12FE
SHA-256:	E7806CD45B774D640BFD1F92E0893D28B87117A9DC25EDB490DA4449D57CA8AC
SHA-512:	FED73EF38F0008AB93589A6F525866A3F73CE9B090E41482DC4933DADC6F1BCE1A26990E8F44704E934528D71E6887D0D44BB38F8B5402CF4C9B2880F16EEA67
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....l..........."...0.................. ........@.. ...............................z....`.................................E...O.......P............v..x&..............8............................................ ............... ..H............text........ ...................... ..`.rsrc...P...........................@..@.reloc...............t..............@..B................y.......H........x...............4..(.............................................{.....{+...V.(,.....}.....}+......0..A........u........4.,/(-....{....{...o....,.(/....{+....{+...o0...... .z.. )UU.Z(-....{...o1...X )UU.Z(/....{+...o2...X...0..b........r...p......%..{......%q.........-.&.+.......o3....%..{+......%q.........-.&.+.......o3....(4.....(5...^.(5..........%...}....:.(5.....}....:.(5.....}....:.(,.....}......(6.....(7.....J.{....%-.&.o8.....(5...*:.(

C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe.config

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	22737
Entropy (8bit):	5.008129188489306
Encrypted:	false
SSDEEP:	96:liBqrQGGJHowfGli6CkuMcuiuwuwu8ux0GReGWeGFuGgeKCUDuTeHOTu0U5e3eT4:liBqrUOpPUDRTHffIC
MD5:	3B1D12693EE14F307D7E8B1F08AE23C0
SHA1:	82719E54B457A4E5CC57B33714E67FC0305B6E90
SHA-256:	0B2A37670105E8D30FE0C4AECFAD876F669663834A6C91BC89E309FB609032B7
SHA-512:	AC7B99E0FB2E7D656DFC8E5DF1FAD58E4446C854E6D1D05A48DBD5FE93AB4978C3B206D828D8BCFC874EFF0981886BE4AE72E063AACCF895959D7CD5456A5E95
Malicious:	true
Preview:	.<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <configSections>.. <section name="EnvConfig" type="System.Configuration.NameValueSectionHandler" />.. <section name="Production" type="System.Configuration.DictionarySectionHandler" />.. <section name="Stage" type="System.Configuration.DictionarySectionHandler" />.. </configSections>.. <startup>.. <supportedRuntime version="v4.0" sku=".NETFramework,Version=v4.6.2" />.. </startup>.. <EnvConfig>.. <add key="env" value="Production" />.. <add key="adCampaign" value="" />.. </EnvConfig>.. <Production></Production>.. <Stage></Stage>.. <runtime>.. <assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1">.. <dependentAssembly>.. <assemblyIdentity name="SQLitePCLRaw.core" publicKeyToken="1488e028ca7ab535" culture="neutral" />.. <bindingRedirect oldVersion="0.0.0.0-2.0.3.851" newVersion="2.0.3.851" />.. </dependentAssembly>.. <dependentAssembly>.. <assemblyIdentity name

C:\Program Files (x86)\letsvpn\app-3.8.0\LetsVPNDomainModel.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21624
Entropy (8bit):	6.336409598826741
Encrypted:	false
SSDEEP:	384:d8KmV2K7tmrZoebmmbNynsAw/98E9VF3AM+oJYKFogX:22KZsuCBxAw/KENAMxOKt
MD5:	AAF315462A2BFC476F2488349B629B09
SHA1:	1957786412810C8200393F329925BF7F8FCB9FA0
SHA-256:	AF1328E99850C6A0F309B582C451E16AEC5B8446A57617198C96F353F7BA60BE
SHA-512:	FF1B9590653E1333F3031456D70169E789BEDF7A3A7B9C69F9076B99D080D6D6006E2812C831B603972445B097A1003F7FB84FC34CABF4EE97BA10CD09140B4B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....%............" ..0..&...........D... ...`....... ..............................Y.....`.................................OD..O....`..................x&...........C..8............................................ ............... ..H............text....$... ...&.................. ..`.rsrc........`.......(..............@..@.reloc...............,..............@..B.................D......H.......P#..p ..........................................................2r...p.(......(......(....6r%..p..(....6ru..p..(....2r...p.(....6r...p..(....6rg..p..(....2r...p.(....2r...p.(....:r...p...(.....rs..p......%...%...%...%...%....(......(....6r...p..(....2rn..p.(....2r...p.(....2r...p.(....2r...p.(.....rz..p......%...%...%...%...%....%....(....2r...p.(......(....2r...p.(....6r...p..(....:rI..p...(....2r...p.(....2r...p.(....6r...p..(....*6ro..p..(

C:\Program Files (x86)\letsvpn\app-3.8.0\LetsVPNInfraStructure.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	23160
Entropy (8bit):	6.508869841329569
Encrypted:	false
SSDEEP:	384:pGJjVa79cnXx4xnITI2c3t3g4KVFb6Y+ZeHNynsAw/98E9VF3AM+olSrlhIgZ:EjVNl9VFuzetAw/KENAMxML
MD5:	1B1C5FA9504EE5405B2DE4703832927C
SHA1:	5BD2EEB60A4E8ADC42BE27A886210D8277603DE1
SHA-256:	779283A943ACE8484C123C6F55995ABF1E403183CF3230842231A6A56419B830
SHA-512:	82FE09BB9EB35CB32928F716D1DCAFF5D75C6126D9AE892571486E997DBAC0CC79B4F58BF83AFE88E25A4877525256B3FA6BD226003BDB227980E8EEA7A6E7B7
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....x............" ..0..,...........K... ...`....... ...............................e....`.................................5K..O....`...............4..x&...........J..8............................................ ............... ..H............text....+... ...,.................. ..`.rsrc........`......................@..@.reloc...............2..............@..B................iK......H........$...%..........................................................2.(/...(....2.(/...(....6.(/....(......(....6.(.....(....6.(.....(......(....6.(.....(....6.(.....(......(......(....b.(/....(/...(.....(....v.r...p.(....(.....(/...(....2(.....(....2.(/...(........0.........................................................(/...~....(...+~....(...+~....(...+~....(...+~....(...+~....(...+~....(...+( ....($....(&...2.(/...((...2.(/...(...*J.(/....(/...(,.

C:\Program Files (x86)\letsvpn\app-3.8.0\Log\20240718.log

Download File

Process:	C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	228
Entropy (8bit):	5.170631483881668
Encrypted:	false
SSDEEP:	6:l95/tN5EfrOz+mAJXm1n9qdW8VRxDLM03fYn:l9du21sXpUULH3wn
MD5:	55F2CA873BDF55AE262883067317B0B0
SHA1:	9622AEDD724CC71707ED95A4D470213D8EC0F5A2
SHA-256:	0192F3130D33BB83B22104CD03EC54A5A7511646438275EA685C65F9A9CBB7DE
SHA-512:	F78B85FBDA252D4B286F66357F80AB7D9617797B03D3C2C9C130953A058DBE646B7D1ED2DED078ED88149E51AF26C0B4786509C24D5AE59677FE5E2106A00155
Malicious:	false
Preview:	2024-07-18 17:03:17,039 [Level: ERROR] [Thread: 3] [class:logger] [(null)]: SC-PusherHelper _pusher_Error ..PusherClient.PusherException: App key 4fc436ef36f4026102d7 not in this cluster. Did you forget to specify the cluster?..

C:\Program Files (x86)\letsvpn\app-3.8.0\Log\Lets.log

Download File

Process:	C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe
File Type:	ASCII text, with very long lines (8616)
Category:	modified
Size (bytes):	198222
Entropy (8bit):	6.003626212346796
Encrypted:	false
SSDEEP:	3072:0VT4TV8BtG+3pxoDCs7EEDlkVSvdr5YM6q6r1tqvC4fbFoLX/R3mOTwoBM:dV8BpbWC6hDewpKMHA1UFo7R3Sz
MD5:	FF089291D229871822EA0FF17C22E626
SHA1:	BE8785A2CFB808DFE31C6A8BA62DBBE197F8A8C1
SHA-256:	838D33416B7459E9F4F3AE1C51E1CC105B2B547E8418A32EBE57851F31DCE2CE
SHA-512:	2B3C4E52E5039061EEB9081A6DF0906C92F667AC0F8246A8700131ABCE6594BDDC07028D38BD2EDD72D53BB241168A4BD8A52637049EFF80BD3F74D4C035C61F
Malicious:	false
Preview:	TUhp7MNjt0uvbD6a6h1C+q9sp+tfrKMn4/s1fI5zkmNFrmuNS5vBPJ+QrA+0rqaNSmeqGhlk.TUhp7MNjt0uvbD6a6h1C+q9sp+tfrKMn4/s1fI5zkmNFrmuNS5zANJ+gvBGr57mCg/a4AKTSnQzuqrcuT0xvgwo+Psx3Zeg=.TUhp7MNjt0uvbD6a6h1C+q9sp+tfrKMn4/s1fI5zkmNFrmuNS5vBPJ+vpwmioLuKAN0P5Io/GQ1HtC5l1w==.TUhp7MNjt0uvbD6a6h1C+q9sp+tfrKMn4/s1fI5zkmNFrmuNS5PiB9OjvxirjqeKpZyuq33UvE3QrsTvn4C9AGZIQOqBJ/kFFy8nP5vBsEXz5agf2n79THOwUsioASepnI4v5pnNW16oS3ffpZQqVGifeCLzsXNmji8qf1+DyTwNY13roe2z9/seGCUF3C3MVkYFu1ftbT0hfG6BYlwG4ixaTHjRKFDCGIx0DX3tQEuhgz3pSqecvKswYE+k4ZcVu5F1T8Xo5j4aJ/CFy4pFHXli5CPIklVtlDJ7SRzhVQ9ZYwTmyAKg6Y8QQaD50GbwFv7Iytey6NYH2CHAFr6rHLpqp3s4xkUvHuTpVjFTJQl5ZxQaHF93HYve7tFqdcE7r1J9Sui1bUKjAIZ+mRLJZ8O3f0n7o6Ia8FXjmwp0VAtf5iM5jxkXyu8Wrl3r+pf7F2miwjyGX0yIJLZ0Jx53GIUMJePLWW+86F/Ib79zVKdccSKafBCHlPnpO3rTv9G7wonM5cNqhrwNSD3KX/FjjHt2ft2gb3U/yAYDB07oB7nBdaQgA+9jjTrsfCs4Jv1ST/BH.TUhp7MNjt0uvbD6a6h1C+q9sp+tfrKMn4/s1fI5zkmNFrmuNS5zhGdqovV2iqb+K/j7UGjQWsLnzRrOb9BrqxYzxrg==.TUhp7MNjt0uvbD6a6h1C+q9sp+tcpqgn4/s1fI5zkmsMMn0n0QcOea7FRR1iS+nXJbQG457

C:\Program Files (x86)\letsvpn\app-3.8.0\MdXaml.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	121464
Entropy (8bit):	6.2337379396282016
Encrypted:	false
SSDEEP:	1536:b0OQlavbPZKNK9hhmPZEMn5xGFE45N+cX8fZzd97WWhT5wNSAQr7YTFoVaoOT8TI:bb5vb/lmhMNGzWWhTdTK5N8shB
MD5:	57999A38944C58896E7CCC70497E7171
SHA1:	2DDB3B7407B122689797F3C9C904F971B4B6DD37
SHA-256:	5708009E0B57793B9B62DD1F7D40A67F1FD4A1B335A0E5A1B72208152FF4E917
SHA-512:	67A8C8996A5239782343AB0D5202B8189B117942D7847C055AEA1382C8ED74A57975B4B10BAB08D416BE651711BEB681038282CECD0A62D8EFB2D2AE9B748FA1
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....w..........." ..0.............R.... ........... ....................... ............`.....................................O.......................x&..........4...T............................................ ............... ..H............text...X.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B................3.......H........z..@...........,D...............................................(......0..l.......r...p.s.........( ....o!......s"....+%...n...%....o#.....~............o$....o%...%.-....,..o......,..o...........$.3W..........Ea......f~....-.(....~......o&.....{...."..}......{...."..}......{...."..}......{...."..}......{...."..}......{...."..}......{ ..."..} ...F.~!...('...t....6.~!....((.....{"..."..}".....{#..."..}#.....{$..."..}$.....{%..."..}%...*..{&...

C:\Program Files (x86)\letsvpn\app-3.8.0\Microsoft.AppCenter.Analytics.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	23160
Entropy (8bit):	6.538767765418332
Encrypted:	false
SSDEEP:	384:vH9ooU6Xrcnt9sXZ0WQb+Jx4veT6pmj7tkWUVMW9NynsAw/98E9VF3AM+o+KbMIN:vH9oR6XScb7Fj7t6FAw/KENAMx+I
MD5:	10ACC0A153A996EF5D3C04F6AB0618B0
SHA1:	3090EA541ED6B3FF860FBBFF2B4508B748E31A4F
SHA-256:	682E5F0F791FC37A0D3D5076347BAF8FAC47D1BDB87E06E527DD1D50B9094D9A
SHA-512:	16697F42CC76F50146F7F6A7F5ABC36A2F12FF2666480119EAD08F1FD2C35E38ED3BA37F73FD6C8B4655F0525BB64CEEAC3A7EE512B1B61E9BC31E5D1B2864A7
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...,.q..........." ..0..,...........J... ...`....... ...............................P....`.................................UJ..O....`...............4..x&..........@I..T............................................ ............... ..H............text....... ...,.................. ..`.rsrc........`......................@..@.reloc...............2..............@..B.................J......H.......`...............................................................0..H.........~....,...~....~..........(......~....%-.&s....%...........,..(..............#<.......0..%.......~..........(...............,..(.........................0..........~..........(....(....o....(...+....,..(.................".......0..0.......~..........(....(.....o.....(...+....,..(...............$.......0..).......~..........(....(......o.......,..(.........................0..C........(..

C:\Program Files (x86)\letsvpn\app-3.8.0\Microsoft.AppCenter.Crashes.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	51832
Entropy (8bit):	6.223529449682046
Encrypted:	false
SSDEEP:	768:2qr8YZ2IPJ1hCmfPzcscksOOWwp/fFCHUHGoH0w8eKYIySh6THAw/KENAMx0:23aJBOkAHaUm08eKYIITHAwrx0
MD5:	4BFFD1E801FA0EAA9D504E5DB4F473BC
SHA1:	CBA73E80ED5FD653BF2A3EF73A6F895B2F7044DF
SHA-256:	239CC6107617E36FE7C52B91FE52A1A6B4BE781A6F005D6B49C5BD5F18C2E323
SHA-512:	36AA88C80DECC6BCD0E7A48F0E2154332C66398B5E2F7AEA499AE9E5A83B2D1D00828E180587AC11EE2530500B758C7C1D9EAF30E05FB21CA7571CB11B8356D2
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..............." ..0.................. ........... ..............................".....`.....................................O.......................x&..............T............................................ ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B.......................H........D...t..........................................................&...(....2.r...p(......0..'.......~.........(....t............(...+...3...0..'.......~.........(....t............(...+...3...0..'.......~.........(....t............(...+...3...0..'.......~.........(....t............(...+...3...0..'.......~.........(....t............(...+...3...0..'.......~.........(....t............(...+...3...(.....(......(.....(.....(.....(.....s....zr.-.rM..pro..p(....*..

C:\Program Files (x86)\letsvpn\app-3.8.0\Microsoft.AppCenter.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	141944
Entropy (8bit):	6.0081838935191705
Encrypted:	false
SSDEEP:	3072:FXiDdWM0c7K9ES99d3+uVIQNlHK6Uav1vP8F6NhT:udWM0cW9EONvHKwvP8FEhT
MD5:	0381AB084F76D5FEA48557962B0BB2E1
SHA1:	EC1D7241455E75E3503AD8556875FA8B56606FE6
SHA-256:	8483EA93144B42ED18BC06401F083E7749DBAFB3299003318C6680F19DF85BBA
SHA-512:	3B75B9F025C82A91FF595060D031054937A9E3A3E74A7C70033BC2919C386192CBFDDF19159849AE792F7B573A84AFA1D7E707F609A678A36CB2F043F0B8D85A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....gu..........." ..0.............f.... ... ....... .......................`......6.....`.....................................O.... ..\|...............x&...@..........T............................................ ............... ..H............text...\|.... ...................... ..`.rsrc...\|.... ......................@..@.reloc.......@......................@..B................H.......H...........PR...........................................................0..H.........~....,...~....~..........(......~....%-.&s....%...........,..(..............#<.......0..%.......~..........(...............,..(.........................(g.....(h.....,..o.......(e...r...p(n....(......0..#.......~..........(.............,..(.......................0..#.......~..........(.............,..(.......................0..........~..........(....(....o....(...+....,..(........

C:\Program Files (x86)\letsvpn\app-3.8.0\Microsoft.Bcl.AsyncInterfaces.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	22648
Entropy (8bit):	6.621592333701651
Encrypted:	false
SSDEEP:	384:X/9b512C4dABe070VJI0Ftdalemxxf34wqsWeb/WjDNynsAw/98E9VF3AM+oj6Nb:X/f1IDjV9UPPpW5Aw/KENAMxm1
MD5:	28695371E53B0C96CE89F8520ECA40A2
SHA1:	A088D92BF15B3D2FEC3449495DCBA1F7DE0A864D
SHA-256:	23D9719E642875C08A10D447076E02E5020757BD649EB5A551FEF2579CD380CC
SHA-512:	36BB72ED4F9A77D4445DD20CF5D50DCFBDFD568323B41D1F9F6F9E82BC833A377D94064E47F21DC6E88595F0C12FBAD1F208D991DC6639332E529C064E00D096
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Q..........." ..0..&...........E... ...`....... ....................................`.................................[E..O....`...............2..x&..........hD..T............................................ ............... ..H............text....%... ...&.................. ..`.rsrc........`.......(..............@..@.reloc...............0..............@..B.................E......H.......4&.......................C........................................(......(.....0....................(....}.....6.\|.....(...+:.\|......(...+:.\|......(...+2.\|....(......{....%-.&.\|....s.....(....%-.&.{...."..(....>..}......}......0...........{....o........{....(....Z..}......}......}....N.{......{....s ...N.{.....{.....s ...v.{.....{....o!....{....s".....(...."..s.....0.....................s#...&...s#.....{$..."..}$...*.0..F.........{%....Xh}%.....}&.

C:\Program Files (x86)\letsvpn\app-3.8.0\Microsoft.Expression.Interactions.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	101496
Entropy (8bit):	6.104594124723951
Encrypted:	false
SSDEEP:	1536:Jrf5GttgxHXEuRmG5rtkGY4CEmWAxXSSYhhS98ca2Wvsd65FJDlGWwkEyTAwrxSX:p5GttWHXEUx5r65LxXshk8JDIWPThYX
MD5:	A62A7C17E4EC13739DA0597C7FA8091F
SHA1:	A3213C5D2AC6418853E412098CD3842264064573
SHA-256:	F643D7C305E08E44E2A43F1785AB685139E446CCFD892170083A0E9EE97D135D
SHA-512:	6DCFB50E817785422D6D7EC670B893BC3373B5F2EF9919DBBF4C2E0467151E4F772947FF17094F256D50E5464DD6DF380B20BA4545AB85FA7A548A7D76AF2BC2
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...eu.K...........!.....\...........z... ........@.. ....................................@..................................y..K....................f..x&...........x............................................... ............... ..H............text...$Z... ...\.................. ..`.rsrc................^..............@..@.reloc...............d..............@..B.................z......H...........L...........x...1...P ........................................z...y.k.....bdd I..`..).PsR@... .aL...%:...y.....XDgM.X}..~)2.v-..4..........EAZZ...,..[..H...o5C.o...5/I.m.!2...#.:.(......}....:.(......}.......0..)........{.........(....t......\|......(...+...3.....0..)........{.........(....t......\|......(...+...3."..(...."..(........{....,..{.....o.....{....o....2.~....(....6.~.....(....F.~....(....td...6.~.....(....J.(.....s ...}....*F.(...

C:\Program Files (x86)\letsvpn\app-3.8.0\Microsoft.Web.WebView2.Core.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	144504
Entropy (8bit):	5.770842043628873
Encrypted:	false
SSDEEP:	3072:0SiitDW10Oug94BeCCepM1STU/xnW+W6jfM0amyw0VzGLC1grekKtk0do/9o8afG:niNang9meCCepM1ST+xnW+W6jfM0amyS
MD5:	C40A81F1414AD5A3D1E99558F6829C29
SHA1:	D5CD9FE5816A0D8F5457D206522ED7CE53F90855
SHA-256:	C718C2ECC7471E689367A1164449F819C89D90D387D2C4B4B7163BC4EA89C68B
SHA-512:	EF91E23C581B1AA1811084EC6E51518D87D381FF3E34440CEFE2ECD522845FBDE85C8F7AD6F11AC8F29D3B3652D831AF97018F572CC0DFAD03E0D35C31F005C0
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...vJ.`.........." ..0..............$... ...@....... ...............................,....@..................................$..O....@..................x&...`......T#............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................$......H........q......................".......................................0..H.........(....o.........,....+..{.........,....(....o....s`...}......{.....+...0..a.........(.........,R..(....o......uQ........, .sd.....uQ........{....o6.....+...r...ps........og..........0..>.........{.........,%....{....ti...}.........ru..p.s)...z..{.....+.............$......&...}....z..}.....(.......}.....(.....>.(....o.......R.(.....-..+..o........0............(....o....(.....+..*R..(..

C:\Program Files (x86)\letsvpn\app-3.8.0\Microsoft.Web.WebView2.WinForms.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	29816
Entropy (8bit):	6.462202229749591
Encrypted:	false
SSDEEP:	768:qLNoCdzhFQj/hJTBbGXZDDcULH4JVrwRSgBucQgJa5/Zi/dUDyqz1POMreAw/KEx:qLqCHmTxGXZDDcULH4JVrwRSgBuvgJa+
MD5:	909CD9684A28B9FFC22BC26B674FD6CC
SHA1:	AD9DAE12B457BDA8E8B78689687FA1AD74D048EA
SHA-256:	A921A38CFAC6F5E2D21A088AB552AA5FA55060F583A7D11DE72493412B779F97
SHA-512:	941D4FB9A19DD6EADFD2DCD3F30E01EE30D3DC5D949B16200CF617C3421061798793A4E942377BA536138B54F7355D5485BEED967E2CE37CCD96A2B7F0E4D238
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...dCd..........." ..0..D...........b... ........... ....................................`..................................b..O....................N..x&...........a..8............................................ ............... ..H............text....B... ...D.................. ..`.rsrc................F..............@..@.reloc...............L..............@..B.................b......H........0..h0..................Da........................................(......{....>..}......}......{....>..}......}......{....>..}......}......{....-%..(.....(......(......s....(....}.....{....r.#.......?}.....(.....(I.....,..(....,..(....,..(.....{....,..{....o......(.....0..................s....(............s....(.....(.......?...s ...o!....(.......>...s"...o#....(.......A...s$...o%....(.......@...s&...o'....(.......B...s(...o)....{.......C...s...o+....{....

C:\Program Files (x86)\letsvpn\app-3.8.0\Microsoft.Web.WebView2.Wpf.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	32376
Entropy (8bit):	6.459354667799433
Encrypted:	false
SSDEEP:	768:0nD8wecsVygSvqa8ZDPLryER0SO4JVrTYIWUpDkS/Ka5/Bi/W7v4F4zfKw/Aw/Km:07eN4vqa8ZDPLryER0SO4JVrTYIWUpDh
MD5:	863C0350622B9E8C65BE99AF16938467
SHA1:	A39F18B311C01C3FA3A701A9C66F965DB0039649
SHA-256:	836F053B5F13EBEF5CDF0357EAE5BF6C6B228953C901CEDB055E4AACAE3E81CF
SHA-512:	C137286B8C1FCCB4EB7689A3E20D65D0023449F89FF55507DCF5EB0DC993463AA34465F13E96E6D21EC2C3363380B43165FE4E922409D4A2F985A783FDB9C3BF
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...]............" ..0..P...........n... ........... ...............................\....`.................................Gn..O....................X..x&..........xm..8............................................ ............... ..H............text....N... ...P.................. ..`.rsrc................R..............@..@.reloc...............V..............@..B................{n......H........5...7...................l........................................(....F.~....(....t:...6.~.....(....F.~....(....t:...6.~.....(....F.~....(....t:...6.~.....(....6.t.....}......{....-%..(.....(......(......s....(....}.....{......0..........r...p.:...(.........(............s....s....(.........r1..p.:...(.........(............s....s....(.........rO..p.:...(.........(............s....s....(.........J.s....}.....(....F.~....(....t....6.~.....(....*V.t....o....,

C:\Program Files (x86)\letsvpn\app-3.8.0\Microsoft.Win32.Primitives.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	14968
Entropy (8bit):	6.809510530383351
Encrypted:	false
SSDEEP:	192:DwTx8wVWhX3W5fNynC5c77bgfU5izh/y2sE9jBF3A5K+ojeV4zMj2D:MN9VWhX3WJNynsAw/98E9VF3AM+oj22D
MD5:	645C04387845327054400446DB0AB817
SHA1:	E4CAE78EC7134CEEA5A3203FE6744CB6EEC7D3C6
SHA-256:	8248B469E03A67C1AB28E4ADCFC164DF699C2A05287A4FCF1190803783400797
SHA-512:	4863B800704F3F2881B7DE62AEE2A273B397C745F3B3B496FE5E70C25F6669C795151DB561A71288B29F1DEC3AA2D1D582D1851E3928057AB9ADDFB03C487470
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...?..Y.........." ..0..............(... ...@....... ..............................b.....@.................................T(..O....@..0...............x&...`.......'............................................... ............... ..H............text........ ...................... ..`.rsrc...0....@......................@..@.reloc.......`......................@..B.................(......H.......P ..L....................&......................................BSJB............v4.0.30319......l...\|...#~......<...#Strings....$.......#US.(.......#GUID...8.......#Blob......................3......................................................\.....0...........D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.7...K.W...S.

C:\Program Files (x86)\letsvpn\app-3.8.0\Microsoft.Win32.Registry.AccessControl.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20600
Entropy (8bit):	6.638028593695809
Encrypted:	false
SSDEEP:	384:sSk7xWUHIx0S3WF7rWoNynsAw/98E9VF3AM+oMy8C8S7:s/0UHU0SOjAw/KENAMxie7
MD5:	377D115F6C642CD2F9978DABDF67750A
SHA1:	CF8506931A965E8FA297A2DCD8D955A86AD7AE9B
SHA-256:	6658D8C93D1EEBEA6919532EE1A1AF572AA821BC22426E608B6E1112D07DE809
SHA-512:	890161132D69FC39704BD5A78F3BDBF2C17C853A3293EE882FAB65C367CABE06886F40D5483771CF006B4C0C12C91BF16B3DF41133233349217C571D6D4C6EB0
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...9.2..........." ..0..............=... ...@....... ....................................`..................................<..O....@.................x&...`.......;..T............................................ ............... ..H............text........ ...................... ..`.rsrc........@....... ..............@..@.reloc.......`.......(..............@..B.................<......H....... "...............8..(... ;........................................(....^.(...........%...}....:.(......}....:.(......}....:.(......}....:.(......}......{...."..(...."..(...."..(...."..(...."..(......(......(......(......(....:.(......}......{....:.(......}......{....:.(......}......{......(....:.(......}......{....^.(...........%...}....:.(......}......{....z.(......}...........%...}....V.(......}......}......{......{....*V.-.r...ps....z

C:\Program Files (x86)\letsvpn\app-3.8.0\Microsoft.Win32.Registry.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	27256
Entropy (8bit):	6.3395269560306255
Encrypted:	false
SSDEEP:	384:A4nLpSumfSQrlHViaCZYvLPQmlJLfjnWn6GWnNynsAw/98E9VF3AM+oPoEP:A4QVrxViR9mlxd1Aw/KENAMxZP
MD5:	D1149413419F8FAA17F8DAAC9BF426E4
SHA1:	5544520C6E5659F7BE981F33449C7511008E27C3
SHA-256:	A166FC0D4508DE4F72AE3CE44996A5400E977A14C3F7686F08DE040D82A7E052
SHA-512:	33B160AAE010DF33B8227E91AF1D2B48315B57F162BAFA70029C46DB58E2BFC65C84F046A13F1C3F71427105CB71395D1795FA5D62CE391B67441E98FA7E93D7
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....j............" ..0..:..........jX... ...`....... ....................................`..................................X..O....`...............D..x&..........$W..T............................................ ............... ..H............text...p8... ...:.................. ..`.rsrc........`.......<..............@..@.reloc...............B..............@..B................LX......H........$..8"...........G.......V.......................................~......0..1.......(....,..%-.&...(.....o.......&...,...o....,.......................(....,.r...p......%...%...(......(.....(....,.r...p......%...%...%...(.......(.....(....,!r...p......%...%...%...%...(........(......,&(....,..r...pr...p.(....(......(......(....,.r...p......%...%...(.......(.....(....,.r...p......%...%...%...(........(.....(....,"r...p......%...%...%...%....(..........(

C:\Program Files (x86)\letsvpn\app-3.8.0\Microsoft.Win32.SystemEvents.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	23160
Entropy (8bit):	6.545020470277763
Encrypted:	false
SSDEEP:	384:6dIaf4rbDyIb/KcWCNRWr7JW9NynsAw/98E9VF3AM+oCj4:6+THDHbs6GGAw/KENAMxh
MD5:	2F72EF95302D63478A901955C495AEB1
SHA1:	B6B4B6C8006179D7C9745362C10A6EFEC1D128F3
SHA-256:	18943AB30CA90836F31DF4C466C5E1C71C1485F053D8417F33557073310D418D
SHA-512:	761BC12E2C50CDAC2DF37EEC471AFC1F1D70967A0DFEBC8543DB72F7BABBBB36EB8AA76252BAF92EC1319A804843B94467A6CC2D31ADA66D10C5AAD8618F7B8E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...8............." ..0.............H... ...`....... ....................................`.................................yH..O....`..d............4..x&...........G..T............................................ ............... ..H............text....(... ..................... ..`.rsrc...d....`.......,..............@..@.reloc...............2..............@..B.................H......H........$...............A.......G.......................................~......0..........(....,....(.....o.......&......................0...........(.......(....-..,....(....,.r...p......%...%...(......(.....(....,.r...p......%...%...%...(.......(.....(....,!r...p......%...%...%...%...(........(......,&(....,..r...pr...p.(....(......(......(....,.r...p......%...%...(.......(.....(....,.r...p......%...%...%...(........(.....(....,"r...p......%...%...%...%..

C:\Program Files (x86)\letsvpn\app-3.8.0\Mono.Cecil.Mdb.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	52856
Entropy (8bit):	6.215202027709334
Encrypted:	false
SSDEEP:	1536:dOr59g98C87KHeBUbwgKirbdwMRTzAt9lYAwrxv:dOr5HC87rUbwgKirJw1DlYh5
MD5:	D3D73A28845A20553410B9B10E89317F
SHA1:	2F13AB706E16D12A76272B25C4E07DF13EF4A5EA
SHA-256:	AA87E654FC57FA6111337310273AA9661982A95830574C8B4C9BC5E0B8CB39A6
SHA-512:	564DCDA299D2690224F2C3F316A10470DABB233D988024D25C57B6590F426A032D4FF2F1120306FFCA4553B09505521EEB8E143B87658422B0AD8D98B1044956
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....u-..........." ..0................. ........... ..............................A.....@.....................................O.......`...............x&..............T............................................ ............... ..H............text....... ...................... ..`.rsrc...`...........................@..@.reloc..............................@..B.......................H........a..x\..................@.........................................(....:...(....(....&...(...."..(...."..(...."..(......(.....0..,........o....o......o.....jo.....o.....o.....o......s....}.....s....}.....s....}......2}.....(.....s4...}....b.{.....o ....{....o!...b.{.....o"....{....o#...6.{.....o$....0..-........{....,.s%...z................s.......(.......{....,.s%...z.{....-..s&...}.....{......sS...o'.....{....,.s%...z.{.....o(.......oU...*..{....,.s%..

C:\Program Files (x86)\letsvpn\app-3.8.0\Mono.Cecil.Pdb.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	98936
Entropy (8bit):	6.38375290518156
Encrypted:	false
SSDEEP:	1536:cU2qJ+RazRt/Kc4oJiOxFR4NdJF0/RfhF46HAoYKHgPzpS6w7fa1C9rdAwrxS:r2MRtrfrR+Pe/xAiAzpQ7y1C9rdhc
MD5:	FE83571146F7F250C32AC0435353BB90
SHA1:	D84E1782AE2ED334674F866DAF98406553979C7B
SHA-256:	38CC717FD0CEF25E53C8531B005AC6AC6A86098C955EC7177EAA3070D93ED8AC
SHA-512:	FB2C05613DD16DDA8F7F1A564F7BA886458932DBE33314485F9512002B4D4070BFDDFF2E8BFF82DDDB6D772DCAB3EEB8F0061C982AC451E0ADEAD3D8E58F74D0
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....rd..........." ..0..T...........q... ........... ..............................r.....@.................................eq..O.......`............\..x&...........p..T............................................ ............... ..H............text....S... ...T.................. ..`.rsrc...`............V..............@..@.reloc...............Z..............@..B.................q......H.......<s.......................p......................................:.(......}......{....-...{....(.....{......o......{....-...{....(.....{......o........0..a........s....}.....s....}.....o....o.....+(.o......{.....o.......(.....o......(.....o....-....,..o..............".4V.......0..J........o....o ....+"..(!.....{.....o.......(.....o".....(#...-...........o.....*........../;.......s$...z.s$...z.s$...z.s$...z.s$...z.s$...z.s$...z.s$...z.s$...z.s$...z.s$...z.s$...z.s$.

C:\Program Files (x86)\letsvpn\app-3.8.0\Mono.Cecil.Rocks.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	37496
Entropy (8bit):	6.4026225767468805
Encrypted:	false
SSDEEP:	768:V+meiCyrXOwS8uRssveum1peFLHFBbOuAw/KENAMx5:4yrewFassveuPbBCuAwrx5
MD5:	554E3722844EA9B90A222882AB725A54
SHA1:	B585777D3CF89B7031757C9BF9991780C05439B0
SHA-256:	3484C79998D69E6DEC8B82CCEBE1772B49D768DA339746D860989CA829A55BCA
SHA-512:	54668FDECAC4C7CFB5C244263B6679AB7471D6E57DD4EBE323C5CB3547B11E8F16F224935181A255F845A0F7C7F70047CAEE255D02E143372A171C6C722EF8F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....i............" ..0..d............... ........... ....................................@....................................O.......l............l..x&..............T............................................ ............... ..H............text...4c... ...d.................. ..`.rsrc...l............f..............@..@.reloc...............j..............@..B........................H.......,A..\@..........................................................J.(.....s....}......F.(......E.(....z.{.....To.....:o....&...(.....0..a.........M.(.....o....,,.{.....`o.....`o....&.{.....o....o....o....&.o....,...o....(.....(....,...(......-.r...ps ...z.o!...,%.o"...r...p(#...-..o"...r#..p(#.....n.{.....~o....&..o$...(....z..P.(.....o%...,...o&...(......{.....(o....&.........s'...(...+.{.....)o....&*..0..3........o(.......YE........3...........m...&...`...

C:\Program Files (x86)\letsvpn\app-3.8.0\Mono.Cecil.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	354936
Entropy (8bit):	6.236515779838891
Encrypted:	false
SSDEEP:	6144:TFzzF5VOCxfiKKhsw4NiL0XRzx9WoCklyusQhK:xdfiKI4RzWSyuTK
MD5:	8598D18CE01699B7BD3BC5E343B6B7A5
SHA1:	BF7B3FEC9FD1C1A32883A558C802414912F2AC52
SHA-256:	7BB560C48EFD6942BA4E775AE6C41324EF17D9F5731F41A9EBF6DA14CF9C559F
SHA-512:	EC6F4839D4FE0BDB8EADA3CC351BB75D6617A02CE2ACBD83339D5523DA924A1EDF0A1111A857599CDA08ECF41595F5DEB11C0F4F0C178C645F8F3824EFE3AEE7
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...i.}..........." ..0..<...........Q... ...`....... ....................................@..................................Q..O....`..H............D..x&...........P..T............................................ ............... ..H............text....:... ...<.................. ..`.rsrc...H....`.......>..............@..@.reloc...............B..............@..B.................Q......H........b..@...................DP......................................"..s0..."..s0...>..}1.....}2.....{1....O...,..{2...,..{1....O...o&...2..O....3...6.r...p.(4.....(5.....}6......i.O...}7....{6....{7.....i(8.....}9...2....i.(:...>..s;.....(<...V..{7....{6.....(=.....0..1..........Y./....X.[......(=.........(=..........(>.......0.._..............+P.../5.../..{9......O......O...o?....0.....%.X..O....O...+.....%.X..O....O.....X....2.*z...X...b...X...b`...X..b`...

C:\Program Files (x86)\letsvpn\app-3.8.0\Newtonsoft.Json.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	709752
Entropy (8bit):	5.9589163441732715
Encrypted:	false
SSDEEP:	12288:ABja5bBvR8Q0TE2HB0WLmvXbsVG1Gw03RzxNHgKhwFBkjSHXP36RMGy1NqTUam:ABjk38WuBcAbwoA/BkjSHXP36RMGvm
MD5:	4ABA39E3B609F3E927D4B4C850A1E9C2
SHA1:	2FC88FDFE44F49567A4160FC7CEBA175BBE851B3
SHA-256:	ABF8133F5BDA0AA4700B7B4B9A8F4A6E2AF8F9FC38DEF6EBBEC7045FDA493671
SHA-512:	CDD79270D8E0E7999B899D32FC012E0450D65732B68EBA982B91F213E6550D5568239EB29267ADEFBD61EA4E674C1096D04A1A6CBBF67FD51E6D8B8AB2770F07
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...p$?..........." ..0.............B.... ........... ....................... ............`....................................O.......................x&.......... ...T............................................ ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B................$.......H.......x...(9............................................................(......(....^.(...........%...}....:.(......}....:.(......}......(....:.(......}......{......(......(....:.(......}......{.....(.............}.....(......{.....X.....}......0...........-.~.....~....X....b...aX...X...X..+....b....aX....X.....2.....cY.....cY....cY..\|....(......._..{........+,..{\|....3...{{......(....,...{{.....{}.......-.....0...........-.r...ps....z.o......-.~.....~....

C:\Program Files (x86)\letsvpn\app-3.8.0\NuGet.Squirrel.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	519800
Entropy (8bit):	6.039245282613648
Encrypted:	false
SSDEEP:	6144:QRKflaWVRA6+LX9c1t3HpbOmhYIeDUQjcaPlq1fQx7NqEaElDp3sL2blV/VyUd9A:QRt6+A1pbOsBQAa4f0pWSbb+1ikMk
MD5:	116231FF6DC4B9F72EF79443DCECF880
SHA1:	EB59A634653DFF12A835A6D37C403A420CC31AEB
SHA-256:	23A42F65BFA7F11612FE506F2C99F4EF98F6B19DEDC33A72E474D439F7B97ECF
SHA-512:	0BC3E48FE06DAE564C65389743FA7EF785759C4D889F6D86C3343AC4F785D266B6B4028C032FF47EFFB37BA09627FE4DC6053A9F8C7E485F658D3ED8555FA39B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....p_.........." ..0.................. ........... ....................... ......s.....`.....................................O.......................x&........................................................... ............... ..H............text...$.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......Xw...............r...i............................................{E.....{F...V.(G.....}E.....}F......0..;........u1.....,/(H....{E....{E...oI...,.(J....{F....{F...oK..... .... )UU.Z(H....{E...oL...X )UU.Z(J....{F...oM...X.0..b........r...p......%..{E......%q4....4...-.&.+...4...oN....%..{F......%q5....5...-.&.+...5...oN....(O.....{P.....{Q...V.(G.....}P.....}Q....0..;........u6.....,/(H....{P....{P...oI...,.(J....{Q....{Q...oK..... .2;. )UU.Z(H....{P...oL

C:\Program Files (x86)\letsvpn\app-3.8.0\PusherClient.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	52344
Entropy (8bit):	6.24207394845658
Encrypted:	false
SSDEEP:	768:p2xghQUndJrmbnJAM6LjB4Mz5k+/FdS0/MuLs/09P24Aw/KENAMxaH:pGghQaJiFAMAhH/Dw/09O4Awrxc
MD5:	97B577FD2529CADDFA7AB924AE6D7882
SHA1:	2546925FD8F3F53DEB668E7A63C518A89E4CF480
SHA-256:	25457828703339A584098231FC662074349C847A4D233F25012D3C4A957FCE85
SHA-512:	62E718073582C32B38E67351E49A69D1DC51B6171A97E6FDC490F9F43A98B78E56C817DBC80595A7A01F4A5868C510ED4DDD5CBA65CE27FA59700E0EE51487A4
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................" ..0................. ........... ....................................`.....................................O.......D...............x&..............T............................................ ............... ..H............text........ ...................... ..`.rsrc...D...........................@..@.reloc..............................@..B.......................H........M...o............................................................{......{......{....r.(......}......}......}........0..S........u......,G(.....{.....{....o....,/(.....{.....{....o....,.(.....{.....{....o.......0..K....... ..,. )UU.Z(.....{....o....X )UU.Z(.....{....o....X )UU.Z(.....{....o....X..0..{........r...p......%..{.............-.&.+.......o ....%..{.............-.&.+.......o ....%..{.............-.&.+.......o ....(!.....{"...:.(......}"......0..#...

C:\Program Files (x86)\letsvpn\app-3.8.0\SQLite-net.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	103032
Entropy (8bit):	6.180568405496724
Encrypted:	false
SSDEEP:	1536:FdAKzGN0ifSJxFlm+FpoHloqUIdmJlllf07gllfUzb1kUyN1e/rWhsCMbdynB5AF:1bcl5mJlllf07gllfUzb6W/+b+O5h2
MD5:	95C9E2150B7D0872F2EC6C9F7BCFF5A2
SHA1:	1AE7EC90D958B8A2EABB5CCC9490C45B45A0C4C2
SHA-256:	ABE8058C79E04C33485AD1777E7FC6280B78BA284F2C2D4D3B1C92A1A8556356
SHA-512:	D1786311B8AE36A0B1D66DE0E0ADD52C179267A7D06F8C29098E188CB24E50F60AAC078222C54444326340CA4FD9BAD920275360A7464CD41FD1F6C2EE1397A7
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...#............" ..0..b..........&.... ........... ..............................7.....`.....................................O....................l..x&........................................................... ............... ..H............text...,`... ...b.................. ..`.rsrc................d..............@..@.reloc...............j..............@..B........................H.......@...x.............................................................{...."..}....>..(......(...."..s......{...."..}..........(......0..?.......s........}\|......(.....,%.{\|...,...o...........s....(...+(...."..s....*....s....R.o.....o......s......{...."..}......{!..."..}!.....{"..."..}".....{#..."..}#.....{$..."..}$.....{%..."..}%.....{&..."..}&.....{'..."..}'.....{(..."..}(.....{)..."..})...rs................. ...(......0..................

C:\Program Files (x86)\letsvpn\app-3.8.0\SQLiteNetExtensions.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	47224
Entropy (8bit):	6.175052532806355
Encrypted:	false
SSDEEP:	768:6qRdLDFPhe5rHMgWVCMlh8Xlrmyac4yPeZrZ3QAw/KENAMxUUpO:6qRdL3e5rHMgWVTnyac4oeZrZ3QAwrxM
MD5:	6BB159781FE0DA78220C968E9143371E
SHA1:	A977689D646FA95C032D475252642F2135439687
SHA-256:	43F8D9F50D12A919EDF836D43E046697759FA8BD08B6B5619B7843698796928B
SHA-512:	2234CCD400C7379E0C18A8E1763C32FB57B6A8722149B40B699E2D0E1823FBEF7AB14958FC8B6928E4A4A3929CA852FCAEAAAB53E055003713DC849156975EFE
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...:. Z.........." ..0.................. ........... ...............................T....@.....................................O.......L...............x&..........\|................................................ ............... ..H............text........ ...................... ..`.rsrc...L...........................@..@.reloc..............................@..B.......................H........K...Y............................................................{......{....V.(......}......}.......0..;........u......,/(.....{.....{....o....,.(.....{.....{....o...... ...E )UU.Z(.....{....o....X )UU.Z(.....{....o....X.0...........r...p......%..{.....................-.q.............-.&.+.......o.....%..{.....................-.q.............-.&.+.......o.....(......{...."..}......{...."..}......ra..p......%...%...%...(....( ......0..M........o...+..,...

C:\Program Files (x86)\letsvpn\app-3.8.0\SQLiteNetExtensionsAsync.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	23160
Entropy (8bit):	6.488970940191523
Encrypted:	false
SSDEEP:	384:n90wriHD7R3d4Q5ENmiL31SAAh1OSxJJssUJqgG/232nd4l4ue8NynsAw/98E9V3:90w2j7R3d4Q5ENmiL31SAAh1OSxJJssO
MD5:	66B36EDF336C23AB87149375D53769EC
SHA1:	AC90EF7F19A8787B78A25533F990E19C924AB73D
SHA-256:	72EC85CBA532E7A140EE88DEB4008EF181D225C9E5F5F65796DC2758666B7E9F
SHA-512:	4E7644B547D0AB7A53CD98F79FD05BDC3F4E4DFAF165E3523D700F4E653EB6044A8B13AFE96650C8A031A2F59D2AC4CAA61ED3B3AC464AB232088BECA8991205
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....g..........." ..0.............H... ...`....... ....................................@..................................G..O....`..\|............4..x&...........F..T............................................ ............... ..H............text....(... ..................... ..`.rsrc...\|....`.......,..............@..@.reloc...............2..............@..B.................G......H.......8)...............................................................0..:.......s.......}......}......}......}...........s.....{....(...+...0..:.......s.......}......}......}......}...........s.....{....(...+...0..:.......s.......} .....}!.....}".....}#......$...s.....{ ...(...+...0..:.......s%......}&.....}'.....}(.....}).........s+....{&...(,......0..B.......s-.......}......}/.....}0.....}1.....}2......3...s+....{....(,...F...(...+...(...+*.0..B.......s5.......}6.

C:\Program Files (x86)\letsvpn\app-3.8.0\SQLitePCLRaw.batteries_v2.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	15992
Entropy (8bit):	6.728419895417078
Encrypted:	false
SSDEEP:	192:4vyW1ESCmPkcpu3NynC5c77bgfU5izh/y2sE9jBF3A5K+ouJJkzW6I8N:46x4u3NynsAw/98E9VF3AM+ouJF67
MD5:	851F16AB2784B91A65CD0D78D8613451
SHA1:	BB0AE59BC1B1BCB11287D816BF5644C4014AC61E
SHA-256:	B57A653953AC23FB837306CE4DF5AA23DBB9BD0B2D555F6BA11D111715BFCD18
SHA-512:	9BDDC111257D817E834E84B899B0215B88F17D3FD92D59CCE96781BD781E6561AAA3112C120FDC418789BE386F5E395DC9123EA17A0011CE87A2CF9B6EC338D4
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0..............,... ...@....... ....................................@..................................+..O....@..X...............x&...`.........T............................................ ............... ..H............text........ ...................... ..`.rsrc...X....@......................@..@.reloc.......`......................@..B.................+......H........ ..<...................(.......................................(......0...............(....o........(....s.......0............(.......(....s....(....2r...p.(....:.(......}.......0...........{.......(....,..~....*BSJB............v4.0.30319......l.......#~..,...x...#Strings............#US.........#GUID.......p...#Blob...........W..........3..........................................................9.........[...............................c.....c...{.c...>.c.....

C:\Program Files (x86)\letsvpn\app-3.8.0\SQLitePCLRaw.core.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	56440
Entropy (8bit):	6.2382477050936815
Encrypted:	false
SSDEEP:	768:y0GhwEvUmz5IR5tUe9CiXmEkzKeGIsNif11gNsNj8cIjqabmAw/KENAMxLS:AlIR56kCckz2DhiNIchabmAwrxLS
MD5:	B76B6155F2004763186F65FDBDA59811
SHA1:	47449EFCC02D8DC7130C546128FCDD8F16299BF9
SHA-256:	AF144D9066A817A4241926A547C32C3DF03396D4DEF4E5B1EF99B0010A315BBD
SHA-512:	BC47013C1ED7D1430980A4093D495207753992373BFA868ABA7487E20DC401477B29BA9441F712B0A67BEDA29664F3EB025DA0D071D37702DFC1638609BFC14D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....d............" ..0.............B.... ........... ....................... .......>....@.....................................O.......(...............x&..............T............................................ ............... ..H............text...H.... ...................... ..`.rsrc...(...........................@..@.reloc..............................@..B................".......H........=.....................t.........................................(......(......(...........Z~....,..o...&.............b~....-.r...ps....z~.....(#...o ....0..........(#......o!.....(....Q6.(.....(%....0..........(#........o".....(....QR.(.......(....('...:(#......o'...N.(.....(.....()...2(#....o#...2(#....o$.....o......o....2(#....o%...2(#....o&...6(#.....ok......0..........s.......}.....{....-...+........s.......(1...6(#.....ol...*6..(....(3..

C:\Program Files (x86)\letsvpn\app-3.8.0\SQLitePCLRaw.nativelibrary.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	19576
Entropy (8bit):	6.608908681745045
Encrypted:	false
SSDEEP:	384:hKX0gijditBKMBRBHsEQoNynsAw/98E9VF3AM+oHIsR9:hKkVRiBB80Aw/KENAMxoQ
MD5:	E6B1C9832E7D7EBE444DF72963DFE20D
SHA1:	813CDB594AC008D23B5743B91688AF80C37CCD8C
SHA-256:	F4EFCE1292266D7314EF9EB66AA080C1D8BA51202676E40D9F07F972D665E0E3
SHA-512:	DA87C94AA6BFB4B0BF6EA627D4B916CCE43031ADED22CC114A1D47B3F3E7653D2E3BCC501DDD1632AF256CA03A5F41817AD047676EE448C5F60403336D9B3C34
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....D............" ..0..............:... ...@....... ....................................@.................................X:..O....@..d............&..x&...`......L9..T............................................ ............... ..H............text........ ...................... ..`.rsrc...d....@......................@..@.reloc.......`.......$..............@..B.................:......H........%.......................8.......................................0..K..........~....%-.&~..........s....%.....(....%~....(....,.r...p.r...p(....s....z..0..#.......(......-...(......3...(....s....z...(....%~....(....,.r)..p.r...p(....s....z..0..#.......(......-..(....&..3..(....&s....z..0..7..........~....%-.&~..........s....%.....(.........~....(......0............(.........~....(......E................+$r9..p.(....rI..p.(....rc..p.(....*s....z...0..........

C:\Program Files (x86)\letsvpn\app-3.8.0\SQLitePCLRaw.provider.dynamic_cdecl.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	66680
Entropy (8bit):	6.00238132489741
Encrypted:	false
SSDEEP:	768:IMXMG2QW0RgqGlel80eX3xFhofnnN+HHHHns6sbEpyqJW6N0yAw/KENAMxWch:P2UTGlel80eXSfnUnM6sbwXN0yAwrxW+
MD5:	A09E315538D93305A166791131F81361
SHA1:	A7DC6E7D5960A69C348BABC5934DB02BC8462B99
SHA-256:	7921AE603F4A562D9AB1C398E32A2115BE26B4DABE4E22D188ABBCE23F38B599
SHA-512:	EEC5A95FCC50D815454E074037D6B89122DA6688D545BB0D8CB6F28EF44ADC5ECD201BA3FCB716EE591460684B0486A2CDF9B04F550790B4BC6E1C83D0F5FCDD
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..............." ..0.................. ........... .......................@............@.................................R...O.......................x&... ......4...T............................................ ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc....... ......................@..B........................H.......dB..P...........................................................6.......(.....~....F~H......on......N........s....o...+..0............(........~......o.....0............(........~I.....or....0..%.........(..........(........~J.......ov.......0..H.........(..........(........~K....oz............(....(.........{........o....2~#....o....2~"....o....2~F....of...6~G.....oj...:~H......on...2~$....o....2~%....o....>.(.......o.......0..N........,........s.....

C:\Program Files (x86)\letsvpn\app-3.8.0\SharpCompress.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	463992
Entropy (8bit):	6.214137039521393
Encrypted:	false
SSDEEP:	6144:bcGv7iCPwqEYosfdBtmXaxWoXY06nQk2zLRC+oRZkR4CDy2sqIT0czX1hlmQ:H+CoCoCBtmXWnL6nd2ZiUR4WylT0qblJ
MD5:	5662E267D359FD7ED6289BE382DE343F
SHA1:	CDFDC6FC05F03947365EF578BE4DA85E5E8CC8BC
SHA-256:	EF3A01AC0439BE2F6AF01FD9AF1CB7F3EF5AF6B04CCA9CDA50DB92A01654C23E
SHA-512:	6FF80065D9791FE782323631BDE3A580B39E49E3489207A0DED23851F7B41ABEB3F3512CAC789CDE4E3C503E6DDA3620532DE524C133C655F14AE88BE67D6253
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...._]..........." ..0.............v.... ... ....... .......................`......W.....`.................................$...O.... ..................x&...@..........8............................................ ............... ..H............text........ ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B................X.......H........f..D[............................................................(G..."..(H...&...(I.....(...."..(....&...(....r.,.~......~...... ...._X..n.,.~.....~...... ...._X..R..2.~.... .....X..F..2.~.....h.X..R..2.~.... .....X..R..2.~.... .....X...0..A.........{.......a}......{.......a}......{.......a}......{.......a}........0..(..........?_d....1...n_....{.....Y.?_b`.{...._.0..@..........{.......(....}.......{.......(....}.......{.......(....}....*.0..5...

C:\Program Files (x86)\letsvpn\app-3.8.0\Squirrel.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	277112
Entropy (8bit):	6.039424501039368
Encrypted:	false
SSDEEP:	6144:PbwZzM/arIPizbgQtYYYncnWDOsksHgtBwsbe+/uAh6:4zM/arIPizxUncQfZHg6
MD5:	4397B20D7CB5B5FF1D52773AF487DBE8
SHA1:	EDE3B69095C6202B7E1FB287F258C5C38311B5F7
SHA-256:	282419516A91B9AD48B23A8DF6B854EF13B6E3BD8FF7F3BD7D17667C3FBF31FB
SHA-512:	88ADBB4891DD17B7F0015FC1435088ABCC9A91265AA95E312302E98A1520EB1C7D6CA2660CF2B26110C28AF6DFCA8C7D1AEE11C8E870105303858914F87112DC
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0................. ...@....... ...............................D....`.................................e..O....@..................x&...`......x)..T............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.......................H.......X... .............................................................{0.....{1...V.(2.....}0.....}1......0..;........u......,/(3....{0....{0...o4...,.(5....{1....{1...o6..... ... )UU.Z(3....{0...o7...X )UU.Z(5....{1...o8...X.0..b........r...p......%..{0......%q.........-.&.+.......o9....%..{1......%q.........-.&.+.......o9....(:...V!..../c...s;..........{...."..}......{...."..}......{...."..}......{...."..}......{...."..}......{...."..}......(2.....

C:\Program Files (x86)\letsvpn\app-3.8.0\SuperSocket.ClientEngine.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	51832
Entropy (8bit):	6.136217669083162
Encrypted:	false
SSDEEP:	768:DDGXmBiIOJv2IIXs4UOPhbY+m/rihAt5A8o4/aBS8XpTt/yO0ysAw/KENAMxHj1:DDGXmBiXanx+zehk/WpB/yO0ysAwrxHh
MD5:	E802889435C83177701191C65708D596
SHA1:	9427D6F279067E1DD13D211A9906FF312D69EBC0
SHA-256:	877FFB102B436632F06C040FD53FC43601E09180983C9084C873EDB32A3B30D3
SHA-512:	68A91FDE0A1EACF55F6E6DE2E1E8A765D23C4FAA288F2271EABEE07FB7F125C2CFE63444AFAD17640AEB8E56C9E6DCD9A3A6D6F6577EC7314CF12BF754072FE7
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...h@qZ.........." ..0.............~.... ........... ..............................q.....`....................................O.......................x&........................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B................^.......H........O...g..................(.......................................&...(....6.......(....:........(.......~....%-.&~..........s....%.....(......0..@........(....s.......o......}.....s....}.....{......i.....o......}.....0..............(.....`,........0..Q.........R.{....u......o......{ .......i2...R...{........\| .....X.(!....................0..............("....`,........0............R.{....u......o......{ .....o#......X......i1...R...{........\| ......(!.....

C:\Program Files (x86)\letsvpn\app-3.8.0\System.AppContext.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	14968
Entropy (8bit):	6.77459369317133
Encrypted:	false
SSDEEP:	384:2DNxWQFWbNynsAw/98E9VF3AM+o1M7ueBX:2DNVgAw/KENAMxCBBX
MD5:	2213F7CE29F2B7F456EAA6E9352BD17D
SHA1:	1965BC2BDD76BE418E885F313BFF41845E973158
SHA-256:	071DE9846D7F1F409B7D25E6D450ADF497820F186C0B7C5F4D752A060AB2A7EC
SHA-512:	93FB447E90FA741D9B098BB0E1A51840A0A350E49E57327F0E70118FDF4FB16A70DD9FD09D8F9EC858BB01F0FE5DDA1DF7CB40C644E0E60C0EC9DFE2D597C40E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...?..Y.........." ..0.............f(... ...@....... ...............................[....@..................................(..O....@..................x&...`.......&............................................... ............... ..H............text...l.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................H(......H.......P ......................\&......................................BSJB............v4.0.30319......l...\|...#~..........#Strings............#US.........#GUID...........#Blob......................3......................................z...............\.....0...........D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.....K.N...S.

C:\Program Files (x86)\letsvpn\app-3.8.0\System.Buffers.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21624
Entropy (8bit):	6.640539397833699
Encrypted:	false
SSDEEP:	384:3rMdp9yXOfPfAxR5zwWvYW8anNynsAw/98E9VF3AM+oSrWKbSSS:3rMcXP60Aw/KENAMxXT
MD5:	254364F3304693D4B23CD62A1896675C
SHA1:	92311456382F24C89D140BA788EE106A776E5FA6
SHA-256:	F1FA2EDC4326120E49347B1A284B59DA121A8D771B2B0C8124A9B77143FA4F47
SHA-512:	9ED3C4EE91F92AB76EFD29F5C39F0F82FD474DD23422472F1CAD349C951A183CB0ABBF275E4B8CBB67BA77CC7C4052A25D8BF133DB5BFD299D1DB2B17B921EC5
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....jM^.........." ..0..$..........BC... ...`....... ....................................@..................................B..O....`..@...............x&...........A............................................... ............... ..H............text...H#... ...$.................. ..`.rsrc...@....`.......&..............@..@.reloc...............,..............@..B................$C......H........'...............?..X...8A......................................j~....%-.&(....s....%..........0..$.........(.....o.......&...,....o....,.....................,!(....,..r...p.(....(......(......(....,.r...p......%...%...(......(.....(....,.r...p......%...%...%...(.......(.....(....,!r...p......%...%...%...%...(........(.....~....2r...p.(....B.....(.........R.....(...+%-.&(!...^.....("....(...+&~.....s$..."..s%.....(&........0......................

C:\Program Files (x86)\letsvpn\app-3.8.0\System.CodeDom.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	28792
Entropy (8bit):	6.24391973293469
Encrypted:	false
SSDEEP:	384:OdgrnDxt3942O1NEIY3lzZIcKBxehzsCtZ7U6r1fDXJx/WpuWRNynsAw/98E9VFv:OgXxtu5jEIYDhzZpmvAw/KENAMxnV
MD5:	558A30EAB0FAD5DBF1172C70CD181DCD
SHA1:	AB072544F83FBBFC7AD8D0E16F3B7FB692DFA1EA
SHA-256:	70D8B7440C34914571C73F798696D7FBE701F8191C0AF4A8E018BF5DF6FA7895
SHA-512:	D2804D4341421CFD5159424CA611707DF5FA53342F6F1DA8ED681B1538D1A35F755E42763127C982A7211B2850DE02716EE64F39F7E39863634FC4D3DCEF0473
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...dP'..........." ..0..>..........\... ...`....... ...............................N....`..................................[..O....`...............J..x&...........[..T............................................ ............... ..H............text...0<... ...>.................. ..`.rsrc........`.......@..............@..@.reloc...............H..............@..B.................\......H........#...)...........L.......Z.......................................~......0..........(....,....(.....o.......&......................0...........(.......(....-..,....(....,.r...p......%...%...(......(.....(....,.r...p......%...%...%...(.......(.....(....,!r...p......%...%...%...%...(........(......,&(....,..r...pr...p.(....(......(......(....,.r...p......%...%...(.......(.....(....,.r...p......%...%...%...(........(....*.(....,"r...p......%...%...%...%..

C:\Program Files (x86)\letsvpn\app-3.8.0\System.Collections.Concurrent.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	14968
Entropy (8bit):	6.8735509430409145
Encrypted:	false
SSDEEP:	384:um2igOWnW8rW4NynsAw/98E9VF3AM+oaE+J0:etvAw/KENAMxo0
MD5:	FEC6162CEC4301C313EC6DBFF8B7B5B5
SHA1:	F78836B0BA052DD234A3FCE1F8AA43B7389AE331
SHA-256:	B4F3CC73F77BC0F58C458F91C368073375FAD6F5D8D7B2A3DDDF9CF11E30F3BC
SHA-512:	0DECB372B2C75004AB0BBBFC2CCCF3189D6B395520C5EFDE542C2656F81A5FA34D7D8934E654D840D3C916072A78B1FF6CADEB4EA362988EC7F1FC9B381CA047
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...?..Y.........." ..0..............)... ...@....... ...............................H....@.................................t)..O....@..D...............x&...`......<(............................................... ............... ..H............text........ ...................... ..`.rsrc...D....@......................@..@.reloc.......`......................@..B.................)......H.......P ..l....................'......................................BSJB............v4.0.30319......l.......#~..d.......#Strings....@.......#US.D.......#GUID...T.......#Blob......................3................................................n.o.....o.....\...........8...3.8...P.8.....8.....8.....8.....8.....8.....1.....8.................V.....V.....V...).V...1.V...9.V...A.V...I.V...Q.V...Y.V...a.V...i.V...q.V.......................#.....+.....3.....;.....C.:...K.Z...S.

C:\Program Files (x86)\letsvpn\app-3.8.0\System.Collections.NonGeneric.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	14968
Entropy (8bit):	6.86741460235784
Encrypted:	false
SSDEEP:	384:Onapn1iwwPWcGWeNynsAw/98E9VF3AM+ooBJAM:NDuaAw/KENAMxJM
MD5:	CACCDA8F568D710D5424F5E919358E21
SHA1:	BB00E0D6FF30C03CBCE0FFC53BE16E8E906B1308
SHA-256:	E1BCC32A6FA3208D50CDB8EE80600F5FF2009AB4082E4EAA2649425D74C9C599
SHA-512:	BEE277C32F0FC9698B1285AF3A9AD27B25ED618D52B8E17EF31CFE000F87556A811089755A270B7B6B0C1CF4338A2487A1221FAB65CEC1421362BE08D9ADF325
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0..............)... ...@....... ..............................j.....@.................................p)..O....@..@...............x&...`......8(............................................... ............... ..H............text........ ...................... ..`.rsrc...@....@......................@..@.reloc.......`......................@..B.................)......H.......P ..h....................'......................................BSJB............v4.0.30319......l.......#~..t.......#Strings....<.......#US.@.......#GUID...P.......#Blob......................3................................................F.o.....o.....\...........,.....,...(.,.....,...f.,.....,.....,.....,.....%.....,.................V.....V.....V...).V...1.V...9.V...A.V...I.V...Q.V...Y.V...a.V...i.V...q.V.......................#.....+.....3.....;.....C.:...K.Z...S.

C:\Program Files (x86)\letsvpn\app-3.8.0\System.Collections.Specialized.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	14968
Entropy (8bit):	6.872903906738809
Encrypted:	false
SSDEEP:	384:oHLaEav5aaUa6arWVLWlNynsAw/98E9VF3AM+oSDP:lPv5t/NOgAw/KENAMxi
MD5:	A57B0FE607CA76EB4C052A6AFAE2C18F
SHA1:	6E12823941D47CB65C271AE9EB330D336DB8329A
SHA-256:	74350CDA3AED948496419BC32CBF190B99A0FC80EA8A8F874E11BD77F6235C38
SHA-512:	E3D5101815CF8CDF6D94DEC659F12916CE6DAFAACCA3150BBBAB416334D06777A231E66B659352222438197F7912ED8A3850CB1CB7044E28B1739D4D4B1EE69E
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...?..Y.........." ..0..............)... ...@....... ...............................,....@..................................)..O....@..P...............x&...`......P(............................................... ............... ..H............text........ ...................... ..`.rsrc...P....@......................@..@.reloc.......`......................@..B.................)......H.......P .......................'......................................BSJB............v4.0.30319......l.......#~..........#Strings....T.......#US.X.......#GUID...h.......#Blob......................3..................................................`.....`...t.M.................................=.....V.................q.....Z...................G.....G.....G...).G...1.G...9.G...A.G...I.G...Q.G...Y.G...a.G...i.G...q.G.......................#.....+.....3.....;. ...C.;...K.[...S.

C:\Program Files (x86)\letsvpn\app-3.8.0\System.Collections.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	15480
Entropy (8bit):	6.724372444145475
Encrypted:	false
SSDEEP:	384:f6iIJq56dOuWSKeWWNynsAw/98E9VF3AM+obtwAL:1iAKAw/KENAMxbf
MD5:	795CF4074277275FF807FCED0A172E21
SHA1:	E2A8448A44E3BFFA31B35FD195A6DE36B8C72EBD
SHA-256:	B6276E6F1E2E96517FDC143D7027888878EC27960D9DD1FB089756EFC0CBD95C
SHA-512:	EEC15A3BE51B13318268EFFFE107255D472B785552EE9F9B723AC50EF7D9E708EF60469EAA118029E01701EF521B4485B20D1138CA84400CA51D2C72A3CB077E
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...?..Y.........." ..0................. ...@....... ....................................@....................................O....@..................x&...`......L)............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.......................H.......P ..\|....................(......................................BSJB............v4.0.30319......l.......#~..\|.......#Strings....\.......#US.`.......#GUID...p.......#Blob......................3................................................k.~.....~.....k..............0....M...............................#..........x...........e.....e.....e...).e...1.e...9.e...A.e...I.e...Q.e...Y.e...a.e...i.e...q.e.......................#.....+.....3.....;.....C./...K.O...S.

C:\Program Files (x86)\letsvpn\app-3.8.0\System.ComponentModel.Annotations.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	36984
Entropy (8bit):	5.904008481655895
Encrypted:	false
SSDEEP:	768:3XDQsPurQcR3y6JOnSHDYFD6Aw/KENAMxp5s:3zPtcE6JhHEF2Awrxp5s
MD5:	550641351E26B6B9B22B4F51C0762E29
SHA1:	018D4D70F4D1D092E3DB3DEDE4327B960EEF013A
SHA-256:	F3E16AC3A24D18639A6B703D356D6ACFC3F48B2E7928D020251490A637DA99FF
SHA-512:	9F48E5F48DC87FBA13D4F2A34DB84B3CD23C4C27F1F6A20D1A574559DFA8C1F5DE240BB957128349F525E527C9EC326BCE08CFEF508C041957BD04A5D388B0CB
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....>.Z.........." ..0..Z..........Bx... ........... ..............................B.....@..................................w..O....................j..x&..........8w............................................... ............... ..H............text...HX... ...Z.................. ..`.rsrc................\..............@..@.reloc...............h..............@..B................"x......H........$...............R.. $...v......................................j~....%-.&(....s....%..........0..$.........(.....o.......&...,....o....,.....................,!(....,..r...p.(....(......(......(....,.r...p......%...%...(......(.....(....,.r...p......%...%...%...(.......(.....(....,!r...p......%...%...%...%...(........(.....~....2r...p.(....2r=..p.(....2r}..p.(....2r...p.(....2r...p.(....2r%..p.(....2r]..p.(....2r...p.(....2r/..p.(....*2r...p.(...

C:\Program Files (x86)\letsvpn\app-3.8.0\System.ComponentModel.EventBasedAsync.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	15480
Entropy (8bit):	6.778406374492553
Encrypted:	false
SSDEEP:	384:Anzz+MpSaLWW0+WnNynsAw/98E9VF3AM+o0Xz9B:uputAw/KENAMxc
MD5:	F590C1B41614FB794B68EC1497A7C97A
SHA1:	651887EE9D4CFF6906440ADCE0589492B15FCE21
SHA-256:	38C6719E86C192979B29D7BF63CD87D9A92048FBA3D59670FC31E58D89FC8509
SHA-512:	FC80FEE83E8D68B09D97A67444AD91C08C26F60DD47148306F860EF9E12168404DB619C288EECA99F577A0C002C4654A6B6E3B03BEFCD997A62AEABA693B039B
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0.............B... ...@....... ...................................@..................................)..O....@..................x&...`.......(............................................... ............... ..H............text...H.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................$......H.......P ......................8(......................................BSJB............v4.0.30319......l.......#~..t...@...#Strings............#US.........#GUID....... ...#Blob......................3............................................................V...........j.................i...........8.................S.....<...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.'...C.B...K.b...S.

C:\Program Files (x86)\letsvpn\app-3.8.0\System.ComponentModel.Primitives.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	15480
Entropy (8bit):	6.832687898258876
Encrypted:	false
SSDEEP:	384:cGhr+YUfyHxsW/HW4NynsAw/98E9VF3AM+oMInF4aC:7kmjAw/KENAMx127
MD5:	BD5DEAF58D3DC293B45248C053EA4BD7
SHA1:	6D441813A724BBC8D872B77A567076E377FC89E3
SHA-256:	4D69FACD43279D56CC6F93BEADDB7EC127781263AC8D8A5B6CD6DBC91866776D
SHA-512:	D603135DAC5CA34525022419269713DAE3EC8F33110FEAF4E3281CD8320FD79D44D7B935F7916EC7B12A5430B2CA3844CAC68E332213C527A84FF0AF0E280425
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0..............+... ...@....... ....................................@.................................<+..O....@..`...............x&...`.......*............................................... ............... ..H............text........ ...................... ..`.rsrc...`....@......................@..@.reloc.......`......................@..B................p+......H.......P ..4....................)......................................BSJB............v4.0.30319......l.......#~..........#Strings............#US.........#GUID...........#Blob......................3................................................Y.]...{.]...6.J...}.....r........... .............................................................D.....D.....D...).D...1.D...9.D...A.D...I.D...Q.D...Y.D...a.D...i.D...q.D.......................#.....+.....3.....;."...C.=...K.]...S.

C:\Program Files (x86)\letsvpn\app-3.8.0\System.ComponentModel.TypeConverter.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16504
Entropy (8bit):	6.765671889329864
Encrypted:	false
SSDEEP:	384:xRE+ruiA5vzWeNWqNynsAw/98E9VF3AM+ouAYS7W:xS9bPAw/KENAMx1+
MD5:	44FF6F8782AEB7D1688A141FE778AC39
SHA1:	015F15A91FA59C13919A87DD48F4717E3AFE9460
SHA-256:	618EE4C4F475985CAB36B2DAB9D581A06A2CE674E2FD97BB8D4BD954929B8E79
SHA-512:	6C5A034AF5B5FF48EC72D8F1759D22E0ED9C5C0D585777BDA94CCEF8913C49936E27E2539621986CA11AAD494A859C7E1B3B382BA77AFE5911207327DA040300
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0............../... ...@....... ....................................@................................../..O....@..p...............x&...`......T................................................ ............... ..H............text........ ...................... ..`.rsrc...p....@......................@..@.reloc.......`......................@..B................./......H.......P .......................-......................................BSJB............v4.0.30319......l.......#~......@...#Strings....T.......#US.X.......#GUID...h.......#Blob......................3................................;.....Y.........8...........<...........P.......................X.....q.....g................."...................I.....I.....I...).I...1.I...9.I...A.I...I.I...Q.I...Y.I...a.I...i.I...q.I.......................#.....+.....3.....;.%...C.@...K.`...S.

C:\Program Files (x86)\letsvpn\app-3.8.0\System.ComponentModel.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	14968
Entropy (8bit):	6.818732069090683
Encrypted:	false
SSDEEP:	384:LT+6ywnVvW0LW6NynsAw/98E9VF3AM+oTU0JU:L99lAw/KENAMxw4U
MD5:	7DAB2F45205D7D0C85BF3E6D403FA49B
SHA1:	054B241A9772A0EFFD146954F2ABEB130DBB99D1
SHA-256:	5200136C28B73FC99BD891B0EA5F217330E8F75A129AD607210B8742151CD72E
SHA-512:	A36D1D7055AE3AEAB6643196763CD546DF0D9D002E5C939D79CED94FF7B819437BE7E6FE03AB1A5D31C4653EF542DA73ED2A2677B80FBAEB897FF0E266C96E03
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0..............)... ...@....... ....................................@..................................(..O....@..................x&...`......\|'............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................(......H.......P .......................&......................................BSJB............v4.0.30319......l.......#~.. ...h...#Strings............#US.........#GUID...........#Blob......................3......................................................\.....0.....7.....D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.2...K.R...S.

C:\Program Files (x86)\letsvpn\app-3.8.0\System.Configuration.ConfigurationManager.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	86648
Entropy (8bit):	5.358004923240595
Encrypted:	false
SSDEEP:	1536:z8KGCEPg1QqF3BhejEpvS/ZFQ+2/NVQ8GLa0Uh55T3lEC/IOPbZkxqN4bENZJlfZ:gHCXBheNQ+2/NVQ8GLa0Uh55T3lEC/Ii
MD5:	25D763FB9890BD82AA539E7F909FE57A
SHA1:	E269A8DB99AA27B3C046E1468B7F1E9DFC14346F
SHA-256:	88B0CB0CB299630DD15E3273494117475CF17ADF529BE7828F45596E4AE192E3
SHA-512:	DCFD94774B05AD821642E4C0FEC217B952FDD86CEEE0BAA5C02B610802EC48843FEED9D962DD61BFA17340B717D9A20684DE34B4E73C092BFC00596921B7AF1C
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................" ..0.. ...........?... ...@....... ....................................`..................................>..O....@...............,..x&...`.......=..T............................................ ............... ..H............text........ ... .................. ..`.rsrc........@......."..............@..@.reloc.......`.....................@..B.................>......H....... ,..$...........D....}...=.......................................~......0..........(....,....(.....o.......&......................0...........(.......(....-..,....(....,.r...p......%...%...(......(.....(....,.r...p......%...%...%...(.......(.....(....,!r...p......%...%...%...%...(........(......,&(....,..r...pr...p.(....(......(......(....,.r...p......%...%...(.......(.....(....,.r...p......%...%...%...(........(....*.(....,"r...p......%...%...%...%..

C:\Program Files (x86)\letsvpn\app-3.8.0\System.Console.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	14968
Entropy (8bit):	6.812037029375057
Encrypted:	false
SSDEEP:	384:oRbzriaXT+WlEWaNynsAw/98E9VF3AM+oQaZ7l:e7ic8Aw/KENAMxTVl
MD5:	1CE048150D6091C4C0DC57F9FB94EB45
SHA1:	A3076597F6DFE6C5E360B627E510319A5EE18D63
SHA-256:	5B632D0D330F0B231500B07DB681BE6427DD27E28F07D375F673EC62F79701E0
SHA-512:	72331983F23AE0054688FD2078C44A8411F870FAB43D77CEFB81EBD2CA50409644498C5930B6A8E598FBC36AE0314036F4F88BBB56097B4F7179738496D6C3E8
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0.............6)... ...@....... ..............................o.....@..................................(..O....@..................x&...`.......'............................................... ............... ..H............text...<.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................)......H.......P ......................,'......................................BSJB............v4.0.30319......l.......#~..H...x...#Strings............#US.........#GUID...........#Blob......................3......................................................k.....?.....$.....S.................R...........!.....j...........<.....%...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.+...K.K...S.

C:\Program Files (x86)\letsvpn\app-3.8.0\System.Data.Common.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	148088
Entropy (8bit):	5.408035922689741
Encrypted:	false
SSDEEP:	3072:LdYO+3m9R6e1x03BZ6bDSzZ8B0uAP+jh2:F+2jv1x0ebezWiuNh2
MD5:	CC515178BBB4D973A808FF1ACDBB0FDA
SHA1:	E05CD9BA5A69820EBD87D0845F90C1025D5D3AC0
SHA-256:	FE6E4BE207AD1F3CD36B755136994244C410518A62B1DD450EDAF36E5222C368
SHA-512:	2DD4F4A0A411D57CE3914AF230AC4DEFD0C1B0F9E19E7C1AEE4950E8B941EF84446A3A4E8A72C9DFA13850D4AF1C1432D908DC688D9464B6F8AE63C99FB55C95
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z.........." ..0..............,... ...@....... ...............................u....@..................................,..O....@..................x&...`.......+............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................,......H........A...............?..h...t+......................................j~....%-.&(....s....%..........0..$.........(.....o.......&...,....o....,.....................,!(....,..r...p.(....(......(......(....,.r...p......%...%...(......(.....(....,.r...p......%...%...%...(.......(.....(....,!r...p......%...%...%...%...(........(....2r...p.(....2r;..p.(....2ro..p.(....2r...p.(....2r...p.(....2r...p.(....2rK..p.(....2r...p.(....2r...p.(....2r...p.(....*2rM..

C:\Program Files (x86)\letsvpn\app-3.8.0\System.Data.Odbc.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	81528
Entropy (8bit):	5.90549354585071
Encrypted:	false
SSDEEP:	768:HsCikxiUPLkOWoYSAkm4fHLofFv9Rit9zzv5dnCRAw/KENAMxs3:MfkxBIOYSq4/2biHrnCRAwrxs3
MD5:	DFA5382ED433D8D7BA396F42C9C043D7
SHA1:	95F9DAA75CD45055DA67354809E090C6BC33F12C
SHA-256:	52FB5D3F26234D2A49C5C46DCB25E4F475E1B5EABE46B9FCFFB02377992719BA
SHA-512:	3AA2F839F335DBC3F8D84EF382CDAEC912AFE5720FB1923BB08B7E8709F0BB43A8B85B7842B0E128BC1781E7C2CD83061479E06CE6F6796DC045B502EAE6C990
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................" ..0.............&... ...@....... ....................................`..................................)..O....@..................x&...`.......(..T............................................ ............... ..H............text...,.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.......................H........(...I..........0r..@...p(.......................................~......0..........(....,....(.....o.......&......................0...........(.......(....-..,....(....,.r...p......%...%...(......(.....(....,.r...p......%...%...%...(.......(.....(....,!r...p......%...%...%...%...(........(......,&(....,..r...pr...p.(....(......(......(....,.r...p......%...%...(.......(.....(....,.r...p......%...%...%...(........(.....(....,"r...p......%...%...%...%..

C:\Program Files (x86)\letsvpn\app-3.8.0\System.Data.OleDb.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	99448
Entropy (8bit):	5.769431873746904
Encrypted:	false
SSDEEP:	1536:n+kZKluk7ZFrtpAauVXrbtYC/xBu9LCAwrx3:n+kzk7p4rbtYC/xBOChB
MD5:	8A9555DEAEC6917897B6EAA8768F973F
SHA1:	8A23A8916CC77084D0F600460FF539EBD396F40D
SHA-256:	3F9EDFFF372148A88965FCB7EA52C5670F8822B33143ABD4E9F50F4E72E99CFD
SHA-512:	54ABD0C206F87D7585CADDBFEA85318138706CC21524D06E14E9E8F94ECE8CD70F1880005D30BB3D626B72311BC1B15903696EAA020A7393955553A522C24A2B
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0..R...........p... ........... ....................................`..................................o..O....................^..x&...........n..T............................................ ............... ..H............text....P... ...R.................. ..`.rsrc................T..............@..@.reloc...............\..............@..B.................o......H...........^..................Pn.......................................~......0..........(....,....(.....o.......&......................0...........(.......(....-..,....(....,.r...p......%...%...(......(.....(....,.r...p......%...%...%...(.......(.....(....,!r...p......%...%...%...%...(........(......,&(....,..r...pr...p.(....(......(......(....,.r...p......%...%...(.......(.....(....,.r...p......%...%...%...(........(....*.(....,"r...p......%...%...%...%..

C:\Program Files (x86)\letsvpn\app-3.8.0\System.Data.SqlClient.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	223352
Entropy (8bit):	5.664777098255565
Encrypted:	false
SSDEEP:	6144:FXFpBZBJL3rBxad7/bAkGF60FhFoFmF8cjcsc4FEFbFgcbFmFiF6FhFuFBFuFDFe:RFRf60FhFoFmF8cjcsc4FEFbFgcbFmFe
MD5:	BCF9441FA3D95BC20A9379AD9150782C
SHA1:	11893105FB07FC1E0C8E67D274E778A95A3D16A4
SHA-256:	28B53AC8453BBF387DFACB5614A911C374778DD78F382A754B9314DB8DB22136
SHA-512:	2D84B50FD5338F3A283213882B70EB839FE4F3049B0821AB35F76532E8FF805B1DA84336CDF664E0FF561CF2671FB9B2CF57A202AD3175AB9DE17D0E391951FC
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0..8...........W... ...`....... ....................................`..................................V..O....`...............B..x&...........V..8............................................ ............... ..H............text....7... ...8.................. ..`.rsrc........`.......:..............@..@.reloc...............@..............@..B.................V......H.......h7..............@...XW...U..........................................0..1.......(....,..%-.&...(.....o.......&...,...o....,.......................(....,.r...p......%...%...(......(.....(....,.r...p......%...%...%...(.......(.....(....,!r...p......%...%...%...%...(........(......,&(....,..r...pr...p.(....(......(......(....,.r...p......%...%...(.......(.....(....,.r...p......%...%...%...(........(.....(....,"r...p......%...%...%...%....(..........(....

C:\Program Files (x86)\letsvpn\app-3.8.0\System.Diagnostics.Contracts.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	15480
Entropy (8bit):	6.784096265441681
Encrypted:	false
SSDEEP:	384:DRtRWjYWwNynsAw/98E9VF3AM+onGJAIkgeK:LiGAw/KENAMxGJAr9K
MD5:	E504E04C1F6BBE1019C5DEAED70262C3
SHA1:	B6628759063DDF8AFD38E375A278923029044244
SHA-256:	5194414591D27227984FAD79C0258E5D566C5D54C1E38B669B191DDEC92CA57B
SHA-512:	B5EDC2F7E94CE024DB81BBE32679D07FE5E5CBF0D5C5CA8CFAC2955E841FEDA278F101389476E65ADF18BCA5D3674E6C108DF5D8A917997B60C65DABDB0CBB30
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0................. ...@....... ...............................8....@.................................x..O....@..@...............x&...`......@)............................................... ............... ..H............text........ ...................... ..`.rsrc...@....@......................@..@.reloc.......`......................@..B.......................H.......P ..p....................(......................................BSJB............v4.0.30319......l...@...#~..........#Strings....H.......#US.L.......#GUID...\.......#Blob......................3..................................................-.....-.........M...........[.................'.....@.................[........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.9...K.Y...S.

C:\Program Files (x86)\letsvpn\app-3.8.0\System.Diagnostics.Debug.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	14968
Entropy (8bit):	6.860094128677331
Encrypted:	false
SSDEEP:	192:OFxrIFWnoW5mNynC5c77bgfU5izh/y2sE9jBF3A5K+oGliwQPjoX:+eWnoWoNynsAw/98E9VF3AM+oGliLPji
MD5:	078B82891DD9C9BA185129718C158145
SHA1:	35AE0FDAE835E5A845C4EF6DCE4EAF094A47B094
SHA-256:	72579343F300DBC6C44101F20CFA2F364C0239012699CA0B7734182B2F8D2AB6
SHA-512:	6E6E3BF4BB15C858A67645478530D3106D9853CFD1C68AD190E7A404C8EEB973D74C3F803ED173471D4FB5A6FC389A05BE46C22E0907586836B52B943F6C3413
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0..............)... ...@....... ...............................M....@.................................X)..O....@..$...............x&...`...... (............................................... ............... ..H............text........ ...................... ..`.rsrc...$....@......................@..@.reloc.......`......................@..B.................)......H.......P ..P....................'......................................BSJB............v4.0.30319......l.......#~..X.......#Strings....,.......#US.0.......#GUID...@.......#Blob......................3......................................K.........]...........d.............o...".o...?.o.....o...}.o.....o.....o.....o.....h...-.o.................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.5...K.U...S.

C:\Program Files (x86)\letsvpn\app-3.8.0\System.Diagnostics.EventLog.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	32376
Entropy (8bit):	6.27374372429953
Encrypted:	false
SSDEEP:	768:qVdeQes+wUTHP0G3cmL+7NQ1OaY74EnAw/KENAMxz/y:qXeQes+wUTHPbANP7tnAwrxzK
MD5:	1B23365F4550E5E94F1CC4ABD4C55DFB
SHA1:	DDA475221A5E6EB3C03325243C1BE9470E1EA245
SHA-256:	DF8602B783F26C26D89E87965D9FE4249102C27BCA7A772E071BC47A10511163
SHA-512:	749993FB581BC72BA02AEF5C234A52C398EE2E774F207C42D9FA2DF97ED1A72FB0D7A4EFE0A7069A2371BCE437E96DC14613FF6E34FEB0F0D0565BFD599DD634
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....K............" ..0..N...........l... ........... ....................................`................................._l..O....................X..x&..........pk..T............................................ ............... ..H............text....L... ...N.................. ..`.rsrc................P..............@..@.reloc...............V..............@..B.................l......H.......<%...,...........Q.......j.......................................~......0..........(....,....(.....o.......&......................0...........(.......(....-..,....(....,.r...p......%...%...(......(.....(....,.r...p......%...%...%...(.......(.....(....,!r...p......%...%...%...%...(........(......,&(....,..r...pr...p.(....(......(......(....,.r...p......%...%...(.......(.....(....,.r...p......%...%...%...(........( ....(....,"r...p......%...%...%...%..

C:\Program Files (x86)\letsvpn\app-3.8.0\System.Diagnostics.FileVersionInfo.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	14968
Entropy (8bit):	6.817075104445386
Encrypted:	false
SSDEEP:	192:qxGxIZWJjW5TNynC5c77bgfU5izh/y2sE9jBF3A5K+oC9Rv3jyO8WU:q6oWJjWVNynsAw/98E9VF3AM+oCHyO8
MD5:	804564787DAC194CA7E0132FC6581E8B
SHA1:	5702FD03D8EF318371DDE1EE13F1E8B0B9B8DBDA
SHA-256:	3A05DCCA103E42B2621191B861969C776231D6D8B43E98F98552987D43952AC5
SHA-512:	5B1DB44B2CE41BD318AAC5575022A806A39066D5D41F3EC9295CA39607F8E57C1731E0D67285C5FDE01C12D3786A387E29B374F26525E9CB7EFAF9C5F99F4243
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0..............(... ...@....... ....................................@.................................H(..O....@..p...............x&...`.......'............................................... ............... ..H............text........ ...................... ..`.rsrc...p....@......................@..@.reloc.......`......................@..B................\|(......H.......P ..@....................&......................................BSJB............v4.0.30319......l...\|...#~......(...#Strings............#US.........#GUID...$.......#Blob......................3......................................z...............\.....0...........D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.$...C.?...K._...S.

C:\Program Files (x86)\letsvpn\app-3.8.0\System.Diagnostics.PerformanceCounter.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	41080
Entropy (8bit):	5.939277671837032
Encrypted:	false
SSDEEP:	384:aGAHVcV8a5cg1YeEBfVmVYSGS4W+FyLVRVStbaB/PRTlBRBMJnnvnL0++WYbWPNV:aTyj5cKJfE+MJnnvnL0jSAw/KENAMx71
MD5:	EE3D6A867DBF2D08E43ADD93B0D7394F
SHA1:	A06A799E23EA783E0056836B61D40D38AC554C68
SHA-256:	358FFE9874F1B19F2D54BFCD8F378D1D7E2F49889B3F53EB7CF7E63BAEC134BF
SHA-512:	4EB2E49B40BBAB55221B54C84FBF09154F8581DD61373205C359236F8634E5E235C990FBB049F61510DCF426E2BC5C82E8787529B827A82422CACD8BA9FE48AD
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....D..........." ..0..n.............. ........... ....................................`.....................................O....................z..x&..............T............................................ ............... ..H............text....l... ...n.................. ..`.rsrc................p..............@..@.reloc...............x..............@..B........................H.......\&...5...........\...............................................~......0..........(....,....(.....o.......&......................0...........(.......(....-..,....(....,.r...p......%...%...(......(.....(....,.r...p......%...%...%...(.......(.....(....,!r...p......%...%...%...%...(........(......,&(....,..r...pr...p.(....(......(......(....,.r...p......%...%...(.......(.....(....,.r...p......%...%...%...(........(.....(....,"r...p......%...%...%...%..

C:\Program Files (x86)\letsvpn\app-3.8.0\System.Diagnostics.Process.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	15480
Entropy (8bit):	6.7416394492770415
Encrypted:	false
SSDEEP:	384:Vqk53/hW3fZ+zWcgNynsAw/98E9VF3AM+oe2yNQ:Vqk53MwMAw/KENAMxH
MD5:	AD6BB30030219D44E2D1217F4E4597F6
SHA1:	0E16871DF98AC223E0F01CD59676666466A0A5E7
SHA-256:	D2BB2876FB57B13B705FFF229EC1B7BBD3EDB27BD96CE27D315CFDCD10C64F2B
SHA-512:	52126CF04589C91C80EAC01B34ACC4DB30ED76D2B61A09CC51850A034657EF545C5923FDF7C91993FF6ACF87A3DD60874646D575F582D17D99DDA952D6E051E0
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0.............*... ...@....... ..............................0.....@..................................)..O....@..0...............x&...`.......(............................................... ............... ..H............text...0.... ...................... ..`.rsrc...0....@......................@..@.reloc.......`......................@..B.......................H.......P ...................... (......................................BSJB............v4.0.30319......l...$...#~..........#Strings............#US.........#GUID...........#Blob......................3............................................................j.q.........~.................}.....3.....L.................g.....P...................k.....k.....k...).k...1.k...9.k...A.k...I.k...Q.k...Y.k...a.k...i.k...q.k.......................#.....+.....3.....;.....C.7...K.W...S.

C:\Program Files (x86)\letsvpn\app-3.8.0\System.Diagnostics.StackTrace.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	17528
Entropy (8bit):	6.623902278271667
Encrypted:	false
SSDEEP:	384:fFCc4Y4OJWfOWqWWOWgNynsAw/98E9VF3AM+of9G/dGfWu0X0:tCcyCcAw/KENAMx1G/w+ZE
MD5:	5674D4C2C09B812A39B47E44B67233D6
SHA1:	A1FA36DE81C14BECF961B3D1AC820202233FBBA7
SHA-256:	CEF9D8C8D755D7AB54002B915C765269DEF4964EA2FAE7C6181D4C42E8A11EAA
SHA-512:	6EB1BFB120BEA15E3D43EB3EC51B666E80AFAF1F9F45173F631F03A217D4B3ACBCA26FC49897F5AC5DDBCDF114669ED25F17201175639209BC81471FD079D855
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z.........." ..0.............N.... ...@....... ...............................b....@..................................-..O....@..................x&...`......L-............................................... ............... ..H............text...T.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................0.......H........ ..4....................,......................................F.(....~....(....6.o.....(....6.o..........*.o........~.....~.....BSJB............v4.0.30319......l.......#~..<.......#Strings.... .......#US.(.......#GUID...8.......#Blob...........GU.........3..................................................8.........*.h...m.h.....Z.....$...........Z...+.\|.....Z...1.Z.....$.....$.......3.D.......\|...F.\|...c.\|.....\|.....\|.....\|.....\|.....\|.....Z...I.\|...}.Z.....Z.

C:\Program Files (x86)\letsvpn\app-3.8.0\System.Diagnostics.TextWriterTraceListener.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	14968
Entropy (8bit):	6.848971491972358
Encrypted:	false
SSDEEP:	192:2IlTx93aWxMW5iNynC5c77bgfU5izh/y2sE9jBF3A5K+o0tIXdzo:2kAWxMWcNynsAw/98E9VF3AM+o0Oi
MD5:	98CCDC92D029B9352B0F3C76B7377820
SHA1:	41FE93B3D6B7647DF41671143BA8C320F0128E1E
SHA-256:	4EFEFD53BEE5C99F3447DC588EC5CA55710D8ED212490C42F4024773F8D68A0E
SHA-512:	5D2FB7089E6CA71C871C1E65C8E010C3DEF14A603D397C7B8EA4E2338F15437FCD217C37EAA1C49AECB0FE28EB1742C08D4B53781F28448F3834784C6ACA78E4
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0..............(... ...@....... ...............................5....@..................................(..O....@..................x&...`......L'............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................(......H.......P ..\|....................&......................................BSJB............v4.0.30319......l.......#~......P...#Strings....D.......#US.H.......#GUID...X...$...#Blob......................3......................................z...........!...\.!...0.....A.....D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.,...C.G...K.g...S.

C:\Program Files (x86)\letsvpn\app-3.8.0\System.Diagnostics.Tools.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	14968
Entropy (8bit):	6.817355486888429
Encrypted:	false
SSDEEP:	384:FAlcWHaWsNynsAw/98E9VF3AM+oj352lBF8:K9cAw/KENAMxVAE
MD5:	D12ABD460B59E8B28A7D164D2964DA40
SHA1:	E7EFFFC1EE468F4F68279933A083D8ED657FBCD4
SHA-256:	CFE713ACFCA474B1A5DF0567A1EF80EAF833E954472D591515DB06440C8B8C06
SHA-512:	8F4897459AD687F4367D132D3A878224DF3191DB6F473EDEECCB0D298AEEEC827380B1B82185C2288A6CD5CFCFD31DE49329B3E49A0408FA9FE35638F6ECA6FF
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0..............(... ...@....... ....................................@..................................(..O....@.. ...............x&...`......d'............................................... ............... ..H............text........ ...................... ..`.rsrc... ....@......................@..@.reloc.......`......................@..B.................(......H.......P .......................&......................................BSJB............v4.0.30319......l.......#~......\|...#Strings....p.......#US.t.......#GUID...........#Blob......................3............................................................`.....1.....t.................s.....).....B.................].........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.5...K.U...S.

C:\Program Files (x86)\letsvpn\app-3.8.0\System.Diagnostics.TraceSource.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	15480
Entropy (8bit):	6.745234097126065
Encrypted:	false
SSDEEP:	384:F8IZnWlNWUNynsAw/98E9VF3AM+oFZnBUaK:mUy9Aw/KENAMxOB
MD5:	7DB7034E101E3F423BED69229F93DBD9
SHA1:	B29F21DA5AB09C9A71EE594E4B9DBC48188BEADA
SHA-256:	338F40988CE8ADBD8A7FBDC8D10393839615547A8142CFDCE9418C8FC77EEE42
SHA-512:	014373DD2A68668C1AA083209F97CCF2D82F1A3436A3CD200587AB53B407C389E47C02D8C56C40F884ADE57880A39A7ACAC6E85D26AC548BE014D16AE3D6BE81
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0.............2... ...@....... ..............................."....@..................................)..O....@..P...............x&...`.......(............................................... ............... ..H............text...8.... ...................... ..`.rsrc...P....@......................@..@.reloc.......`......................@..B.......................H.......P ......................((......................................BSJB............v4.0.30319......l...\...#~..........#Strings............#US.........#GUID...........#Blob......................3............................................................t...................................=.....V.................q.....Z...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;. ...C.;...K.[...S.

C:\Program Files (x86)\letsvpn\app-3.8.0\System.Diagnostics.Tracing.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	25208
Entropy (8bit):	6.466675387037198
Encrypted:	false
SSDEEP:	384:7lQnCMi33333333kj8xe+5PTYM3zUy+CezHjzgKj0uRWOdWmWJdWtNynsAw/98EM:JQq33333333kX+TBi8aAw/KENAMxY
MD5:	65F3F53E55786FDFD8598D8C5600F0B6
SHA1:	DF758EBF3BB29E8621246A8A054D60704039D8E4
SHA-256:	0583D3000110DE475112DD0CD5DA294B5AE52FF01866EB2452242BA3EF40708A
SHA-512:	362FFBF5BEA912F2D1692DE137D13F896DCA70189A3AB59FA78C849CA70658B537F179BAFA190B0954A95101DE4803CCD3A3DC22120AEB2310DA9B59990F995C
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z.........." ..0.............RM... ...`....... ...................................@..................................L..O....`..x............<..x&..........PL............................................... ............... ..H............text...X-... ...................... ..`.rsrc...x....`.......0..............@..@.reloc...............:..............@..B................3M......H.......8...!...................K.......................................0..H........(.....-.r...ps....z.-.r...ps....z.(......}......(#...}.....{.....o...."..(........0..Z.............%.r#..p.%..{.....%.rA..p.%..{..........%.rS..p.%..{....l.{....l[...ra..p(.....(....&...{.....0..4.................}......+....{.....".......X.....{.....i2..0..k..........{........{..........."....(.......X....{.....i.0%.(..........(.....(.......,..(........"....3.....}....*.......=..M......

C:\Program Files (x86)\letsvpn\app-3.8.0\System.Drawing.Common.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	53880
Entropy (8bit):	5.832608440044609
Encrypted:	false
SSDEEP:	1536:+JbgUxvrIn01EkO/69KzwmOiGeCcSP8UIrMAwrxH:+1xvrInsEkO/AKzwm3C0UOMhp
MD5:	0AE7AE1F6687092739BA364B0AC49B7B
SHA1:	081EB0FB184E72DFFB30181D1DAC589DE011EB1A
SHA-256:	450CC89ACE549D5F471935EAB2A534ACF35D1056AE56F1AE2BFF206BE1087A93
SHA-512:	FFA0D8843FCA8CDEBA3CAF9138BE860F25F11768DCCDC1E1F3A7E0D6306BAD7F436E4970119E578C7F090B98456DF394E9E8B13CD24DF42024A66F8DA9AD5423
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................" ..0.............n.... ........... ....................................`.....................................O.......................x&..........8...T............................................ ............... ..H............text...t.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B................O.......H........)...\...............6...........................................~......0..........(....,....(.....o.......&......................0...........(.......(....-..,....(....,.r...p......%...%...(......(.....(....,.r...p......%...%...%...(.......(.....(....,!r...p......%...%...%...%...(........(......,&(....,..r...pr...p.(....(......(......(....,.r...p......%...%...(.......(.....(....,.r...p......%...%...%...(........(.....(....,"r...p......%...%...%...%..

C:\Program Files (x86)\letsvpn\app-3.8.0\System.Drawing.Primitives.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	14968
Entropy (8bit):	6.814871399999646
Encrypted:	false
SSDEEP:	384:f28YFlXulWY/WMNynsAw/98E9VF3AM+ohHpSm4emO2eAq:f0qjAw/KENAMxhJSmIOAq
MD5:	01D354F72D5D5AD6BC8FA27AD8F06EDC
SHA1:	2848058BC3B261047F9FF018DA82004FD28BA7A7
SHA-256:	30A9ED4888312DD728BCE995E562F763565AEB4C0B74E5948E139C8AB45639EE
SHA-512:	AFF6B89861A179F0CF83237E7BAE1EBF78788523E600B9BFD2B100632FCBACF74461663C9B54548E95589A10517A1AF3F72BE788ADAEC0533829B887F2D8BFDD
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0..............(... ...@....... ....................................@..................................(..O....@.. ...............x&...`......t'............................................... ............... ..H............text........ ...................... ..`.rsrc... ....@......................@..@.reloc.......`......................@..B.................(......H.......P .......................&......................................BSJB............v4.0.30319......l.......#~..,...P...#Strings....\|.......#US.........#GUID...........#Blob......................3......................................................~.....R..... .....f.................e...........4.....}...........O.....8...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.6...K.V...S.

C:\Program Files (x86)\letsvpn\app-3.8.0\System.Dynamic.Runtime.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	15992
Entropy (8bit):	6.6917837405443255
Encrypted:	false
SSDEEP:	384:/uMLcdQ5MW9MWxNynsAw/98E9VF3AM+ojzVRaF8:2OcSptAw/KENAMx+8
MD5:	EFCAF895ECE4CEA7E70F23A1ED2957EE
SHA1:	C34ECFDA6450EE833B4B54883FC0D8BE6B7D21FD
SHA-256:	E81E6FD8B3E0BECAF461777CB0D7B5EF992F8DE38FBF832686FB7144047B0EAE
SHA-512:	7DB91CB0AB5D7436F6336340F2885D376E2EE3B9F2AB5230349670C18DCCBF8293AF9CC033D6D7B6741B4AFB0978807D0952C766DE9828E1B993E4FF9113DE56
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0..............,... ...@....... ...............................-....@..................................+..O....@..................x&...`...................................................... ............... ..H............text...$.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................,......H.......P .............................................................BSJB............v4.0.30319......l.......#~..p...0...#Strings............#US.........#GUID...........#Blob......................3................................................;.........................$.....$.....$.....$...[.$...t.$.....$.....$.........g.$.....#...........e.....e.....e...).e...1.e...9.e...A.e...I.e...Q.e...Y.e...a.e...i.e...q.e.......................#.....+.....3.....;.....C.3...K.S...S.

C:\Program Files (x86)\letsvpn\app-3.8.0\System.Globalization.Calendars.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	15480
Entropy (8bit):	6.776188074680716
Encrypted:	false
SSDEEP:	384:SZ7RqXWDRqlRqj0RqFWcNynsAw/98E9VF3AM+o86luOyjfgjr+:C9qKqjqjuqVAw/KENAMxi
MD5:	C2089AFBACCB6AB592327497B1CE6343
SHA1:	CE9BF3FC48D7A970AC7C3E1C604BBA941C14FCE3
SHA-256:	82B79BDCF76B2B263C6F4230023E986169DC3392EDF787FA7038167F49C0986A
SHA-512:	7C998EF2BA1AEF5744256C4874731C0C9A3BED49BF904D8507DA207ACB4EE265FB3F66A28CAC7D96C662B29CE18AB8D6B62394191E61EC87B7AA630A9E157957
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0................. ...@....... ....................................@.................................X..O....@..P...............x&...`...... )............................................... ............... ..H............text........ ...................... ..`.rsrc...P....@......................@..@.reloc.......`......................@..B.................*......H.......P ..P....................(......................................BSJB............v4.0.30319......l...L...#~......l...#Strings....$.......#US.(.......#GUID...8.......#Blob......................3......................................z...............\.....0.....%.....D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;. ...C.;...K.[...S.

C:\Program Files (x86)\letsvpn\app-3.8.0\System.Globalization.Extensions.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	19576
Entropy (8bit):	6.594445205428063
Encrypted:	false
SSDEEP:	384:WNBMbljRC+lgfS1RPWYR1Rw0R9WYRPWYRDRj0R9WjNynsAw/98E9VF3AM+oyVR7s:WvMhF2SzNzwu/NljuwAw/KENAMx6s
MD5:	A546A2242CA80C39E8496426F0A941F7
SHA1:	F0BB37F1BF54F23534CD13E911B433A2A156874E
SHA-256:	24B735F2DD0EC1C9EF42A62F334BEA46680261F08D17E6160A69D804834486AE
SHA-512:	BBEEA81503E3FB9B56B0435EC7850556C384E3A22304C387A7B14008DD74E59DF01B3108B3CFA46EA7CD147DBFACDAC0C89ECC187936F3DCB8B562788043BA6D
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z.........." ..0..............6... ...@....... ....................................@.................................a6..O....@...............&..x&...`.......5............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`.......$..............@..B.................6......H........"..H............4......(5........................................o...."..o......o...."..o....j~....%-.&(....s....%........0..$.........(.....o.......&...,....o....,.....................,!(....,..r...p.(....(......(......(....,.r...p......%...%...(......(.....(....,.r...p......%...%...%...(.......(.....(....,!r...p......%...%...%...%...(........(....2r...p.(..........(.......0..K........-.r1..ps....z. ...@3.(..... ....3.(....*. ...._,.(....rI..ps..

C:\Program Files (x86)\letsvpn\app-3.8.0\System.Globalization.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	14968
Entropy (8bit):	6.867500588440313
Encrypted:	false
SSDEEP:	384:kZ4RLWdRfRJ0RZWANynsAw/98E9VF3AM+oTE5v0L:kZK0pJu1Aw/KENAMxAyL
MD5:	4A2F5573E7DB1599C7B453E62CD8C74D
SHA1:	4A4015CF0DB6E90810BA292E8AFD6948F805FBB2
SHA-256:	3227788D522ACF2BA6E841FB3B623275E157A2FB743E621119CF3CB2C1976E6B
SHA-512:	55FC0E9FFC8A58202F321555AD0DF5E7C01405B1B0FE29589A1E28DF2DE7144DF4340EAB0FF50BABAE4F50CA040976AE4AEAA7ED31F150036A8B1A99341CB058
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0..............)... ...@....... ....................................@..................................)..O....@..................x&...`......h(............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................)......H.......P .......................'......................................BSJB............v4.0.30319......l...0...#~..........#Strings....x.......#US.\|.......#GUID...........#Blob......................3......................................................m.....A.{.........U.................T...........#.....l...........>.....'...................u.....u.....u...).u...1.u...9.u...A.u...I.u...Q.u...Y.u...a.u...i.u...q.u.......................#.....+.....3.....;.....C.1...K.Q...S.

C:\Program Files (x86)\letsvpn\app-3.8.0\System.IO.Compression.ZipFile.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	14968
Entropy (8bit):	6.760386134424974
Encrypted:	false
SSDEEP:	192:gFx+WTIEfW5nNynC5c77bgfU5izh/y2sE9jBF3A5K+o2DMKRurxB9/:wYWsmWhNynsAw/98E9VF3AM+o2DJkxz
MD5:	EDF87310A7412FCD59711B972BD119D2
SHA1:	442DD0EDD8462EBE9973C20C5D88D7AE2D22B1D7
SHA-256:	C81865A06342141767E24AC2024294196874EFC07176B092B08868ACAF8A313A
SHA-512:	EF0AB8A6994E8724CAC6F2D1F113B649E23074850C9604048E0128D9BBA85E0CA636C41F034F838B160DA51DCFE4943194F74D6356C822E55FC9A5E853C7AB97
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0.............*(... ...@....... ..............................i.....@..................................'..O....@..@...............x&...`.......&............................................... ............... ..H............text...0.... ...................... ..`.rsrc...@....@......................@..@.reloc.......`......................@..B.................(......H.......P ...................... &......................................BSJB............v4.0.30319......l.......#~......D...#Strings....8.......#US.<.......#GUID...L.......#Blob......................3......................................................z.....N.....".....b.................a...........0.....y...........K.....4...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........:.....C.....b...#.k...+.k...3.k...;.....C.....K.....S.

C:\Program Files (x86)\letsvpn\app-3.8.0\System.IO.Compression.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	104568
Entropy (8bit):	6.3741623498814475
Encrypted:	false
SSDEEP:	1536:0vc/U5yNq2oS4Zd0LE3YigSFvhoZO2K3aAYH2TfXmNoJXxAwrxS:0gk1tiLMYiDFvxqrWDWNoJXxhU
MD5:	5E581DD5CC3B70AFC3F97986789F3505
SHA1:	46DFDE7DE126E854CC45C575DF32679A1551D1E1
SHA-256:	20B24A7DBBE19758D2526C909B52E1AFBFC11971D90ACC6D3CC88C78244BAC7D
SHA-512:	F139A13F66A0B975D0F0B56A76473D8F3C52C5B99F4FEE0C3079F324716F540A59EC5C405B7F93F0CE9F3B877F3EF998FF61435C6B55BE5208C9ED05872965AC
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z.........." ..0..d...........W... ........... ..............................>.....@.................................5W..O....................r..x&...........V............................................... ............... ..H............text....b... ...d.................. ..`.rsrc................f..............@..@.reloc...............p..............@..B................iW......H........................9.......V......................................j~....%-.&(I...s....%..........0..$.........(.....o.......&...,....o....,.....................,!(....,..r...p.(....(......(......(....,.r...p......%...%...(......(.....(....,.r...p......%...%...%...(.......(.....(....,!r...p......%...%...%...%...(........(....2r...p.(....2r7..p.(....2rs..p.(....2r...p.(....2r...p.(....2r...p.(....2r=..p.(....2r_..p.(....2r...p.(....2r...p.(....*2r...

C:\Program Files (x86)\letsvpn\app-3.8.0\System.IO.FileSystem.AccessControl.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	29304
Entropy (8bit):	6.356253184999812
Encrypted:	false
SSDEEP:	384:vmjoB5y+MLi9VYp/OiRc715ZkSAcE1l2Yd5zqNz8TWgVbWxNynsAw/98E9VF3AM1:aCN9VYp/OiRcnZIfk8P4Aw/KENAMx8k
MD5:	EA5EF8FFF8B43C924CA66F2541D8781F
SHA1:	39BBB2F3C0735A1FD7EDEF0D10B696B9AB43FB9E
SHA-256:	8E53A461B2B43B55AE8568235AAA9FF6E7B2E29071EF7DAC595B0B0253C1272F
SHA-512:	AD1ED87229F4F7FACA21B22276A1C56CBAFD95CB8228D87598EE02DDE5DFAFBE94B2A7AFEF4A186F40ED647749B90DAA812E6402E6A84203154935C96E079938
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...._............" ..0..B...........`... ........... ....................................`.................................t`..O....................L..x&..........l_..T............................................ ............... ..H............text....@... ...B.................. ..`.rsrc................D..............@..@.reloc...............J..............@..B.................`......H........&..t)...........P.......^........................................(....^.(.......(...%...}....:.(......}....:.(......}....:.(......}.....~.....0..1.......(....,..%-.&...(.....o.......&...,...o....,.......................(....,.r...p......%...%...(......(.....(....,.r...p......%...%...%...(.......(.....(....,!r...p......%...%...%...%...(........(......,&(....,..r...pr...p.(....(......(......(....,.r...p......%...%...(.......(.....(....,.r...p......%

C:\Program Files (x86)\letsvpn\app-3.8.0\System.IO.FileSystem.DriveInfo.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	14968
Entropy (8bit):	6.820775316399807
Encrypted:	false
SSDEEP:	384:hKcuz1W1cW4NynsAw/98E9VF3AM+oVVIPm:7u8yAw/KENAMxWm
MD5:	8F6C5B23FAD5B0258B3C292A94A492D9
SHA1:	94BBAFB90BDCBF2EF4B01A16FD37C040A212E84C
SHA-256:	CD1785CB76AD35C9E2DBDB1719BF58424CB5B5BD14166746805A658867F36A6B
SHA-512:	742D4637508FEADDFE294E860E82AF9F7DAF7E029E3CB1A9195E8B09027448716870D34CD4874DF4ED5A11E8EEE4C3F763DD5BC10D27966740CAE75619B2A7B7
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0..............(... ...@....... ..............................+t....@..................................(..O....@..P...............x&...`......H'............................................... ............... ..H............text........ ...................... ..`.rsrc...P....@......................@..@.reloc.......`......................@..B.................(......H.......P ..x....................&......................................BSJB............v4.0.30319......l.......#~......H...#Strings....L.......#US.P.......#GUID...`.......#Blob......................3......................................................p.....D.....9.....X.................W...........&.....o...........A.....*...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;. ...C.;...K.[...S.

C:\Program Files (x86)\letsvpn\app-3.8.0\System.IO.FileSystem.Primitives.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	14968
Entropy (8bit):	6.8282019259097195
Encrypted:	false
SSDEEP:	192:DpXYpxjSSWikW5JNynC5c77bgfU5izh/y2sE9jBF3A5K+oVfBM0rPTn:g+SWikW/NynsAw/98E9VF3AM+oVfWcP7
MD5:	E1AC5F3AB3FDF2F27800029DAD5EDA05
SHA1:	D7AB81D90A925D69B9A022B2A277863FC6CC4BC3
SHA-256:	82F1662E5F07F93D83CB8946DF2599B4E497515306015D80698DA623DDF4F594
SHA-512:	1AF16D294E7AFC71EEFA00E700BD502634EB6A7F43E7AD44E6BA4B424AA64FE0FA5E51BD5289672641C45F934E3D7D3FAA6ADC932376CA327B0AAF9933428698
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0..............(... ...@....... ....................................@..................................(..O....@..P...............x&...`......d'............................................... ............... ..H............text........ ...................... ..`.rsrc...P....@......................@..@.reloc.......`......................@..B.................(......H.......P .......................&......................................BSJB............v4.0.30319......l.......#~......X...#Strings....h.......#US.l.......#GUID...\|.......#Blob......................3......................................................y.....M...........a.................`.........../.....x...........J.....3...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.!...C.<...K.\...S.

C:\Program Files (x86)\letsvpn\app-3.8.0\System.IO.FileSystem.Watcher.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	14968
Entropy (8bit):	6.8750098198153085
Encrypted:	false
SSDEEP:	384:pAWzgWSqNynsAw/98E9VF3AM+omHnJ20a:ptpAw/KENAMxWJa
MD5:	C4CB83A10C258E8199A06DA1A9A5BA02
SHA1:	06FF1A241C0216A3E520C0827C8148D8A99D3109
SHA-256:	D0C7C9A5C2ADCE23BD20AA88D04CF00868CA921B817F09A378ECC0FABAA4A4A2
SHA-512:	CE208C08ECECE40705EE605843EC1BBFEB86B2C8C40A4E35642BE4F4D9139C83573E71B384304EEBAC33C3E4CB7F23728A1DF1C64C91DC1491971549607465A1
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0..............)... ...@....... ....................................@.................................p)..O....@..@...............x&...`......8(............................................... ............... ..H............text........ ...................... ..`.rsrc...@....@......................@..@.reloc.......`......................@..B.................)......H.......P ..h....................'......................................BSJB............v4.0.30319......l.......#~..d.......#Strings....@.......#US.D.......#GUID...T.......#Blob......................3..................................................C...f.C...:.0...c.....N.................M.................e...........7..... ................................)....1....9....A....I....Q....Y....a....i....q.*.......................#.....+.....3.....;.....C.9...K.Y...S.

C:\Program Files (x86)\letsvpn\app-3.8.0\System.IO.FileSystem.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	14968
Entropy (8bit):	6.8275326675634
Encrypted:	false
SSDEEP:	384:qBLRWbYWHNynsAw/98E9VF3AM+oYH+jQSU:qB2PAw/KENAMxvU
MD5:	C6CFB9C5F5A80A8278936EFD2A685351
SHA1:	52E41ED2189CC5ECCB75A26F995EE629B06444A9
SHA-256:	5E485AEB20D0C13C6E2F1F1DB0E2C73928977A41B26BDB4FC96059E921D13CC7
SHA-512:	D7A452741839B7DAC378049C47D212DC13A64CAC81361E6CBC6F8ECD3CD5681E36E87216F4F451223395B059AED5C78532740F0A214B01EC2EF1D43449EAD5CA
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0.............b)... ...@....... ............................../.....@..................................)..O....@..................x&...`.......'............................................... ............... ..H............text...h.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................D)......H.......P ......................X'......................................BSJB............v4.0.30319......l.......#~..X.......#Strings............#US.........#GUID...........#Blob......................3................................................../...z./...N.....O.....b.................a...........0.....y...........K.....4...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.1...K.Q...S.

C:\Program Files (x86)\letsvpn\app-3.8.0\System.IO.IsolatedStorage.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	14968
Entropy (8bit):	6.81505805405473
Encrypted:	false
SSDEEP:	384:PHW4/WodNynsAw/98E9VF3AM+om7C5u6f:Pr1bAw/KENAMxKCjf
MD5:	2760EDEA72E9D1F1156CEA61518D107A
SHA1:	D0BE12DF3359163803FD85008A1239EA4E128C0F
SHA-256:	E54C7502F5DE2FB482FCC4391C15483741A604DA4F2221A5D760695301521CE8
SHA-512:	07EC8F0E9A652DF10739BDD798ABF16D4C89C46D95A4C50FB70E537D9B21DF6D3ADB8E6762D987EAA0AF755818B74E4D035A87B91C41AF9045E64AF93B9AB0E9
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............(... ...@....... ...............................f....@..................................(..O....@.. ...............x&...`......X'............................................... ............... ..H............text........ ...................... ..`.rsrc... ....@......................@..@.reloc.......`......................@..B.................(......H.......P .......................&......................................BSJB............v4.0.30319......l.......#~......\...#Strings....`.......#US.d.......#GUID...t.......#Blob......................3..................................................+.....+...^.....K.....r.................q.....'.....@.................[.....D...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.6...K.V...S.

C:\Program Files (x86)\letsvpn\app-3.8.0\System.IO.MemoryMappedFiles.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	14968
Entropy (8bit):	6.878699089237708
Encrypted:	false
SSDEEP:	384:uvk7hWmCWgNynsAw/98E9VF3AM+oPG7QO:us7/gAw/KENAMx/O
MD5:	2F897DCB9D47FFF553108EE2B09D908D
SHA1:	1D73F56908ED0F0C406BB693CC6B6FA45A390F9E
SHA-256:	20387D1372C8302A08E21F341914816637D8E62B62B19771F5E640D72FEC12AA
SHA-512:	A1AEB474A45C51759D238DDE1D686A5BFF6B2C558996992CA610E35C2E8D89F0D9DCB42433F5BD9686BF195A38D1D3B53B302B072117291F42E376CB7CDD2CE7
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............)... ...@....... ....................................@.................................h)..O....@..0...............x&...`......0(............................................... ............... ..H............text........ ...................... ..`.rsrc...0....@......................@..@.reloc.......`......................@..B.................)......H.......P ..`....................'......................................BSJB............v4.0.30319......l.......#~..H.......#Strings....8.......#US.<.......#GUID...L.......#Blob......................3................................................ .C.....C...w.0...c.............................@.....Y.................t.....]................................)....1....9....A....I....Q....Y....a....i....q.*.......................#.....+.....3.....;.....C.8...K.X...S.

C:\Program Files (x86)\letsvpn\app-3.8.0\System.IO.Packaging.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	46712
Entropy (8bit):	5.881205401815118
Encrypted:	false
SSDEEP:	768:Uxua7db+smzMnSzBt++0YfTF61O+luv5ty5Aw/KENAMxtR+bd:UxH7ssKugt+++1luv5ty5AwrxtA
MD5:	E6FD5B96619717AF6DC3DB741A073EF0
SHA1:	D040071C41F2B7CCCAA68E53172F763F4AD1ECA4
SHA-256:	8691A33C890CFFE99951C9D15EB68DB0694702CEA708BF9395F8D75DD20E9453
SHA-512:	E2316D12B5AA0EDB053D017123523A0CD62BDCB7A918DBE03F238B1C5DEDF3F66392EA4EA2BC2FBB61532A06FAD805A3B2F6B8463C3E5798D5CEDE7AF8486C7A
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...)1............" ..0.................. ........... ..............................n.....`.................................S...O.......................x&..........t...T............................................ ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......`(...D...........l...6...........................................~......0..........(....,....(.....o.......&......................0...........(.......(....-..,....(....,.r...p......%...%...(......(.....(....,.r...p......%...%...%...(.......(.....(....,!r...p......%...%...%...%...(........(......,&(....,..r...pr...p.(....(......(......(....,.r...p......%...%...(.......(.....(....,.r...p......%...%...%...(........(.....(....,"r...p......%...%...%...%..

C:\Program Files (x86)\letsvpn\app-3.8.0\System.IO.Pipes.AccessControl.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	19576
Entropy (8bit):	6.534905885729895
Encrypted:	false
SSDEEP:	384:AANJdesEvbDYUgmpWrxWNPfWqxWfPsNynsAw/98E9VF3AM+oAtOk3VmWooEb:VclTD/yod2wAw/KENAMxEF6oW
MD5:	C8F5E8011557FE29BB9613E55CCE3916
SHA1:	8CD00606D8B07636A014196B88A4E9E6E4B531C4
SHA-256:	BB3E059755E1D5AAE2DD0D0345960CD268D9107341AE4771C5A313744F2EB907
SHA-512:	DD68161785435133A368ABF55A5A98455FD279276D1C16446131635D323E8B31F51EEC45AB6A62C0EEA86B57CAC4ACA8F2FD59535AA5636F72BD110D76D9053A
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....:.[.........." ..0.............Z5... ...@....... ..............................[.....@..................................5..O....@..P............&..x&...`......T4............................................... ............... ..H............text...`.... ...................... ..`.rsrc...P....@......................@..@.reloc.......`.......$..............@..B................;5......H........!...............0..(....3......................................j~....%-.&(....s....%..........0..$.........(.....o.......&...,....o....,.....................,!(....,..r...p.(....(......(......(....,.r...p......%...%...(......(.....(....,.r...p......%...%...%...(.......(.....(....,!r...p......%...%...%...%...(........(.....~....2r...p.(....2ra..p.(....2r...p.(....2r...p.(....2r...p.(....B.....(...........o...."..o.....BSJB............v4.0.30319..

C:\Program Files (x86)\letsvpn\app-3.8.0\System.IO.Pipes.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	14968
Entropy (8bit):	6.841464443152656
Encrypted:	false
SSDEEP:	384:WGMWCUWKNynsAw/98E9VF3AM+o3303rJL:W3oAw/KENAMxU3F
MD5:	5542A3DA5C583EF325F85505C7391598
SHA1:	90A65AD3C7F53E3CF7FFD4F15E7207E017FFFA19
SHA-256:	B53CDA164A2C957F2F957794AD7D742DD6D79ADAF5FF95F2B81D886D6836B1DE
SHA-512:	38B7C007A17D9C976B4909A646BFCEF482A2C5632EC582B036D124F23F005B0051CD7A2B33D9F561DD66C5967229CFB3A983758F4629EF0C2BE2F42C8929A7AF
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............)... ...@....... ....................................@.................................@)..O....@..................x&...`.......(............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................t)......H.......P ..8....................'......................................BSJB............v4.0.30319......l.......#~..X.......#Strings............#US. .......#GUID...0.......#Blob......................3..................................................].....]...T.J...}.....h.$.....$.....$...g.$.....$...6.$.....$.....$...Q.....:.$.................D.....D.....D...).D...1.D...9.D...A.D...I.D...Q.D...Y.D...a.D...i.D...q.D.......................#.....+.....3.....;.....C.,...K.L...S.

C:\Program Files (x86)\letsvpn\app-3.8.0\System.IO.Ports.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	33912
Entropy (8bit):	6.191160854163302
Encrypted:	false
SSDEEP:	768:w44bN5hwABzKGUn11fF+1WnAw/KENAMxR5:w5bLhLBzcn1gWnAwrxR5
MD5:	A3A6976F1A793C848C408D961E024EC3
SHA1:	3BE8BD9E1193B778F5082F79DF4976535281445F
SHA-256:	80476589CB6BBAAF2ADCA6D0232F6A923AA33076CD7A7756D716F4C9014ADCE7
SHA-512:	34E6324D142369FB92C98DA7C173948E40704DA0586FEA168C58AB088F844C28D05E5267E363CF7B7A2F8B20EB6CCB4E0304F3B4934898D3088F65B5306E1C60
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0..T...........s... ........... ..............................t)....`..................................r..O....................^..x&...........q..T............................................ ............... ..H............text....S... ...T.................. ..`.rsrc................V..............@..@.reloc...............\..............@..B.................r......H........&...............U..X...`q.......................................~......0..........(....,....(.....o.......&......................0...........(.......(....-..,....(....,.r...p......%...%...(......(.....(....,.r...p......%...%...%...(.......(.....(....,!r...p......%...%...%...%...(........(......,&(....,..r...pr...p.(....(......(......(....,.r...p......%...%...(.......(.....(....,.r...p......%...%...%...(........(.....(....,"r...p......%...%...%...%..

C:\Program Files (x86)\letsvpn\app-3.8.0\System.IO.UnmanagedMemoryStream.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	14968
Entropy (8bit):	6.822101311013669
Encrypted:	false
SSDEEP:	384:2BhwI7WSQWHNynsAw/98E9VF3AM+o2Yp56b:2DwIBPAw/KENAMxhkb
MD5:	9B9967369B8DC5341C2DDA846F94DBE2
SHA1:	7E931BB42231B610BC11CA77FD428799228E4D7D
SHA-256:	F3794B4CB1140F6B96997C418E5BAAACD614C6159B133272596062934FA07748
SHA-512:	74DDF36E9AFFC9AE098F3FD2BC00817AF3A4A46B41B0252729F336EFFE06CA55530C0316420B49DEC35B1AECAAA4B037E1A82F5F55A63CFFC45584EA3CF08018
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............(... ...@....... ...............................]....@.................................l(..O....@..P...............x&...`......4'............................................... ............... ..H............text........ ...................... ..`.rsrc...P....@......................@..@.reloc.......`......................@..B.................(......H.......P ..d....................&......................................BSJB............v4.0.30319......l.......#~......D...#Strings....8.......#US.<.......#GUID...L.......#Blob......................3......................................................f.....:.....2.....N.................M.................e...........7..... ...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.!...C.<...K.\...S.

C:\Program Files (x86)\letsvpn\app-3.8.0\System.IO.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	14968
Entropy (8bit):	6.839732036391094
Encrypted:	false
SSDEEP:	384:TyvPRW4lW2NynsAw/98E9VF3AM+oayAJvovr:u39vAw/KENAMxNr
MD5:	DF5262CAD9CE624B3A4AD35BD5BA995E
SHA1:	DADBC60A633FF6A7DCA1445FA1F71FEC032BAC17
SHA-256:	1384BD7A74C8E9906E7F59D8E00E55591FFB2A40DAE73F2B195DC16BFFFFAD32
SHA-512:	96EB82B16C741E7F8107223C9196FA1C00F091D3BEA6CB975C02C3821863A0072A697F8E3CD822E5BD50C49D6074B1B5ECBA790B2CD68341F9F398DB99F290A8
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0..............)... ...@....... ...............................H....@..................................)..O....@..................x&...`......l(............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................)......H.......P .......................'......................................BSJB............v4.0.30319......l...L...#~..........#Strings............#US.........#GUID...........#Blob......................3......................................................f.....:...........N.................M.................e...........7..... ...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.&...K.F...S.

C:\Program Files (x86)\letsvpn\app-3.8.0\System.Linq.Expressions.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	15992
Entropy (8bit):	6.784741569846042
Encrypted:	false
SSDEEP:	384:U6RW6eWLNynsAw/98E9VF3AM+od0q9JIpaE:U67hAw/KENAMxehYE
MD5:	4D53A24B328C7F20F8FBBFB9A85B6E7A
SHA1:	0DCDA4058834F033F75416810C79894207C38FDB
SHA-256:	9F9636861C484B80EB8277A6F79C2699093A086763D112218C0701B6526CCC9C
SHA-512:	7AEF82ACFA0AD79D3DB11B88D64292EDCB8C658F49AB69E7E48B7A62FBDC886040F744BDB0F9C35FB353A6B8021ECA85ED47929A38D1728E5D36C79ED35D659F
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............-... ...@....... ..............................$.....@..................................-..O....@..................x&...`......P,............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................-......H.......P .......................+......................................BSJB............v4.0.30319......l.......#~..\.......#Strings....\.......#US.`.......#GUID...p.......#Blob......................3......................................5.........c.............z...............(.....E.....................................Q.........../...........b.....b.....b...).b...1.b...9.b...A.b...I.b...Q.b...Y.b...a.b...i.b...q.b.......................#.....+.....3.....;.....C.4...K.T...S.

C:\Program Files (x86)\letsvpn\app-3.8.0\System.Linq.Parallel.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	14968
Entropy (8bit):	6.821811086038403
Encrypted:	false
SSDEEP:	192:4SPuxFp9W70W5uNynC5c77bgfU5izh/y2sE9jBF3A5K+oxG6ZyHDJ:4SUP9W70WMNynsAw/98E9VF3AM+ox/IJ
MD5:	5F7DDAF1A2CE0A981BA95BA7A04A53A0
SHA1:	3B34346D9AE8604248B74320B363CB1946B8F85E
SHA-256:	F4871E637B26A9273EE03A46C43E615C16DE3A60228A925B23E6E83AE479733C
SHA-512:	5EE5E1AF0A6D05394FB1ED2F16CE77B86BC540976EAC5FDBF703B946D17BFD8843756C92B656BE6E5E43312F073BA44FC81AFC5E77FC7A417D0187C89B22E2C8
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............)... ...@....... ...............................Q....@..................................(..O....@..................x&...`.......'............................................... ............... ..H............text...$.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................)......H.......P .......................'......................................BSJB............v4.0.30319......l.......#~..,...x...#Strings............#US.........#GUID...........#Blob......................3..................................................&.....&...p.....F.............................9.....R.................m.....V...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.1...K.Q...S.

C:\Program Files (x86)\letsvpn\app-3.8.0\System.Linq.Queryable.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	14968
Entropy (8bit):	6.814257290171635
Encrypted:	false
SSDEEP:	384:C8yg07W0/WPNynsAw/98E9VF3AM+ob/IKQ:CBHOAw/KENAMx7a
MD5:	268DC9A7E6D415C64488BD21926DA0F3
SHA1:	F59997C24AC37FBA8EC36B14BA301EFB53E29061
SHA-256:	D65F95F9ADC954BC2A514402B6E351B4E6D89B39BC0735326DBC2A65B963FA6F
SHA-512:	4CB7751A12D11B90C132C76D36197CA6AB289CA244BE03778C30B027E9DC50575910701E2CF990A14278AC8D5704E1670530B8B25C983F1CA7343A924FBFB76C
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............)... ...@....... .............................. .....@..................................(..O....@..................x&...`......x'............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................(......H.......P .......................&......................................BSJB............v4.0.30319......l.......#~.. ...d...#Strings............#US.........#GUID...........#Blob......................3.................................................."....."...m.....B.............................6.....O.................j.....S.......(...........................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.2...K.R...S.

C:\Program Files (x86)\letsvpn\app-3.8.0\System.Linq.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	14968
Entropy (8bit):	6.780896649081638
Encrypted:	false
SSDEEP:	192:cueAxQJ4WmRW5FNynC5c77bgfU5izh/y2sE9jBF3A5K+oTyp6CTqwgh:Se1WmRWHNynsAw/98E9VF3AM+oTypRdS
MD5:	652E6B1DE659A43BC1237E7AE4747B46
SHA1:	523BB0A2D1BE1189E1138C67BB2DA9A1356E42A1
SHA-256:	FE8795AAB170EDAE0F2769E07FB1324D591F4D6983A9FAF9238EE6EE150B5B61
SHA-512:	B9CD467836B89180E274843AADFA7B9FF8DF32D7A7132BFEB35E78AB03E5DAB379B5B697AE706CC6DBF1AD04E0C00F1F65EA2B59A0D6F41419763235A9387E80
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............(... ...@....... ....................................@.................................p(..O....@..................x&...`......8'............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................(......H.......P ..h....................&......................................BSJB............v4.0.30319......l.......#~.. ...0...#Strings....P.......#US.T.......#GUID...d.......#Blob......................3............................................................f...........z.................y...../.....H.................c.....L.......,...........................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.(...K.H...S.

C:\Program Files (x86)\letsvpn\app-3.8.0\System.Management.Automation.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	364152
Entropy (8bit):	5.897813552682531
Encrypted:	false
SSDEEP:	6144:vA0HY8o04jatc9MCELK5h+BO2L1fsqF030Nhj:vA0HYnitRCOFOI1W8j
MD5:	F19D5FB1DF341441765BB36A623E87A3
SHA1:	9F4683C1608A7DC0DF7C19BDEF8DFC6723090596
SHA-256:	FE640B4B33A38EE98F94444D43F5B4D2E4ED1482C5F348779ED68A8F937FD85F
SHA-512:	B151D6A9989F5A4F787E2823D75FBDDB10D6E917F881A639F963D83ACFCC94966A5FE81D333064C698228852163BD1746B55F4B2CED8EC3B517DCC651F60AA50
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....;..........." ..0..`...........~... ........... ...............................Q....`.................................?~..O....................h..x&..........\}..T............................................ ............... ..H............text....^... ...`.................. ..`.rsrc................b..............@..@.reloc...............f..............@..B................s~......H.......t\|..h....................\|........................................('.....((.....(#............(......(......(......(.........(1.......(....................(......(......(......(......(......(......(......(.....................().....()...........(........(......(......(......(......('.......Q...(.....................('.....((..............('.....('.......................('.........

C:\Program Files (x86)\letsvpn\app-3.8.0\System.Memory.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	141944
Entropy (8bit):	6.155486265393985
Encrypted:	false
SSDEEP:	3072:mUGrszKKLB8a9DvrJeeesIf3amN32AW/rcchFk:RB8l3/aK32fhG
MD5:	8C6FB203922E4B1FB38833CDF99EE539
SHA1:	DE4B492D42229244E2E70F6AA8E43E8C2D553B43
SHA-256:	804ACC8A546D4AA0482A6D43D4660F443CB06E09188F9BE08AD2EC4C37A78358
SHA-512:	822B276868B81CE85658D9F189C582E9B800F1D1294233DAAAA2372011E548A234A233D0482C5C486240E53E1BF81725F440045E18E1B6D9AD6C321D58A9825F
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....6wb.........." ..0.................. ... ....... .......................`............@.................................`...O.... ..@...............x&...@......(................................................ ............... ..H............text........ ...................... ..`.rsrc...@.... ......................@..@.reloc.......@......................@..B........................H........,................................................................('...>..}......}......{......{......{.....{....3..{.....{....((......0...........%.u....,..........(.....z.{....%-.&.+.o)....{....(a.....(....zN........o...s+....(....z.s,.....(....zF(U....(O...s-....(....z.(V...s-....(....z.s.....(....z.s/.....(....zN........o...s0....(....zrr...p(\....c.K...(O...s1....(....zBr...p(Y...s1....(....z.s2....(....z.(X...s3....(!...z.(_...s3...*.(#...z

C:\Program Files (x86)\letsvpn\app-3.8.0\System.Net.Http.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	192120
Entropy (8bit):	6.1095874919471225
Encrypted:	false
SSDEEP:	3072:5eruQlNGOhYq0AQcTvankc+8lbKta4FUPAT8xpRI454I/Kv6RpZ8dwPSgehZ:sW60VcTvakcXcApO9hZ
MD5:	D7FE90E6A28F33B2E06B412D2CB433F5
SHA1:	EE7AE201243B75F9237BB9F56DFD457D8DDF95E6
SHA-256:	AE51503D5AD99F7B8B158E7EA36548B1C95EEC9653E287FDC22E9823680E9F7C
SHA-512:	F2CBAB0A576949696423CAD2A1992FE07726F84E1F7891E39A4BE36A0F07E62E4C1E7CF796A76052074C67D177299BFAB3166379FA0E1C0EE661519837BCE6C3
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z.........." ..0.................. ........... ....................... ......hX....@.....................................O.......h...............x&........................................................... ............... ..H............text...D.... ...................... ..`.rsrc...h...........................@..@.reloc..............................@..B........................H........$..H...........$....,...........................................0..,........ ....1.r...ps0...z.............(.....s1....0..l........J.2..J.o2...2.r...ps0...z..Jo3....%36.o2....JY.2..J.Xo3.....J.Xo3...(...... ........J.XT....J...XT.o3.....o2....Y./....o3....%3 ...Xo3......Xo3...(.... ..........0..=..........J...XT..%....J...XT.~..... ...._.c.....J...XT.~......._......0............02...91...A2...F1...a2...f1. ....*..91...F1...aY+...AY..X+...0Y...02...91...A2...F

C:\Program Files (x86)\letsvpn\app-3.8.0\System.Net.IPNetwork.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	36472
Entropy (8bit):	6.360769533946289
Encrypted:	false
SSDEEP:	384:jVRG18S8ZaRMtn/RF6XbPnP8hbUePwV/QjTGIHeesAQNynsAw/98E9VF3AM+oPk0:jVc1GUMB/z6XmY/iee58Aw/KENAMx80
MD5:	0919E712F2E526C0E677ABF9178D9737
SHA1:	D31E922D0A7A7119841FFE9CB3E5C13EF03D91F2
SHA-256:	6780DC73498120F6BB9FEA8928BD5886DE24C73948FB67E61A4A5FD2FD46C713
SHA-512:	0B2E0C1AF67BBF56CFDD23CD11C35167814A41B567143AA0F9344CEDE56C97C3D8E775783F9E486ECD8B04F6775638D9BF839D7E817189E63F036E6422ADD366
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0..\..........r{... ........... ....................................`..................................{..O.......h............h..x&..........0z..T............................................ ............... ..H............text....[... ...\.................. ..`.rsrc...h............^..............@..@.reloc...............f..............@..B................Q{......H.......D>..l;...................y.......................................0..v.........(.......i.Y...i.Zs.........(.......o.....0....(.....3...0o....&..o ...&..Y.+......(......0o!...o ...&..Y.../..o"...6..r...p(#....0............(.......i.Y...i.[.X.Zs.......i.]..-......+....b......%.Y..X....Y..-....($........o.....0....(.....3...0o....&...o ...&+1.....b...Y..bX...Y.X......($.....0o!...o ...&..Y.../..o"...*...0..d.........(.......X...i.3..+.../......+......f...X....i.Y2...i.

C:\Program Files (x86)\letsvpn\app-3.8.0\System.Net.NameResolution.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	14968
Entropy (8bit):	6.802189948456299
Encrypted:	false
SSDEEP:	192:uZsxgyrWYLW54nNynC5c77bgfU5izh/y2sE9jBF3A5K+o/REog/fZhQ9t5:A6ZWYLWMNynsAw/98E9VF3AM+o/ihQF
MD5:	EB072DC7E1ED218FBCD443D4CEA517D2
SHA1:	66F63DE8DCCBFFC10774D835F586F89A21597AA4
SHA-256:	BD427D9903FFC1C1042A5AB3A7EDCD8ED0CE2BFD7B7625F2C04C459DC7DD90CF
SHA-512:	20CB0F9BFF6D7B708E92F9BC92AFAFCA2BA0BE90D63F42EC14146E7A9CB7F633CFC71D89EDEDDED883BC3A07837853710B86C4AEC8AAB1BC1AE2F3808832B53B
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............(... ...@....... ..............................SV....@.................................T(..O....@.. ...............x&...`.......'............................................... ............... ..H............text........ ...................... ..`.rsrc... ....@......................@..@.reloc.......`......................@..B.................(......H.......P ..L....................&......................................BSJB............v4.0.30319......l.......#~......0...#Strings....$.......#US.(.......#GUID...8.......#Blob......................3......................................z...............\.....0...........D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.6...K.V...S.

C:\Program Files (x86)\letsvpn\app-3.8.0\System.Net.NetworkInformation.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	15992
Entropy (8bit):	6.760661155824475
Encrypted:	false
SSDEEP:	192:s3k14xPxHWMQW5nNynC5c77bgfU5izh/y2sE9jBF3A5K+oZbhEG:sU1W1WMQWhNynsAw/98E9VF3AM+oZbaG
MD5:	5E9398C0286857643D3994F5EBBEDA14
SHA1:	C608B60BC53036E866CDD83F107FE994E61911D0
SHA-256:	41F97D0D09030478BF59F7B8AED871AC968906741A277F9D9BF0A3D300F5261B
SHA-512:	2150FB1885FDF39EAC854F41140D533B789E1DFF84A918B2DF97E61E8793F97FA31972C1D794D143D00A55A5AF33483DD50F5F45BA0B6CD9BBE9B3705F6F6A00
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............,... ...@....... ....................................@..................................,..O....@..@...............x&...`......p+............................................... ............... ..H............text........ ...................... ..`.rsrc...@....@......................@..@.reloc.......`......................@..B.................,......H.......P .......................*......................................BSJB............v4.0.30319......l...<...#~..........#Strings....t.......#US.x.......#GUID...........#Blob......................3................................!...............E.................%.................'...........e.....~...........................................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.:...K.Z...S.

C:\Program Files (x86)\letsvpn\app-3.8.0\System.Net.Ping.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	14968
Entropy (8bit):	6.794512450253837
Encrypted:	false
SSDEEP:	384:jdSWSKWkNynsAw/98E9VF3AM+otIRE6DVHM5:ZOsAw/KENAMxtWPe
MD5:	D78E020A455E229D91E9B6F7B6D75324
SHA1:	5FB252BE555B7EDBAF04BB492E3224CD5EE84DE8
SHA-256:	73AF2E59157A23950C47B9432A65B88008DA18A1A79277D3681DA58E18412FD8
SHA-512:	8823AF5BC692852119BDDF425715379C84998F332EE4D9B0780DD148158C47ABA7FA86F79141B99076E1A61DAE17C4CB022443249A6609718A6F9825C010FAD9
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............(... ...@....... ....................................@..................................(..O....@..................x&...`......X'............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................(......H.......P .......................&......................................BSJB............v4.0.30319......l.......#~.. ...L...#Strings....l.......#US.p.......#GUID...........#Blob......................3......................................................\.....0...........D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.,...K.L...S.

C:\Program Files (x86)\letsvpn\app-3.8.0\System.Net.Primitives.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	15992
Entropy (8bit):	6.709623509639638
Encrypted:	false
SSDEEP:	384:GJEYA2WkIW5eNynsAw/98E9VF3AM+om6sYAk:GyYA87SAw/KENAMxVD
MD5:	4B11E0E78337E429E3A0C82D6B33818C
SHA1:	AF784648C8D641F81A804941D200CB3FB00EC4FF
SHA-256:	54BC7C27778B877D526E1ACA5E2AC04CE9497CDF7828A64FA1F4EBD26E9AD94F
SHA-512:	51595C57EBBFCABE81E8B8CC9F37CC57DF73310EA6C67FF69C1CA68DB505B9D13D792B088819690E7C4294343C5C8F92C99ADA24F3442E039FC06599AB104A72
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0.............r,... ...@....... ...................................@................................. ,..O....@..................x&...`...................................................... ............... ..H............text...x.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................T,......H.......P ......................h......................................BSJB............v4.0.30319......l.......#~..\|...x...#Strings............#US.........#GUID...........#Blob......................3......................................$.........N.U.....U.....-...u.................0...........n.........................>.......................'.....'.....'...).'...1.'...9.'...A.'...I.'...Q.'...Y.'...a.'...i.'...q.'.......................#.....+.....3.....;.....C.2...K.R...S.

C:\Program Files (x86)\letsvpn\app-3.8.0\System.Net.Requests.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	14968
Entropy (8bit):	6.843517310961627
Encrypted:	false
SSDEEP:	192:0Rl0qgopJ5xBcWe4W5tNynC5c77bgfU5izh/y2sE9jBF3A5K+o0WvUh/xSzl:YJGWe4WLNynsAw/98E9VF3AM+o0bRgl
MD5:	D9AC332E5F769149B4A8A7C4A97A6DB2
SHA1:	C98B5CD7709296654FF4BAFC795B86EBBF1844DD
SHA-256:	33A847D3FDD524EF0300BA8A4DFA2E3AD57B5DD7247E3C70A603E4D3002A3F28
SHA-512:	C10AA32D412081975A43F115419B2324A18AE2BD3A33C647204028224168A8920B5F38D7EA21B20B33B8E8DD04163367242DC789670C2455AE56468E8E88EDB6
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............)... ...@....... ....................................@.................................0)..O....@..................x&...`.......'............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................d)......H.......P ..(...................x'......................................BSJB............v4.0.30319......l.......#~..d.......#Strings............#US.........#GUID...........#Blob......................3..................................................4...~.4...R.!...T.....f.................e...........4.....}...........O.....8...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.0...K.P...S.

C:\Program Files (x86)\letsvpn\app-3.8.0\System.Net.Security.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	15480
Entropy (8bit):	6.752319219280576
Encrypted:	false
SSDEEP:	384:8dW1w3WesW4NynsAw/98E9VF3AM+oVn252j:l1wxyAw/KENAMxA52j
MD5:	7DCF3E1C53CC189E06BE067F81CD7CD1
SHA1:	24C8919559959679E6B19FC5BC524010CC3201FA
SHA-256:	D28B4DD562F4219A27F04307A13D822BC1CEEF6AA2E9EF741B71AD12F5E19476
SHA-512:	376BE8442F6F3361BF01A95FF78CE6438CE021FDA7EF7F616354AA4C0E97C0A1CF9A53C130E9A2CEB62C482D70D6216F960453384D605C8D09C2988C6F99B41C
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0.............~... ...@....... ..............................8.....@.................................,..O....@..................x&...`.......(............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................`*......H.......P ..$...................t(......................................BSJB............v4.0.30319......l...$...#~......t...#Strings............#US.........#GUID...........#Blob......................3......................................................\.....0...........D.<.....<.....<...C.<.....<.....<...[.<...x.<...-.......<.................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.0...K.P...S.

C:\Program Files (x86)\letsvpn\app-3.8.0\System.Net.Sockets.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	24184
Entropy (8bit):	6.565483854341909
Encrypted:	false
SSDEEP:	384:yylNGlfdqj5531HJTABhf8g2MkO1ICMbmiT2Y4Y3ocWS9sWvW8YsWZ3NynsAw/9X:yyp12Bhkg3qnV/sfdAw/KENAMx8nIL
MD5:	49D9BE2A7F375DC26CEF020B82115E70
SHA1:	FDE23328362BD974DE5BADF3BCF24E4423DF2BC1
SHA-256:	63C58F61FC8EFDCB5C156172A8340CE8ACED38328C0A4AD519EC9503ECFF756B
SHA-512:	92DCBDFDBDEEE0D41216CEED8CFAA48A9C6CCD79DA85CE1F2EF07E368AB24E32D8050854B4E4A226AF8A7FB3F0342595F2C590E95AC3A53B14BF09C39C9EC818
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z.........." ..0.............I... ...`....... ....................................@.................................gI..O....`...............8..x&...........H............................................... ............... ..H............text....)... ..................... ..`.rsrc........`.......,..............@..@.reloc...............6..............@..B.................I......H.......H(... ..................HH.......................................0..J.......(....~....%-.&~..........s....%.....~....%-.&~..........s....%......o.......0..L.......(....~....%-.&~..........s....%.....~....%-.&~..........s....%........o...+.0..K.......(....~....%-.&~..........s....%.....~....%-.&~..........s....%.......o...+..0..L.......(....~....%-.&~..........s....%.....~....%-.&~..........s....%........o...+.0..L.......(....~....%-.&~..........s....%.....~....%-.

C:\Program Files (x86)\letsvpn\app-3.8.0\System.Net.WebHeaderCollection.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	14968
Entropy (8bit):	6.821508143172893
Encrypted:	false
SSDEEP:	384:RHPAW1bW+NynsAw/98E9VF3AM+oGknvMo:9rpAw/KENAMxYo
MD5:	5F938A15736D4E087B61FE8C96553225
SHA1:	DD65B804271A892B6CD4642C5BB683521FFB56C2
SHA-256:	46C8553C68D1B1B4791ED2763D2BD5E77CC9CE387BD83BE5D39A04976EA17F01
SHA-512:	81968F68E6E3D05139C7FAFFA74FC65700F0FC28613133C8204412273CC100BAC1950F271E399D19857D109864802D7916269DE2D30425A884C17F935500851E
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............(... ...@....... ..............................E.....@..................................(..O....@..P...............x&...`......P'............................................... ............... ..H............text........ ...................... ..`.rsrc...P....@......................@..@.reloc.......`......................@..B.................(......H.......P .......................&......................................BSJB............v4.0.30319......l.......#~......P...#Strings....T.......#US.X.......#GUID...h.......#Blob......................3......................................z...............\.....0.....3.....D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;. ...C.;...K.[...S.

C:\Program Files (x86)\letsvpn\app-3.8.0\System.Net.WebSockets.Client.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	14968
Entropy (8bit):	6.819026097590596
Encrypted:	false
SSDEEP:	384:0NoqWD7W9NynsAw/98E9VF3AM+ocgxsfZJbJ:0NofQAw/KENAMx+f1
MD5:	8187907D7A3946C95A4D8DF98FAC605B
SHA1:	82A2142C2E526D5024C6E15B99CC69BDB9BB4FE5
SHA-256:	6697204636DCCFCF9EBB5C75884C73EA6A4169D74EC7B016B3EB9705977E6586
SHA-512:	D60523CACA51B3636DEFB05AB249A0122C421C1199D5E5EBEC65561BE69F3882B2F1D8F8843CE5759D971205385AB7922856EA5980D1CD60D597E6B6B6E7C589
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............(... ...@....... ....................................@.................................\|(..O....@..@...............x&...`......D'............................................... ............... ..H............text........ ...................... ..`.rsrc...@....@......................@..@.reloc.......`......................@..B.................(......H.......P ..t....................&......................................BSJB............v4.0.30319......l.......#~......X...#Strings....L.......#US.P.......#GUID...`.......#Blob......................3......................................z...............\.....0...........D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.9...K.Y...S.

C:\Program Files (x86)\letsvpn\app-3.8.0\System.Net.WebSockets.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	14968
Entropy (8bit):	6.824116445174452
Encrypted:	false
SSDEEP:	384:yGETSAWUEWNNynsAw/98E9VF3AM+o9Jm7JmS:oT1ZAw/KENAMxnImS
MD5:	E4EDD210F9A17AD15FE8ABDD1F8E4505
SHA1:	A6273044C8A0DB9B4DFBA6F208232A46369BE18D
SHA-256:	FD4A3C9620CABD73012825D4BE88C0F9D2CFACB01677F1E893799A5F32FC37CC
SHA-512:	98BA6AE72307B15ED408C74FFBA1D5E3873B0B91D3F1C32AAE5D7DC087A93A5306EA46AC44034BADACE533DDA10DF1AE590237F821F0903B9ECD0F2D09209300
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0.............B)... ...@....... ..............................s.....@..................................(..O....@..................x&...`.......'............................................... ............... ..H............text...H.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................$)......H.......P ......................8'......................................BSJB............v4.0.30319......l.......#~..<.......#Strings............#US.........#GUID...........#Blob......................3............................................................T.....,.....h.................g...........6.................Q.....:...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.2...K.R...S.

C:\Program Files (x86)\letsvpn\app-3.8.0\System.Numerics.Vectors.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	109688
Entropy (8bit):	5.497563021167047
Encrypted:	false
SSDEEP:	1536:1POw0SUUKw+GbgjMV+fCY1UiiGZ6qetMXIAMZ2zstK/NAwrxa:1Ww0SUUKBM8aOUiiGw7qa9tK/NhQ
MD5:	0777016729A900B75F705FF85D8EA755
SHA1:	B9F29DD11D1F54D2075DB4796512A666F436E408
SHA-256:	69E0A128C55A0216CAFF449C2E9FE98A6CAE0135A3E9519CECEB1745A964D8F9
SHA-512:	8B15671BBBB4AD8A2AE5F673FF9511309DE05B765363B12DBEF4746303EAA775BAE94229A86A47C5690BBD995674B7D1892CE93A24F6152BC084DE07A64969B0
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....?.Z.........." ..0..v............... ........... ...............................h....@.................................f...O.......................x&.......................................................... ............... ..H............text....u... ...v.................. ..`.rsrc................x..............@..@.reloc..............................@..B........................H........Q..\|?..........$... ...D.........................................(....&.l(....k&.l(....k..l.l(....k..l.l(....k&.l(....k&.l(....k&.l(....kj~....%-.&(....s....%........0..$.........(.....o.......&...,....o....,.....................,!(....,..r...p.(....(......(......(....,.r...p......%...%...(......(.....(....,.r...p......%...%...%...(.......(.....(....,!r...p......%...%...%...%...(........(.....~....2r...p.(....2rG..p.(....2r...p.(....*2r...p.(.

C:\Program Files (x86)\letsvpn\app-3.8.0\System.ObjectModel.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	15480
Entropy (8bit):	6.815996215140673
Encrypted:	false
SSDEEP:	384:2cDagtDApWSKJWZNynsAw/98E9VF3AM+ozZJM:2PKBGAw/KENAMxo
MD5:	83E0063CF0FF4D1C23C1FD5DFDA0B6EC
SHA1:	024AF076996E032DA204518253B09468A8329471
SHA-256:	0EE45579AA9283B663911D86D84507E8854305231A70A84180712163F0D6DD88
SHA-512:	684072E6B3102C5F344B31C459331777E93F0F663504EB2F26D0F11EA1DCB28C3573C09BF5AD58933E8FFAFEC6C2C675B1B72758769656CAAE4F0F0E929B1319
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............+... ...@....... ....................................@.................................0+..O....@..................x&...`.......)............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................d+......H.......P ..(...................x)......................................BSJB............v4.0.30319......l...x...#~......$...#Strings............#US.........#GUID...........#Blob......................3......................................x.........w.o.....o.....\...............<.....Y.................................................G...........V.....V.....V...).V...1.V...9.V...A.V...I.V...Q.V...Y.V...a.V...i.V...q.V.......................#.....+.....3.....;.....C./...K.O...S.

C:\Program Files (x86)\letsvpn\app-3.8.0\System.Reflection.Extensions.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	14968
Entropy (8bit):	6.826170733961278
Encrypted:	false
SSDEEP:	192:36NxhqWD4W5FNynC5c77bgfU5izh/y2sE9jBF3A5K+oc36auWW:WIWD4W7NynsAw/98E9VF3AM+ocnub
MD5:	D98253C86346595032AC55D84ECEF47C
SHA1:	4584398C7EB63752ED4727EA7B32E54A76F7985C
SHA-256:	9FE07FD950C23EDCACA64BA5E5CFCEB80915739AC84E01CA48AD27BAD3D062BF
SHA-512:	E1B206BEAEB13711DADE3A9346F3F3C76B8936C7A2BF8B114DDF6910661D8BF70E2C4B2ED2BE2080B6758C16CE18FE7028BC10148E7B5646E4E966E2EE46D96A
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............(... ...@....... ...............................T....@..................................(..O....@..@...............x&...`......\'............................................... ............... ..H............text........ ...................... ..`.rsrc...@....@......................@..@.reloc.......`......................@..B.................(......H.......P .......................&......................................BSJB............v4.0.30319......l.......#~......`...#Strings....d.......#US.h.......#GUID...x.......#Blob......................3......................................................\.....0...........D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.9...K.Y...S.

C:\Program Files (x86)\letsvpn\app-3.8.0\System.Reflection.Primitives.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	15480
Entropy (8bit):	6.749204604079557
Encrypted:	false
SSDEEP:	384:CMWzQWeNynsAw/98E9VF3AM+o6xaBDgXG:C5sAw/KENAMxZBZ
MD5:	B5044B9A057DBBA9C3C8F6493C560CF6
SHA1:	F73C065E558E87FBFC1EBFDA0D425E03F34D44F0
SHA-256:	9DAFCF874816350F5051E6DEF8B74C4DC60BE847237C89EAABC3DC0BDACD2B3C
SHA-512:	5E0BBB9A3C226EA68C0A0F96AEF04A5BAAAFFFCC46213C98F3CAAC34D3D69F006A0ECF143098479A735E0E19A1B98158D30F39E47E2DFF2A4D7F0DEB556798A8
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0.............N... ...@....... ..............................'.....@..................................)..O....@..@...............x&...`.......(............................................... ............... ..H............text...T.... ...................... ..`.rsrc...@....@......................@..@.reloc.......`......................@..B................0......H.......P ......................D(......................................BSJB............v4.0.30319......l...L...#~..........#Strings............#US.........#GUID...........#Blob......................3......................................................z.....N.....:.....b.................a...........0.....y...........K.....4...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.9...K.Y...S.

C:\Program Files (x86)\letsvpn\app-3.8.0\System.Reflection.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	15992
Entropy (8bit):	6.683459404591802
Encrypted:	false
SSDEEP:	384:DxDHKWAMWqNynsAw/98E9VF3AM+owMbOtKA:dD8oAw/KENAMxFxA
MD5:	B4400C5A1ABA6171ED1FCA1B71CEEEA7
SHA1:	67980C87C4336D5D2DEB8B3939DE18B8A82CB384
SHA-256:	11DC97B116AF80B8743243DE6819B55754157C1FD41724A74713273C6FCEF73C
SHA-512:	C95C1901944A500283E8FE0C8692970843B0F9CCAEE57EEF6DF3D7491CDE018048C92E9CE06EBFD2D27BA3CDC95611F077489CE76B1C1BB36E3D962ACD837F58
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0.............r,... ...@....... ..............................V.....@................................. ,..O....@..................x&...`...................................................... ............... ..H............text...x.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................T,......H.......P ......................h......................................BSJB............v4.0.30319......l...H...#~......D...#Strings............#US.........#GUID...........#Blob......................3................................"...............1.............{.................................Q.....j.......................n...................u.....u.....u...).u...1.u...9.u...A.u...I.u...Q.u...Y.u...a.u...i.u...q.u.......................#.....+.....3.....;.....C.....K.N...S.

C:\Program Files (x86)\letsvpn\app-3.8.0\System.Resources.Reader.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	14968
Entropy (8bit):	6.800102656580758
Encrypted:	false
SSDEEP:	384:yLNBEW6pW3NynsAw/98E9VF3AM+oNxouR:ybMEAw/KENAMxfR
MD5:	814F9A879DD177D44A94F735B2CDEB3E
SHA1:	747CF9E258AB5DF59C18969B6FD1698D941CBD53
SHA-256:	4AC33F7F44C6BB4857523A831341975E0AF7AB0244C608FC2786CFD156CE6F82
SHA-512:	BABD499A4B3824815111393868A2D386788513E945AC709C0EFB150C1A527D70D508E82358F80682CFE57B662E3DF1B1060C577DE2F02789F2C2300FD03C099B
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............(... ...@....... ...............................]....@.................................D(..O....@..................x&...`.......'............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................x(......H.......P ..<....................&......................................BSJB............v4.0.30319......l...\|...#~......0...#Strings............#US.........#GUID...,.......#Blob......................3......................................z...............\.....0..... .....D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.4...K.T...S.

C:\Program Files (x86)\letsvpn\app-3.8.0\System.Resources.ResourceManager.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	14968
Entropy (8bit):	6.84826707492014
Encrypted:	false
SSDEEP:	192:rH4Bxs0KHKW/tW5GNynC5c77bgfU5izh/y2sE9jBF3A5K+otmzKceb:rKkHKW/tWwNynsAw/98E9VF3AM+otUc
MD5:	33A3DD4F83B9918A6358F2D9E9594CAF
SHA1:	6228D07498B618AB58C3ED9C38D54D59633321DF
SHA-256:	68A4ECCA6F3521C0E21CB93CB42041D81B9C26C8A73B89BC7CA15DA8046C6CBA
SHA-512:	1582075F6BCCB67B5B4457A4409520FD90435BC9B570DA544DB67E2EE6427737E316AD96285787C5CEEEEE33AE365A55EEB1843C7A88A2B255552A3C2A15B333
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............)... ...@....... ....................................@..................................(..O....@..`...............x&...`.......'............................................... ............... ..H............text...4.... ...................... ..`.rsrc...`....@......................@..@.reloc.......`......................@..B.................)......H.......P ......................$'......................................BSJB............v4.0.30319......l.......#~..........#Strings............#US.........#GUID...........#Blob......................3..................................................W.....W...R.D.........f.......................=.....V.....}...........q.........................>.....>.....>...).>...1.>...9.>...A.>...I.>...Q.>...Y.>...a.>...i.>...q.>.......................#.....+.....3.....;."...C.=...K.]...S.

C:\Program Files (x86)\letsvpn\app-3.8.0\System.Resources.Writer.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	14968
Entropy (8bit):	6.7947255354740275
Encrypted:	false
SSDEEP:	384:CLnfIWqrW1NynsAw/98E9VF3AM+olAcvdR:CDf4oAw/KENAMxacT
MD5:	A2F0D40A8D42905D185EF4DB8599EED9
SHA1:	079A76924CE52E19AF2FD04A7745832BD90BEAC1
SHA-256:	DE7A2E1EBCBC64B339853AB696A850E8E78987F4328F1834E5D457F47C534AC8
SHA-512:	FD09E14B4D6B1E9F7CE3B6E52235A49372DC85C912FDCEDF7FBB9E0091C3E257073A0B33D30911CBD484E82E65175ED103E1FFDB6D9667A2B8A5E321B5A1A303
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............(... ...@....... ....................................@.................................D(..O....@..................x&...`.......'............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................x(......H.......P ..<....................&......................................BSJB............v4.0.30319......l...\|...#~......0...#Strings............#US.........#GUID...,.......#Blob......................3......................................z...............\.....0..... .....D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.4...K.T...S.

C:\Program Files (x86)\letsvpn\app-3.8.0\System.Runtime.CompilerServices.Unsafe.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	18552
Entropy (8bit):	6.558054999750472
Encrypted:	false
SSDEEP:	384:aybU8ndrbbT9NWB2W6NynsAw/98E9VF3AM+oO8tE:ay5ndvWWAw/KENAMxTE
MD5:	81B2DD30569F8417CA5ED6D91EDEF636
SHA1:	AA6BB3489DB7B60DD7141BCA9F3B2FBD67FBDD37
SHA-256:	D50DA557DF45942C5BB2DF88E698C984E9EDE1ED3ED0A1D702A1998630A4EC90
SHA-512:	A0855C6A6990CE6C83D641A82EE7C597124846437FBD65D672D2288A4FA395227195488CD2B9A2F5CA00E72F706264FD48412503C854D3F1002038E5E3FBFD29
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....Ksa...........!.................6... ...@....@.. ..............................w.....@..................................6..K....@..............."..x&...`.......$............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`....... ..............@..B.................6......H.......D%..<...................P ......................................_...+.'g.......x2..}}...B.O....T...e..?.M..R"M.~pg..c..LD#..y.....y....:u.v...#.;.-.h.......0..#.....a5\|T%W...].!.%'..9.0...........q......0..............q.......0..............q.......0..................0......................0......................0............q.............0............q.............0..............0..............0..................0...............*...0..............

C:\Program Files (x86)\letsvpn\app-3.8.0\System.Runtime.CompilerServices.VisualC.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	15480
Entropy (8bit):	6.7773144853669836
Encrypted:	false
SSDEEP:	192:BZhbRtxWl8WK1W5tNynC5c77bgfU5izh/y2sE9jBF3A5K+o1YcJHUR:Lna8WK1WLNynsAw/98E9VF3AM+o1zJK
MD5:	F21EA44D2DF5BD561C5869AA1D3B39A9
SHA1:	B23A69582F3283A05532B973BEC9FE47F45000B6
SHA-256:	B3123354683349BE1A093828C4374EA44DAAE9D519FF00D1EB930F40CA8BC153
SHA-512:	989BA420B156944CD693AF07813618142E3C0787F6183EAAFDA16E1B42111ECB95BA8D0BCDA369CC48DFBDFD0967ABE1DC4BACB8AE2AB217ACDBAA2C807813C7
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0.............j... ...@....... ..............................62....@....................................O....@..................x&...`.......(............................................... ............... ..H............text...p.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................L*......H.......P ......................`(......................................BSJB............v4.0.30319......l...@...#~......0...#Strings............#US.........#GUID....... ...#Blob......................3................................................w.................!...........<.....Y.............................................................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.)...C.D...K.d...S.

C:\Program Files (x86)\letsvpn\app-3.8.0\System.Runtime.Extensions.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	15480
Entropy (8bit):	6.727402464775893
Encrypted:	false
SSDEEP:	384:xBSWITW7NynsAw/98E9VF3AM+ot9vc0rZn:x6WAw/KENAMxvvcqZn
MD5:	47400FC5377CB2666AA3114940EE2C1C
SHA1:	A681278A3B762F568EF3717C044E769D12E78657
SHA-256:	66054C451039D3099FBF5A9E74181EA33A2D2193830DE46EFC5FFDACF0FE2C5B
SHA-512:	120A8242EDCA3F4D2AC992A536DAEB39F5DAE2BF4626CF83D92C2B9624D9D1449FB41BC906918EDCFC6A9545D0442C90082B534611375F0357B173693F849463
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0................. ...@....... ..............................J.....@..................................)..O....@.. ...............x&...`.......(............................................... ............... ..H............text...$.... ...................... ..`.rsrc... ....@......................@..@.reloc.......`......................@..B.......................H.......P .......................(......................................BSJB............v4.0.30319......l...@...#~..........#Strings............#US.........#GUID...........#Blob......................3..................................................\|.....\|...S.i.........g.................f...........5.....~...........P.....9...................c.....c.....c...).c...1.c...9.c...A.c...I.c...Q.c...Y.c...a.c...i.c...q.c.......................#.....+.....3.....;.....C.6...K.V...S.

C:\Program Files (x86)\letsvpn\app-3.8.0\System.Runtime.Handles.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	14968
Entropy (8bit):	6.841590720433094
Encrypted:	false
SSDEEP:	384:I88cIIWNoW5NynsAw/98E9VF3AM+oJTu0nF:I9cU1Aw/KENAMxFfF
MD5:	919DD02A82D5823A3E6362F1C065220D
SHA1:	7D6D69328A8F18C16B1430C949CF1C896BB04B7B
SHA-256:	AF44BFFF38889E83B0DF920ECBF04B296B11D34F6CE68E3475F66B40CB1C340D
SHA-512:	46FB9413D7411057D54EDCCED842180F0074A203117E7C3B9C31A3532A1465DF358A7A789A87E9C05E378DC54A88144DEBD373BB6F0DAF0EF6917EED626C584E
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0.............V)... ...@....... ..............................4L....@..................................)..O....@..................x&...`.......'............................................... ............... ..H............text...\.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................8)......H.......P ......................L'......................................BSJB............v4.0.30319......l.......#~.. .......#Strings............#US.........#GUID...........#Blob......................3..........................................................c.....J.....w.................v.....,.....E.................`.....I...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.3...K.S...S.

C:\Program Files (x86)\letsvpn\app-3.8.0\System.Runtime.InteropServices.RuntimeInformation.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	22136
Entropy (8bit):	6.5886653491946765
Encrypted:	false
SSDEEP:	384:WkUwx9rm5go1fWKmmW6oqN5eWjaWpNynsAw/98E9VF3AM+ogIUQY6rOBX:NrmoFmWdOLAw/KENAMxRUyrOR
MD5:	B913DBF8697A75E29BD5DBE22327E8A6
SHA1:	7D1C3F61658C333A2AB7A9C9097F09FF1A012750
SHA-256:	139B12CBF2BE4D81D281F4B1246D202184820E7564F45BEF99EFA7B77762D06F
SHA-512:	D527AB88289DCBFED411A43489AB26CB6A6786F9D1580C1D5CE0E99C82E784C34EA2FE9FE0890AC45B15706869910365C568585604DEEA3876CEBE1888B6D19C
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z.........." ..0..&...........E... ...`....... ....................................@.................................PE..O....`..x............0..x&...........D............................................... ............... ..H............text....%... ...&.................. ..`.rsrc...x....`.......(..............@..@.reloc..............................@..B.................E......H........$...............A.......C......................................j~....%-.&(....s....%..........0..$.........(.....o.......&...,....o....,.....................,!(....,..r...p.(....(......(......(....,.r...p......%...%...(......(.....(....,.r...p......%...%...%...(.......(.....(....,!r...p......%...%...%...%...(........(....2r...p.(....2r/..p.(..........(....2(.....(....^~....-.(.........~.....0..........~..........(.........(....-Y..(!....{/......5..,

C:\Program Files (x86)\letsvpn\app-3.8.0\System.Runtime.InteropServices.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	18040
Entropy (8bit):	6.642469143005083
Encrypted:	false
SSDEEP:	384:v09bOAghbsDCyVnVc3p/i2fBVlAO/BRU+psbC984vmJHrE1dtx66aI2sU52RWVsy:+OAghbsDCyVnVc3p/i2fBVlAO/BRU+pY
MD5:	FE325AA1B2B88D4B810CB820AC1451FD
SHA1:	FC01561BAFBCCB2943E333DB6A4A4846B9D9FF3F
SHA-256:	EA0779F81A6039D025C886C05E5B01F39124BD6EB0AB19406D05A83C4131B8C1
SHA-512:	D3070E6E65E5FD0BC348ADF0FC28D06B67BDE1B6456C7F80356E39A627E0F8AC28056FD45E979E5057530051666AA6C5516E73C1ED3821C4B9556945CB99A745
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0.............r5... ...@....... ...............................-....@................................. 5..O....@..P............ ..x&...`.......3............................................... ............... ..H............text...x.... ...................... ..`.rsrc...P....@......................@..@.reloc.......`......................@..B................T5......H.......P ......................h3......................................BSJB............v4.0.30319......l.......#~..........#Strings............#US.........#GUID...........#Blob......................3................................r.....................e...........4.................3.....L...................................R...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;. ...C.;...K.[...S.

C:\Program Files (x86)\letsvpn\app-3.8.0\System.Runtime.Numerics.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	14968
Entropy (8bit):	6.8014830758086475
Encrypted:	false
SSDEEP:	192:cyYx4AW6RW5KNynC5c77bgfU5izh/y2sE9jBF3A5K+oLD4qc0IPVgQ:A7W6RWoNynsAw/98E9VF3AM+oLLIp
MD5:	FD0535A85E1D8560F37B7AB03D3FBE77
SHA1:	FDBE8816D334FC9D0125B8C2693E5B4D0952B7D8
SHA-256:	78AC946923CCF8E801630AB01FF98EDB7D3D0641E7331A718324C87F3352C90E
SHA-512:	5279DD3E46FF85AB585B3A8BEA3CB8DD7E80D7577783EED5EE640407F170E2B001B54D2BECD83F3CF72897F711ACC448D835F66A8D2F4F49FCA15C69E31C5590
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0..............(... ...@....... ..............................A.....@.................................T(..O....@..................x&...`.......'............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................(......H.......P ..L....................&......................................BSJB............v4.0.30319......l.......#~......4...#Strings....(.......#US.,.......#GUID...<.......#Blob......................3......................................z...............\.....0...........D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.4...K.T...S.

C:\Program Files (x86)\letsvpn\app-3.8.0\System.Runtime.Serialization.Formatters.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	14968
Entropy (8bit):	6.892806055840072
Encrypted:	false
SSDEEP:	384:MI5HeWFwTBsWoNynsAw/98E9VF3AM+owYqbSG:MI5HFwTBiAw/KENAMxPqr
MD5:	DB49EEE7C696808C685F6561EBC0DC05
SHA1:	4D4D32C9C24257EC49E5659F3988DC5F1D0509C3
SHA-256:	68DDCFB922FF99618E93FE54166DB39F729E9A62DC6B1A52A2312DA0874D4002
SHA-512:	318A46573D1396784DA6F545745988CEA5DA4720FDA308F42612D1A309164B45330886DD3C940BAC75A2E838A6F49269332F6AE18C8172CE360F2577E1F52776
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0..............)... ...@....... ....................................@.................................\|)..O....@..................x&...`......D(............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................)......H.......P ..t....................'......................................BSJB............v4.0.30319......l.......#~..H.......#Strings....@.......#US.D.......#GUID...T... ...#Blob......................3............................................................U.x...........................~.....4.....M.................h.....$...................r.....r.....r...).r...1.r...9.r...A.r...I.r...Q.r...Y.r...a.r...i.r...q.r.......................#.....+.....3.....;.)...C.D...K.d...S.

C:\Program Files (x86)\letsvpn\app-3.8.0\System.Runtime.Serialization.Json.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	14968
Entropy (8bit):	6.855638105273029
Encrypted:	false
SSDEEP:	384:pAJpVWbfkBnWPNynsAw/98E9VF3AM+oyMS9nu:pAJpWfkBeAw/KENAMxbInu
MD5:	B3C4B77E07EA6E49BA2CE009BCBF3D99
SHA1:	3C69DA5D5C6831E131EF36AACF9F6C0EC86EB371
SHA-256:	423E7F9858E11CDFAB9A6A08EC6D44930B812855467A42FBC72D7AB8FDC5FC98
SHA-512:	AC8C5D1960B8B2D0B1EDE853944D77CB59203C1E3162CFDADC48FA554328385310745A3C2CDBA5B973061238B9E2D977398CF9B1D51ABE8495E53DA1026C3FE0
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0.............>)... ...@....... ....................................@..................................(..O....@..`...............x&...`.......'............................................... ............... ..H............text...D.... ...................... ..`.rsrc...`....@......................@..@.reloc.......`......................@..B................ )......H.......P ......................4'......................................BSJB............v4.0.30319......l.......#~..........#Strings............#US.........#GUID...........#Blob......................3......................................z...........@...\.@...0.-...`.....D.................C.................[.....x.....-.........................'.....'.....'...).'...1.'...9.'...A.'...I.'...Q.'...Y.'...a.'...i.'...q.'.......................#.....+.....3.....;.#...C.>...K.^...S.

C:\Program Files (x86)\letsvpn\app-3.8.0\System.Runtime.Serialization.Primitives.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20600
Entropy (8bit):	6.5070421514118015
Encrypted:	false
SSDEEP:	384:Q8R71h7yzt94dHWFgQBVWeHWFyTBVWyNynsAw/98E9VF3AM+o5NgJbS6y:R1dyAqgQBfqyTB7Aw/KENAMx5mYX
MD5:	3A6CF088D818A7753591D7D5690A5179
SHA1:	7705C246DA1A80BC4E98171959F7741661695555
SHA-256:	B37C5ED1F3213B494B776B17DBB627B857C0F8EA182FCB5ED1D3FF6B2B848FF4
SHA-512:	B07AFA3C09209DAC0DDB502AE938B3886DB46508F68E94606966A7E4F1578BFEF6B5A183DF7F4D3D0519A633E0762A59D987F7649BCA5A6849B5F0B173F00F9E
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z.........." ..0..............8... ...@....... ...............................+....@..................................8..O....@..8..............x&...`.......7............................................... ............... ..H............text........ ...................... ..`.rsrc...8....@......................@..@.reloc.......`.......(..............@..B.................8......H.......\|!..l............1..p...X7......................................j~....%-.&(....s....%..........0..$.........(.....o.......&...,....o....,.....................,!(....,..r...p.(....(......(......(....,.r...p......%...%...(......(.....(....,.r...p......%...%...%...(.......(.....(....,!r...p......%...%...%...%...(........(....2r...p.(..........(......BSJB............v4.0.30319......l.......#~..h.......#Strings....\...4...#US.........#GUID...........#Blob...

C:\Program Files (x86)\letsvpn\app-3.8.0\System.Runtime.Serialization.Xml.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	18552
Entropy (8bit):	6.649154461430228
Encrypted:	false
SSDEEP:	384:DpsBljcZQIVI8CNwbcyMWs4oBOW9MWG4tBOWlNynsAw/98E9VF3AM+owhma:9sPMQMI8COYyi4oBNw4tBzAw/KENAMx2
MD5:	B285F197C89B5F85C2888003D3DC1BDF
SHA1:	6C047D63E071B1193FDD3C030CA577471DE014B5
SHA-256:	0D1E8BD8021109DB71038BF94DC49F9FB3F64DF1E755167A85502D453B9ECC01
SHA-512:	E75BD4F50BB8B2D4447D12A5A6F83EF83E77DB881B6F56C0AB2A1A66C5AA978F072200A5B490716170FBD57BC79940CE6FFA6D6F3A2932C0714F64CBC7B89344
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z.........." ..0..............3... ...@....... ....................................@..................................3..O....@..............."..x&...`.......2............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`....... ..............@..B.................3......H........!..0...................L2.......................................s......s......0...........o....u......,..o......0..%........s..........(....r...p.$o......o....:.(......}......{.....(....z.(....z6.{.....o....:.{......o.....(....z:.{......o.....(....z.(....z.BSJB............v4.0.30319......l.......#~.. .......#Strings....$...0...#US.T.......#GUID...d.......#Blob...........W..........3............................................................................

C:\Program Files (x86)\letsvpn\app-3.8.0\System.Runtime.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	23160
Entropy (8bit):	6.28577170728029
Encrypted:	false
SSDEEP:	384:PbhigwLAuZtM66g/Id7WVXWpNynsAw/98E9VF3AM+oVu46/IdvKE:PbhzkKs0Aw/KENAMx77F
MD5:	67639290A759FAADC7E0A1E213B67A6E
SHA1:	9235627E26F7FAFCD51B0680B05EDBBBFF574BDF
SHA-256:	A14A1A4CAF71483CFEBA1694218BB19102DDAD2E6F1DC0158406296B26ABB18D
SHA-512:	F5155AE14D93DB90385EF386B3E43D4DE0B9C1EB9484EC5740A5E6B3D2F4DC19C166349E9BEFDAA35888AAFC851C7C8D9279E34BAE677B3B5AD65D49F93D154B
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0............"H... ...`....... ...............................z....@..................................G..O....`...............4..x&...........F............................................... ............... ..H............text...((... ..................... ..`.rsrc........`.......,..............@..@.reloc...............2..............@..B.................H......H.......P ...%...................F......................................BSJB............v4.0.30319......l.......#~..........#Strings.....#......#US..#......#GUID....#......#Blob......................3................................................_.........................8.....8....8.....8.....8.....8.....8.....8..........8.................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.+...K.K...S.

C:\Program Files (x86)\letsvpn\app-3.8.0\System.Security.AccessControl.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	36472
Entropy (8bit):	6.027655216465377
Encrypted:	false
SSDEEP:	384:zClIF91FhktexyvaMAdB+w3G5h9MF4YfzMfpcrqmf9wEJqIxVRvFNgfBkyN17xWv:WlM7Ke5/WBkyN1hjAw/KENAMxerj
MD5:	5C53C93A58BD47B9C6BA58C71AE06754
SHA1:	2A237D36B0FC4469CC5DE354A29B89F8039EF499
SHA-256:	CAACA309FE6C3180EC808BC0E1F6A459A653EFD548E0B6F4BA59192B52F9FF1E
SHA-512:	DAF26D160C6FE37E2BD683186F5612DDF03888B1A235310CA1E15BCB970843F815E060163F349208D76E74C2C371C36E9632859F816D39F92AEA6623501CD2CB
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0..Z...........x... ........... ..............................-)....`..................................x..O....................h..x&...........w..T............................................ ............... ..H............text....X... ...Z.................. ..`.rsrc................\..............@..@.reloc...............f..............@..B.................x......H........%..p5..........P[.......w.......................................~......0..........(....,....(.....o.......&......................0...........(.......(....-..,....(....,.r...p......%...%...(......(.....(....,.r...p......%...%...%...(.......(.....(....,!r...p......%...%...%...%...(........(......,&(....,..r...pr...p.(....(......(......(....,.r...p......%...%...(.......(.....(....,.r...p......%...%...%...(........(.....(....,"r...p......%...%...%...%..

C:\Program Files (x86)\letsvpn\app-3.8.0\System.Security.Claims.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	14968
Entropy (8bit):	6.830774918807505
Encrypted:	false
SSDEEP:	384:sUcX6W9aWyNynsAw/98E9VF3AM+okHcXJacl:sUchKAw/KENAMxHXRl
MD5:	FA0DF58934F9C3917EEF67481B6F8655
SHA1:	8888B04CCF48A6D1AD12682E1E9B30400EDC2A1A
SHA-256:	734E63EF151AB3CA64B2F45F6597B65EB2CDB0A9D314633244CC7039F6E63BCC
SHA-512:	A474E9D01FB4B1869CA14FF79CC6DD08A59B51A8BC5C09295544F9E8ECE535814EAF8F7D449951450C88B6111794F476634B5662282C98D8215DD11FECC1F8DB
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0.............B)... ...@....... ....................................@..................................(..O....@..................x&...`.......'............................................... ............... ..H............text...H.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................$)......H.......P ......................8'......................................BSJB............v4.0.30319......l.......#~..<.......#Strings............#US.........#GUID...........#Blob......................3......................................................\.....0.....(.....D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.3...K.S...S.

C:\Program Files (x86)\letsvpn\app-3.8.0\System.Security.Cryptography.Algorithms.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	40568
Entropy (8bit):	5.925525639765563
Encrypted:	false
SSDEEP:	768:voBj7kS+8mjvHTeaWKs0Sd4eeKAw/KENAMx/I:SPmb9WKs0PeeKAwrx/I
MD5:	776B096F900E8B42389F945D0C83ED1B
SHA1:	5E9451CB2BDE12FA9F98CEF309AEDC9F61BA22B6
SHA-256:	9A95A2AA57FC01ACCB04E5D076058206F84C3EF78F853467D2615B0DE12FFBAE
SHA-512:	1E400A015F04FF12C457A8D97D6CEF6B14E5628CB801B4D3ED8E396AF7E148268466723D69838EB67D775DBA358D8F4624A614BD6625F358809E5C1C3E5B8B71
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z.........." ..0..h.............. ........... ....................................@.................................u...O.......8............x..x&........................................................... ............... ..H............text....f... ...h.................. ..`.rsrc...8............j..............@..@.reloc...............v..............@..B........................H.......P'..\8..........._...%..,.......................................j~....%-.&(F...s....%..........0..$.........(.....o.......&...,....o....,.....................,!(....,..r...p.(....(......(......(....,.r...p......%...%...(......(.....(....,.r...p......%...%...%...(.......(.....(....,!r...p......%...%...%...%...(........(....2r...p.(....2rI..p.(....2r...p.(....2r...p.(....2r...p.(....2r...p.(....2r9..p.(....2rm..p.(....2r...p.(....2r...p.(....*2r=..

C:\Program Files (x86)\letsvpn\app-3.8.0\System.Security.Cryptography.Cng.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	19576
Entropy (8bit):	6.653648806525993
Encrypted:	false
SSDEEP:	384:gVdtuO/q3p4YN5XYwWCfW6KNynsAw/98E9VF3AM+o1OTIwa4SB:gVJSZBXY4PeAw/KENAMxMi4SB
MD5:	1A1BA150E2850F42AADE35130AAAF9CD
SHA1:	47057EB9200F7ED1313A206E1D0FFFF65F7D012C
SHA-256:	7F014DCCDE86BC4A0807421D1D69BDC19DF21888FC2E7DBBCFB942EE036B7BC2
SHA-512:	28628239B5A036954397D2A6119A0F2BF70DC2B59BD9AF7C248B3E78EFD7811D7703AD09207B3C28D450F9762E3E610A2A76B358205D646F8D5EFB6204311AA8
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...q............." ..0.............j:... ...@....... ...............................Q....`..................................:..O....@...............&..x&...`.......9..T............................................ ............... ..H............text...p.... ...................... ..`.rsrc........@......................@..@.reloc.......`.......$..............@..B................L:......H.......\|!..............t6.. ....8......................................:.(......}......{...."..(...."..(...."..(......(......(......(......(....:.(......}......{....:.(......}......{....:.(......}......{......(....:.(......}......{....^.(...........%...}....:.(......}......{....z.(......}...........%...}....V.(......}......}......{......{....*..BSJB............v4.0.30319......l.......#~..@.......#Strings....T.......#US.X.......#GUID...h.......#Blob...

C:\Program Files (x86)\letsvpn\app-3.8.0\System.Security.Cryptography.Csp.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	14968
Entropy (8bit):	6.8644913084994625
Encrypted:	false
SSDEEP:	192:cEtTL/WxOT6LoWPzW5DNynC5c77bgfU5izh/y2sE9jBF3A5K+oC7s+9iBPN:dTI2pWPzW1NynsAw/98E9VF3AM+oCli/
MD5:	C441D062A861F4CCF12275FDA8213C8C
SHA1:	BFFEDE7F0FCFD807494076E7163C4F85E2FE1DA9
SHA-256:	2DBA318CE18DAAB0A23ECD5C6A52F292BECD3DD722F28D69339B9CF0E0E483BA
SHA-512:	0E4F9A4FE21D807472AD29F41A408D9C32D38CA2683051F6EB3A2ABCB1B30B899130CDAF936D923AE86BB603EC3D31EF2E1219392F22ADF099A98E4D58F39253
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0.............^)... ...@....... ..............................f.....@..................................)..O....@..`...............x&...`.......'............................................... ............... ..H............text...d.... ...................... ..`.rsrc...`....@......................@..@.reloc.......`......................@..B................@)......H.......P ......................T'......................................BSJB............v4.0.30319......l.......#~..,.......#Strings............#US.........#GUID...........#Blob......................3......................................z...........A...\.A...0.....a.....D.................C.................[.....x.....-.........................(.....(.....(...).(...1.(...9.(...A.(...I.(...Q.(...Y.(...a.(...i.(...q.(.......................#.....+.....3.....;."...C.=...K.]...S.

C:\Program Files (x86)\letsvpn\app-3.8.0\System.Security.Cryptography.Encoding.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	14968
Entropy (8bit):	6.878953416934269
Encrypted:	false
SSDEEP:	384:mcezoy4W04W7uNynsAw/98E9VF3AM+oJzC3q:mBzoy+4Aw/KENAMxs6
MD5:	46248082F106473781DFBB7CFD316A2B
SHA1:	508AD1E55AC979D9EC0F3D49988FE01F118F68AC
SHA-256:	08AED36B4D8BBC2CA2CF4752413D49D69CE5B23524538A8A0DC27B6ADFA30C27
SHA-512:	4EFEDB09B3FF0D98EA460EE14C3C61926328A0487879E89EA1BD094F859482C20F9916E2E615CD152882046EE9072A60090E1FE8CF24CB0BC97FC5E75677B0E6
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0.............~)... ...@....... ...................................@.................................,)..O....@..................x&...`.......'............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................`)......H.......P ..$...................t'......................................BSJB............v4.0.30319......l.......#~..<.......#Strings............#US.........#GUID....... ...#Blob......................3..................................................f...o.f...C.S.........W.................V...........%.....n...........@.....)...................M.....M.....M...).M...1.M...9.M...A.M...I.M...Q.M...Y.M...a.M...i.M...q.M.......................#.....+.....3.....;.'...C.B...K.b...S.

C:\Program Files (x86)\letsvpn\app-3.8.0\System.Security.Cryptography.Pkcs.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20600
Entropy (8bit):	6.619821686147398
Encrypted:	false
SSDEEP:	384:3yBGXZp94Yi06W82WLNynsAw/98E9VF3AM+owI0dxNObj+:umZp9Zw5Aw/KENAMxGnsa
MD5:	A33429C11454244C0E581AA1D9419690
SHA1:	5DA6F78652F24CAA212A7689F5B9E76A0B7CC821
SHA-256:	555FF6F44EC6CA0D3E193413FD79D32A5A03B3929BF37DF72AC8CFE5C2E8E3FC
SHA-512:	E5B26BB1562DCEF844FD610BCF8C982F612E8AFB66EB12EEA31E09CBBF0084D03D713F1A98A8A50C55D775D719A8EA09E47C987F5BAF4FD2EB305E8788C21A6C
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....J..........." ..0.............Z=... ...@....... ...............................B....`..................................=..O....@..X..............x&...`.......<..T............................................ ............... ..H............text...`.... ...................... ..`.rsrc...X....@....... ..............@..@.reloc.......`.......(..............@..B................;=......H........!..............d9.. ....;......................................:.(......}......{...."..(...."..(...."..(...."..(...."..(......(......(......(......(....:.(......}......{....:.(......}......{....:.(......}......{......(....:.(......}......{....^.(...........%...}....:.(......}......{....z.(......}...........%...}....V.(......}......}......{......{....BSJB............v4.0.30319......l...h...#~......0...#Strings............#US.........#GUID...

C:\Program Files (x86)\letsvpn\app-3.8.0\System.Security.Cryptography.Primitives.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	15480
Entropy (8bit):	6.762338825068934
Encrypted:	false
SSDEEP:	192:cpgHWexY+WKpW5GNynC5c77bgfU5izh/y2sE9jBF3A5K+oNgfrmHtQG:nH/JWKpWUNynsAw/98E9VF3AM+oWyHaG
MD5:	2C17367B9676015B034BED6889459BFD
SHA1:	313AED415E3106FE0A76FC21E619AED0CCDA8166
SHA-256:	B198A77A66CB7A2A2C95103EC8D27E3FB30BD6CB6706ADF7D495149FAF1928E7
SHA-512:	6DF1CFF355BD6E6175CDA83D2BA07CD69366FD17E4D642E93CA668F3660D656DCFEC8268320DB00F8983715684CCE1EEB002165BFECD7E758296C31CA6D23922
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0............."... ...@....... ....................................@..................................)..O....@..................x&...`.......(............................................... ............... ..H............text...(.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.......................H.......P .......................(......................................BSJB............v4.0.30319......l...$...#~..........#Strings............#US.........#GUID....... ...#Blob......................3............................................................o.s...........D.....D.....D.....D...8.D...Q.D.....D.....D...l.....U.D.................m.....m.....m...).m...1.m...9.m...A.m...I.m...Q.m...Y.m...a.m...i.m...q.m.......................#.....+.....3.....;.)...C.D...K.d...S.

C:\Program Files (x86)\letsvpn\app-3.8.0\System.Security.Cryptography.ProtectedData.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	19576
Entropy (8bit):	6.694396388199787
Encrypted:	false
SSDEEP:	384:D4YlS5PWAb6jDWANynsAw/98E9VF3AM+oHBMv1t:DmYzAw/KENAMxhU
MD5:	A99DE80CB0FC0B27CE6ADB9006FF99A8
SHA1:	0A6856A19E82B10EE38A563C18F9FC7DFAEC25E0
SHA-256:	105E179208B3A0B0B55D2CFE98EC2B1013CE393E1EF14576F9D8C2ABD30629EA
SHA-512:	B7426D88EF71AB36A5A14537264BB091F96CF2D0E32DA1CAA25A10466285AA966C7FF2AFA450531A6D39CE18C9EE7E05050D28B5408B830BEFD29954D06132D5
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...H.W..........." ..0..............9... ...@....... ..............................)1....`.................................M9..O....@...............&..x&...`......88..T............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`.......$..............@..B.................9......H........!...............5..0....7......................................:.(......}......{...."..(...."..(...."..(...."..(...."..(......(......(......(......(....:.(......}......{....:.(......}......{....:.(......}......{......(....:.(......}......{....^.(...........%...}....:.(......}......{....z.(......}...........%...}....V.(......}......}......{......{....*BSJB............v4.0.30319......l.......#~..0.......#Strings............#US.........#GUID...

C:\Program Files (x86)\letsvpn\app-3.8.0\System.Security.Cryptography.X509Certificates.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16504
Entropy (8bit):	6.710342529092688
Encrypted:	false
SSDEEP:	384:MTjbocNsWMhWlNynsAw/98E9VF3AM+oCyX2Xfh:gboYyOAw/KENAMx1S
MD5:	2948F842DD70A33ECF10C431DCB43303
SHA1:	6410D052855DD73DB673D3CF1C1D971EA7FF8ACF
SHA-256:	233A0B92D9B8216B62EABC7523AA2067AA368DFFB1CE195EEAA671879252AD95
SHA-512:	BD6EAC5A5F86F621BBFBC8E49DF0FA142CB4ED3A119513B732D2F2FD40345379501FBC4C32FFFF0959C5136110B1CF8E5B3258FDBDB824505D692B9645E1C399
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0.................. ...@....... ..............................g)....@..................................-..O....@..................x&...`.......,............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................-......H.......P .......................,......................................BSJB............v4.0.30319......l.......#~......\|...#Strings....x.......#US.\|.......#GUID.......(...#Blob......................3................................'.....).........u.................=......."...:."...W.".....".....".....".....".....".....[.....".................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;./...C.J...K.j...S.

C:\Program Files (x86)\letsvpn\app-3.8.0\System.Security.Cryptography.Xml.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	50296
Entropy (8bit):	5.7498296292461335
Encrypted:	false
SSDEEP:	768:vszrvuWznnuJlMeEM8Hy8d4Vx50lAhDVC+nAw/KENAMxFXj:vgrvuqcP8RE5tQ+nAwrxh
MD5:	09F599485E60C9409F86EAD197FEE30F
SHA1:	9B35A82EC8A7F30708F01A670356228AE11B051D
SHA-256:	3EF1F1E87A04A94FDB743AAFADC97F1381EC168736523FEDE9775C61F8F4831C
SHA-512:	5A4E21C3B36248EA661DAAB6508E5747D5B593D4189E68A5A7EF0B7C50780613C71C398D5B981D895822F389F9967B2225E28C87190DBEBA5AF28988BA292F19
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0................. ........... ....................................`.....................................O.......4...............x&..............T............................................ ............... ..H............text....... ...................... ..`.rsrc...4...........................@..@.reloc..............................@..B.......................H........&...K...........q.. ............................................~......0..........(....,....(.....o.......&......................0...........(.......(....-..,....(....,.r...p......%...%...(......(.....(....,.r...p......%...%...%...(.......(.....(....,!r...p......%...%...%...%...(........(......,&(....,..r...pr...p.(....(......(......(....,.r...p......%...%...(.......(.....(....,.r...p......%...%...%...(........(.....(....,"r...p......%...%...%...%..

C:\Program Files (x86)\letsvpn\app-3.8.0\System.Security.Permissions.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	28280
Entropy (8bit):	6.296428773095193
Encrypted:	false
SSDEEP:	768:P47XzsCggQsW7Sl8xjP/QZxAw/KENAMxF6:Q7XgpRxb/kxAwrxF6
MD5:	D26AD9F981456702DAA2527E77E29C31
SHA1:	25C9BE794C0DA62E93EA2FBACA4603F0AE54C9AE
SHA-256:	61A742ED9BF0CF347BA4218ABF1848F58B574F0C0782C7511E635ABEC941302D
SHA-512:	F0C22272273C01B74219774AFA551B8DED65B1CC2AAE48BBCAADC69CFE9735F15FB45DBCE7F6515CFCFE07B229D0BFD88773262F68B26A9D3489071ADDF89376
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...0............." ..0..>..........r]... ...`....... ....................................`..................................]..O....`...............H..x&..........(\..T............................................ ............... ..H............text...x=... ...>.................. ..`.rsrc........`.......@..............@..@.reloc...............F..............@..B................S]......H........#...2..........0U..x....[.......................................~......0..........(....,....(.....o.......&......................0...........(.......(....-..,....(....,.r...p......%...%...(......(.....(....,.r...p......%...%...%...(.......(.....(....,!r...p......%...%...%...%...(........(......,&(....,..r...pr...p.(....(......(......(....,.r...p......%...%...(.......(.....(....,.r...p......%...%...%...(........(.....(....,"r...p......%...%...%...%..

C:\Program Files (x86)\letsvpn\app-3.8.0\System.Security.Principal.Windows.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	19064
Entropy (8bit):	6.679862240557071
Encrypted:	false
SSDEEP:	384:sEwo6eTs14YY4cWpOWhNynsAw/98E9VF3AM+oKmAgdeMEt:FwDdTfAw/KENAMxHUzt
MD5:	A74F50E751F0B0CA185E476598A98193
SHA1:	6DB6DBFDF87ACC61B1159AFC15325CD2CA3ECAC9
SHA-256:	D8369FF36E302398D3120E7B5A3E0E05730A5782DA2D2DC504EE06CAA280D715
SHA-512:	90CBF94F4B2E12016ABF020F67B9881A81B20B7F50578F54BDB447D0A05863568CE644CA6B1E554D7D7271B7B924FEBF8AD890A1D7BE546AFBDFFFE6CEECA569
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....r..........." ..0.............V8... ...@....... ...................................`..................................8..O....@...............$..x&...`.......6..T............................................ ............... ..H............text...\.... ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B................68......H.......\|!..............\4.. ...\|6......................................:.(......}......{...."..(...."..(...."..(......(......(......(......(....:.(......}......{....:.(......}......{....:.(......}......{......(....:.(......}......{....^.(...........%...}....:.(......}......{....z.(......}...........%...}....V.(......}......}......{......{....*..BSJB............v4.0.30319......l.......#~..@.......#Strings....8.......#US.<.......#GUID...L.......#Blob...

C:\Program Files (x86)\letsvpn\app-3.8.0\System.Security.Principal.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	14968
Entropy (8bit):	6.81168346392725
Encrypted:	false
SSDEEP:	192:c8fExAJsjWVWhW5NNynC5c77bgfU5izh/y2sE9jBF3A5K+oTnYgOWn6H:3SKiWIhWvNynsAw/98E9VF3AM+oTY0nS
MD5:	031DB5B294441B7D5D50A49DF348F61C
SHA1:	3EFBB4D426497B07BFB5BACC69EAE9F88A95A66F
SHA-256:	88F762BA6E058A6446069C73D5082F0937F34FC91CE9DBFEC1A2AA5D1D5E5B42
SHA-512:	CF55BB0D3B07CC1FE8A186E76DF1F1E33F91B3711CF78632ADE14F210C870E7A05BD9246663712BFE766F027630FA85D9C45E665FDE77DA48E268663AD3679F4
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0..............(... ...@....... ....................................@.................................t(..O....@.. ...............x&...`......<'............................................... ............... ..H............text........ ...................... ..`.rsrc... ....@......................@..@.reloc.......`......................@..B.................(......H.......P ..l....................&......................................BSJB............v4.0.30319......l.......#~......@...#Strings....D.......#US.H.......#GUID...X.......#Blob......................3......................................................\.....0.....'.....D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.6...K.V...S.

C:\Program Files (x86)\letsvpn\app-3.8.0\System.Security.SecureString.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	15992
Entropy (8bit):	6.754088027834978
Encrypted:	false
SSDEEP:	384:a0KbZWApWmWTpWMNynsAw/98E9VF3AM+oLPi4Nkx:dKRyFAw/KENAMxzB0
MD5:	EAA2B0229980B92394676C131B0274A3
SHA1:	EE1F73068C84F0FF2EDFFC77D878EBD6A4FE1464
SHA-256:	A83D85DBE7C10AF01DFB5F4C8C5D62BC049AD124A1E834EF66EE07FB5D8BDDFC
SHA-512:	F784EDC2B7F86721A5B629273F38509B42A4ECE0474C821E19800D5454F8CC194F723ADCBAB2A1226CAAF2EBEC7E0F8ED78E2BCBFC3CD27260C2759C4A628354
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z.........." ..0..............)... ...@....... ..............................p.....@.................................>)..O....@..................x&...`.......(............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................r)......H.......p .......................(........................................(......(......(......(....BSJB............v4.0.30319......l.......#~..........#Strings....`.......#US.h.......#GUID...x...(...#Blob...........G..........3.............................................."...........C...........u...............m.b...........J.....J.....J.....J...6.J...O.J.....J.....J...j.C...S.J.............................P ............X ............` ......4.....h ....................

C:\Program Files (x86)\letsvpn\app-3.8.0\System.ServiceModel.Duplex.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	14968
Entropy (8bit):	6.832679409000617
Encrypted:	false
SSDEEP:	384:pLH9W5nOWlNynsAw/98E9VF3AM+oPwj1Bu:pL4zAw/KENAMxUDu
MD5:	7C3742FC15BB40126181B85E080E0603
SHA1:	929B4290CC7836FA951B3F61305F63CCB80D89DB
SHA-256:	FD1BFA30003038A6880197CA137C7E76451FAAB17D63DBE4B126A8050FA0723E
SHA-512:	2C74873250900D2CBA8084191CE861D9197FF2481E5AAC8EDB07A9C77D63C4E25929F1DE77D54208039F55797B23B6E2E23C4D913B6492A24D1F4FE89587785F
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....y............" ..0..............)... ...@....... ..............................].....`..................................(..O....@..p...............x&...`.......'..T............................................ ............... ..H............text...$.... ...................... ..`.rsrc...p....@......................@..@.reloc.......`......................@..B.................)......H.......P ......................X'......................................BSJB............v4.0.30319......l.......#~..D.......#Strings............#US.........#GUID.......$...#Blob......................3................................................*.0.....0...g.....P...........M...........c.......................J.....{.....~.......+...........................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....+.8...+.N...3.d...;.....C.

C:\Program Files (x86)\letsvpn\app-3.8.0\System.ServiceModel.Http.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	15992
Entropy (8bit):	6.728639920161468
Encrypted:	false
SSDEEP:	384:ElbWvX+W1NynsAw/98E9VF3AM+opp8IU35F:E2zAw/KENAMxUT/
MD5:	E01A5C1F26C22A95EF52DA2E6BC988A4
SHA1:	517CD791DC0B2CFFA1D96B941A8902B69A920BDB
SHA-256:	5912402920052DAF4697EA36E2DFA5398B853751471A90E4A4BD7AEE9532F250
SHA-512:	BC1C27A06FCCF501BE11D631B251E508BFEA80E131A4E5CABC9CCD7A02099439522DA171ADC0CFC2A6B2D464F19344FFEB15639EB19FBEBD1AEC66F71C4EE4FD
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................" ..0..............,... ...@....... ....................................`.................................L,..O....@..`...............x&...`......\+..T............................................ ............... ..H............text........ ...................... ..`.rsrc...`....@......................@..@.reloc.......`......................@..B.................,......H.......P .......................*......................................BSJB............v4.0.30319......l...8...#~..........#Strings....T.......#US.X.......#GUID...h...$...#Blob......................3................................................}.t.....t.....a........._.......................B.................................................[.....[.....[...).[...1.[...9.[...A.[...I.[...Q.[...Y.[...a.[...i.[...q.[.......................#.....+.....+.6...+.L...3.b...;.}...C.

C:\Program Files (x86)\letsvpn\app-3.8.0\System.ServiceModel.NetTcp.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	15480
Entropy (8bit):	6.7431190083640145
Encrypted:	false
SSDEEP:	384:A2mtX7WWRvWWbNynsAw/98E9VF3AM+oAYRKI9+H:A28XdpAw/KENAMxA9Ic
MD5:	5DBD710B004A9F6DFDF52E8467DF72A0
SHA1:	149D9FCAD3B3ACF5E5B0CE7F30A4FD3E439BA75E
SHA-256:	99FD731CB7E9EF6EDE71717D0CC3455B2FA319553F2F215C02BB3B5EBB503B75
SHA-512:	15FA4138C06E395B300296B199D71557E24ECF695705B680F96DDBE2E153A9CA79BB7261EC67C9D183893AE1FE04EC5D7C8ED83C9559564381FC2FF4582042FE
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....>c..........." ..0............."... ...@....... ..............................x.....`..................................)..O....@..p...............x&...`.......(..T............................................ ............... ..H............text...(.... ...................... ..`.rsrc...p....@......................@..@.reloc.......`......................@..B.......................H.......P ......................\(......................................BSJB............v4.0.30319......l... ...#~......H...#Strings............#US.........#GUID.......$...#Blob......................3..................................................4...q.4...E.!...T...........+.....X.....'...........p.................Y.....B...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....+.8...+.N...3.d...;.....C.

C:\Program Files (x86)\letsvpn\app-3.8.0\System.ServiceModel.Primitives.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	22136
Entropy (8bit):	6.3830115600760395
Encrypted:	false
SSDEEP:	384:N8h2IgODoeNlPSCqWvVEWiXNynsAw/98E9VF3AM+oV7Qm:Oz1zNlFBw9Aw/KENAMxFl
MD5:	8376E1735EAD406722CE0A13F61CA6F4
SHA1:	07CC0C412A136E795E5AD2976AB197E0EFC2FE0E
SHA-256:	43956FE381A896782B0DDD752BD652BBB5BA375BFDC6186D8C54E5D1777C826C
SHA-512:	87078D10275D992C03CF4F7BB5B3A1A93125B3FD6128E1D22C87A2C2FD9F26583E8DD4AFBEC8CD1EF7D11198F6446BFBB0323FE0171D43D774F860E45849DDCE
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0..&...........D... ...`....... ..............................~\....`.................................xD..O....`...............0..x&..........\|C..T............................................ ............... ..H............text....$... ...&.................. ..`.rsrc........`.......(..............@..@.reloc..............................@..B.................D......H.......P ..."...................B......................................BSJB............v4.0.30319......l.......#~..,...D...#Strings....p ......#US.t ......#GUID.... ..(...#Blob......................3......................................I...............\...................t.....t...C.t.....t...\.t.....t...6.t.....t.....t.....l.................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+. ...+.<...+.R...3.h...;.....C.

C:\Program Files (x86)\letsvpn\app-3.8.0\System.ServiceModel.Security.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	15992
Entropy (8bit):	6.779988992419316
Encrypted:	false
SSDEEP:	384:BLkW1JgWgNynsAw/98E9VF3AM+oMAuQBJ:BVKAw/KENAMxZXr
MD5:	BDF38E523E48E4E7433EDC3EAC2623A8
SHA1:	6DE2A0094F1C9DC87BAC717E3EA3C5B5944668D9
SHA-256:	55690DA45B7F0ED9654378218DAC0DE737EB6FA1EC611E5EB3EB6FEBF37E403B
SHA-512:	AB2D16B7AF0C2F2337AA85967C6E19AC972068BEE9A283CE5F8DE86156799B371FC4ED2BBEF872BB83D077800C9BAA41B7F85749F41AEAD935A510EC6A8F563A
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....1..........." ..0.............V-... ...@....... ..............................~.....`..................................-..O....@..................x&...`.......,..T............................................ ............... ..H............text...\.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................8-......H.......P ..<....................+......................................BSJB............v4.0.30319......l...<...#~......X...#Strings............#US.........#GUID.......(...#Blob......................3................................................:.............................w...........s.......................Z.............%.................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....+.:...+.P...3.f...;.....C.

C:\Program Files (x86)\letsvpn\app-3.8.0\System.ServiceModel.Syndication.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	18040
Entropy (8bit):	6.688404947321908
Encrypted:	false
SSDEEP:	384:GISW5NW2eWoNynsAw/98E9VF3AM+oZ9O7v:G+5b0Aw/KENAMxa
MD5:	974C69D21335505D6CE4FB177008DD71
SHA1:	28E25C34A7A19B51A6763745A406A0544DD6791B
SHA-256:	68E9D279DD59107E22900434C8CEA1492E53AA914C5BB1109DA17A4C919D9C23
SHA-512:	840884C5C03BD15664C6DBFD094EA2DC7C058B0BA2B4430470E4E79BC67116294FF6D0DDFA53B801E7B91AA99696CE8BC738A4EBD68CDA3C522661B3660D1DE9
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................" ..0..............4... ...@....... ....................................`................................./4..O....@............... ..x&...`......83..T............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................c4......H........ ...............0.. ....2......................................:.(......}......{...."..(...."..(...."..(...."..(...."..(....*BSJB............v4.0.30319......l.......#~..........#Strings....\.......#US.`.......#GUID...p.......#Blob...........W..........3........................................................".........................q.......................B...................q...........q...X.q...'.q.....q...K.q...h.q.....q.....q...............%.....y.......{.

C:\Program Files (x86)\letsvpn\app-3.8.0\System.ServiceProcess.ServiceController.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20088
Entropy (8bit):	6.667915364225621
Encrypted:	false
SSDEEP:	384:hxO4YkTdk8VKWCWV1upaWrNynsAw/98E9VF3AM+o5Mi7J0:hxOSQvAw/KENAMxhW
MD5:	8BC796C134027966B293B9251FEA8A7D
SHA1:	2DD97B66859347F10C1697AD9EA053BEEA85A76C
SHA-256:	A9FBC8846AF9E2EEC2C9B99BB69D2049AC8EC53B3175FD11CD6CA5C0164A7640
SHA-512:	220EA92E16F018C11B899CFB0BFA97163F35271DA286E3EE34F1215006E190922361F3275C294477ECF28801727DC0B457B86560899814A01764E6FB228A5BEF
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....)............" ..0.............;... ...@....... ...............................Z....`..................................:..O....@...............(..x&...`.......9..T............................................ ............... ..H............text...0.... ...................... ..`.rsrc........@......................@..@.reloc.......`.......&..............@..B.................;......H........!...............7..0...H9......................................:.(......}......{...."..(...."..(...."..(...."..(...."..(......(......(......(......(....:.(......}......{....:.(......}......{....:.(......}......{......(....:.(......}......{....^.(...........%...}....:.(......}......{....z.(......}...........%...}....V.(......}......}......{......{....BSJB............v4.0.30319......l...4...#~......T...#Strings............#US.........#GUID...

C:\Program Files (x86)\letsvpn\app-3.8.0\System.Text.Encoding.CodePages.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	762488
Entropy (8bit):	7.475789213702804
Encrypted:	false
SSDEEP:	12288:BILs7xn7kZQ6kliVreJIHHr0tRYbKr2KtG9VKABC6rPqNy:WG9km6k/IwRYbiBeKGCzNy
MD5:	BB901EDE7C0AF7055375F8509E2D3D82
SHA1:	A7A42873C5598A259A6A12D9E56211CAF37655AF
SHA-256:	54BAAB90D73B9D144CD2D9EBF47916E50DFE10F1A3A4BD0B3D90C7E0E1E6C4DA
SHA-512:	6242623D882E43B5BC0D32622E2E7DC499F901DE141C7BAA16B74D1321E6237867E1C97AAE689FF8856B998E52B12B15765F973F2FC254D49065384C4483C6B1
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....mo..........." ..0..p..........n^... ........... ....................................`..................................^..O....................\|..x&...........]..T............................................ ............... ..H............text....o... ...p.................. ..`.rsrc................r..............@..@.reloc...............z..............@..B................M^......H.......H....$..........<...`....\........................................(....^.(.......5...%...}....:.(......}....:.(......}....:.(......}.....~.....0..........(....,....(.....o.......&.................!....0...........(.......(....-..,....(....,.r...p......%...%...(......(.....(....,.r...p......%...%...%...(.......(.....(....,!r...p......%...%...%...%...(........(......,&(....,..r...pr...p.(....( .....(!.....(....,.r...p......%...%...(.......("...*.(...

C:\Program Files (x86)\letsvpn\app-3.8.0\System.Text.Encoding.Extensions.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	14968
Entropy (8bit):	6.839216065258091
Encrypted:	false
SSDEEP:	192:cU+xx8u2SWCXW5UNynC5c77bgfU5izh/y2sE9jBF3A5K+o73DdsBvOqhUL:mb1nWCXWKNynsAw/98E9VF3AM+orD2pu
MD5:	ACA2C9C0A1C82D149EC9E5751F73AC73
SHA1:	D51273BF3C361A4050414CDE0CCF980D3ACADEF2
SHA-256:	9B1F8B7538607F3760A8C0C027418AE7DA6A17B2F8D4BBC736E6FF69D50D86AB
SHA-512:	FF9CB15F747DB9A803323AD6CD4440D586F88AEB37334C845745C0CFEEB01F21478FD0757302668CA727D6A97238C5D90ED76919C74C1D1676C262EF50BA42A5
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0..............)... ...@....... ....................................@..................................(..O....@..T...............x&...`.......'............................................... ............... ..H............text... .... ...................... ..`.rsrc...T....@......................@..@.reloc.......`......................@..B.................(......H.......P .......................'......................................BSJB............v4.0.30319......l.......#~.. ...t...#Strings............#US.........#GUID...........#Blob......................3......................................................\.....0.....6.....D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.!...C.<...K.\...S.

C:\Program Files (x86)\letsvpn\app-3.8.0\System.Text.Encoding.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	15480
Entropy (8bit):	6.7399650993965015
Encrypted:	false
SSDEEP:	192:c1S6cYxmPlW7TW58NynC5c77bgfU5izh/y2sE9jBF3A5K+og+TgTplAhw:GNyW7TWaNynsAw/98E9VF3AM+oRoF
MD5:	BC83C52170C66AD69AE38E175AAF1A6D
SHA1:	A276BD43071A916A4E3E24477301332F40488A50
SHA-256:	EF93A80072A7B96E810E55C672289EADD6388996CB14192C37748AD1CD5ABCDA
SHA-512:	4320964B01DB997B6650D9AEA5D93E9E9A328305BE14A5F6F63A0164778131A8D43689608C688BDB4712C9DD1D9DA0F839C3A00CCCD844F5904E77E931B1EFB8
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0.............2... ...@....... ....................................@..................................)..O....@..................x&...`.......(............................................... ............... ..H............text...8.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.......................H.......P ......................((......................................BSJB............v4.0.30319......l...0...#~..........#Strings............#US.........#GUID...........#Blob......................3......................................................\.....0...........D.7.....7.....7...C.7.....7.....7...[.7...x.7...-.0.....7.................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.1...K.Q...S.

C:\Program Files (x86)\letsvpn\app-3.8.0\System.Text.RegularExpressions.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	14968
Entropy (8bit):	6.875316375132124
Encrypted:	false
SSDEEP:	384:l6Rb32WVzWwNynsAw/98E9VF3AM+ogBBuQnCc:8Rb3djAw/KENAMxgXuLc
MD5:	D30721109BD21AC4117CE0FBDFF276C5
SHA1:	0BF4807A724A7FE1E915D71F08A40B3ADC2014A8
SHA-256:	87465BE8D73A437F217DFC7DFA5A1355D46F1A272C51FFE6CAE5846E1A1D3D26
SHA-512:	A73B6A87C46C346D66901302BE4B46E4EA1D6AE66D1DB93471E0E559F996D41E16FFAE84D7325A652F39894242005C97E0975B83EBDF9B7233C8D114C9AE4F7D
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0..............)... ...@....... ..............................[.....@.................................t)..O....@..P...............x&...`......<(............................................... ............... ..H............text........ ...................... ..`.rsrc...P....@......................@..@.reloc.......`......................@..B.................)......H.......P ..l....................'......................................BSJB............v4.0.30319......l.......#~..........#Strings....@.......#US.D.......#GUID...T.......#Blob......................3..................................................K...d.K...8.8...k.....L.................K.................c...........5.........................2.....2.....2...).2...1.2...9.2...A.2...I.2...Q.2...Y.2...a.2...i.2...q.2.......................#.....+.....3.....;. ...C.;...K.[...S.

C:\Program Files (x86)\letsvpn\app-3.8.0\System.Threading.AccessControl.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	30840
Entropy (8bit):	6.294097898423139
Encrypted:	false
SSDEEP:	384:UMTiavAbgFWyO5XIu+TJSl2Yd5zcNEkUr6ODA7WpOWNNynsAw/98E9VF3AM+oDB8:UMWavA+YHfsZta7Aw/KENAMxW
MD5:	BF911F2D6C3F4964038F5EFD3B862A79
SHA1:	8D0E66A52BC289DD2CFA582AAF374220FF0290BB
SHA-256:	098F5C71D8C361AF39ED5E2C9FB83E7E7900AA6A175484A44D6FA7E26C9F57F2
SHA-512:	2C04B314ED0D162258F3FC2CD2F98E1DC8F75893833CD7AB1F252A7E95E24CA7862BD9E4F8BDD4CDC123B33B98E02B5EAC1D95406BDF55D98AB655313F12B727
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0..D..........zb... ........... ..............................,D....`.................................%b..O.......l............R..x&..........(a..T............................................ ............... ..H............text....B... ...D.................. ..`.rsrc...l............F..............@..@.reloc...............P..............@..B................Yb......H........%..$-...........R.......`........................................(....^.(..........%...}....:.(......}....:.(......}....:.(......}.....~.....0..........(....,....(.....o.......&......................0...........(.......(....-..,....(....,.r...p......%...%...(......(.....(....,.r...p......%...%...%...(.......(.....(....,!r...p......%...%...%...%...(........(......,&(....,..r...pr...p.(....(......(......(....,.r...p......%...%...(.......( ....(...

C:\Program Files (x86)\letsvpn\app-3.8.0\System.Threading.Overlapped.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	31352
Entropy (8bit):	6.516868631846073
Encrypted:	false
SSDEEP:	768:Qu5I+sqOylryry8qqIfUc7a56Aw/KENAMxYG:QYIVBpry8qqIfUcm56AwrxR
MD5:	3E3E7E6208C706167B8D711D67B87416
SHA1:	8A530FF1F16A07CF3843D72F9486317A6D84FF2A
SHA-256:	7BDE4D16019DCB419B884724E68B264AEB868990B047652A15B6DF1C1977B41F
SHA-512:	5739BF68176C82DE9CCA40728FB59AA1886DD5679DDC0A872058D6819CF3CF6736E0B73C0A7E0709176C1EAC75444B5F1554EFF96C98F5C8E8B078BF3FFBD350
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z.........." ..0..F...........d... ........... ..............................\|.....@..................................c..O.......x............T..x&...........c............................................... ............... ..H............text....D... ...F.................. ..`.rsrc...x............H..............@..@.reloc...............R..............@..B.................c......H........&...7...........^.......b......................................j~....%-.&(....s....%..........0..$.........(.....o.......&...,....o....,.....................,!(....,..r...p.(....(......(......(....,.r...p......%...%...(......(.....(....,.r...p......%...%...%...(.......(.....(....,!r...p......%...%...%...%...(........(....2r...p.(....2rK..p.(....2ry..p.(....2r...p.(....2r...p.(....2rc..p.(..........(......0..;........\|....(......./......(....o....s

C:\Program Files (x86)\letsvpn\app-3.8.0\System.Threading.Tasks.Extensions.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	26744
Entropy (8bit):	6.480795961047466
Encrypted:	false
SSDEEP:	384:YR973o62/KqcAnb05J3w0I5eUGef8s72XBWdvVW2JW8ahNynsAw/98E9VF3AM+ob:YRZ4nNxnYTb6BlheAw/KENAMxp/We
MD5:	B7726F0CB4AA40EA7332276927B4D299
SHA1:	BD8129FF17A3D458D162D5AB62F599BD655940B9
SHA-256:	B16C34C7E4B2EFAFEEE54B84BBFF86F5C7787E5A80138EAE9E9E7B4690B268C1
SHA-512:	1967320A577019EC7FCDBA0EEFED5B409E2289A51549EE3C434F9AAF1A37188D70E48AEFC739C443511EAB6123847AD1B7BB46F7BBEE5CC01E1CB31DB7BA7C42
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....jM^.........." ..0..8...........V... ...`....... ....................................@..................................V..O....`...............B..x&..........PU............................................... ............... ..H............text....6... ...8.................. ..`.rsrc........`.......:..............@..@.reloc...............@..............@..B.................V......H........0...$...................T........................................(......(....z..(....z2.(....s....2.(....s....:........o.....~....~.-..(......}......}......}....~.-..(......}......}......}....Z..}......}......}....J.{....%-.&.o....^.u....,........(.....~.{.....{....3..{.....{.......&...(....2...(...........0..'........{......,..u....%-.&..(...+(....(....n.{....,..(....s.....q......0..a.........{....o0.....,;..{....o2...(......;...3.~.......s......

C:\Program Files (x86)\letsvpn\app-3.8.0\System.Threading.Tasks.Parallel.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	14968
Entropy (8bit):	6.839909294946254
Encrypted:	false
SSDEEP:	384:uvn4HREpWiQWeNynsAw/98E9VF3AM+oIGa:hS4Aw/KENAMxI
MD5:	88D9E8D1056642200422FFBAE0356A28
SHA1:	68B8227039842CA9FF6BD1AE2ECCDE72E938F840
SHA-256:	F257A879FDAE6C96387DF8C96B4222AE48FFFB47EC3E5884A9361A424B848500
SHA-512:	3799779E7ED33BE4DDCBC8C098B2C8657DDC47F2422F5BC4CCE3C875FC129D3346BAC14643B78CBD16E9624DC62C2D132C33CDFF16868AF6E6CB058AA744FBE3
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0..............)... ...@....... ...............................@....@..................................(..O....@..P...............x&...`......x'............................................... ............... ..H............text........ ...................... ..`.rsrc...P....@......................@..@.reloc.......`......................@..B.................(......H.......P .......................&......................................BSJB............v4.0.30319......l.......#~......l...#Strings....\|.......#US.........#GUID...........#Blob......................3......................................................n.....B.....".....V.................U...........$.....m...........?.....(...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.!...C.<...K.\...S.

C:\Program Files (x86)\letsvpn\app-3.8.0\System.Threading.Tasks.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	15992
Entropy (8bit):	6.734840906262781
Encrypted:	false
SSDEEP:	384:P8MjKb47T3UCcqFMkJ59WdtWHNynsAw/98E9VF3AM+oDdYh9k:EMjKb4vcGdOQAw/KENAMxak
MD5:	CACD91D69DA201A2BFAA34DB18E895D2
SHA1:	BD09AF45A9B83659E75C27554C89987B3E33B5FC
SHA-256:	4311D0B78E06C6ED70182BB21FCF34A1CEDD84E6DF36A90EC5C435D7913786E5
SHA-512:	AD45AC572122BC77B1C78067D3D7130D3050531C4044AF4766698117FA551D21C63DE7800227EB66BB0445E812237285EE8B6BE56FCB6729FF26BD6CF175CBBA
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0..............,... ...@....... ..............................:.....@.................................`,..O....@..................x&...`......(+............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................,......H.......P ..X....................*......................................BSJB............v4.0.30319......l...<...#~..........#Strings....4.......#US.8.......#GUID...H.......#Blob......................3................................!.....O.......................................].....z.............................7.......j...........n...........................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.3...K.S...S.

C:\Program Files (x86)\letsvpn\app-3.8.0\System.Threading.Thread.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	14968
Entropy (8bit):	6.828460218119519
Encrypted:	false
SSDEEP:	384:ZzyNXd4+BW6FWFNynsAw/98E9VF3AM+o0PkUp2Zq:kzCAw/KENAMxqx
MD5:	E715F4AEC7DB3FA4B0AED6BD8F3E8548
SHA1:	89B8AE11F3011A6A68EF2FCC2593979B83544F53
SHA-256:	39F2416DCBD4169355F3F7DE15958A1FD88336D5942CA6AF6F833CBF5644E874
SHA-512:	17035A0989C0FA84B302AC5CD9233C0D914EA0EF1F19DF8F14DF5121067838BD4E5AC70DD465B4DE62960D2312533EB2A731DE0EF328797B59C39A9671157DC3
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0..............)... ...@....... ....................................@..................................(..O....@..................x&...`.......'............................................... ............... ..H............text... .... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................(......H.......P .......................'......................................BSJB............v4.0.30319......l.......#~..,...p...#Strings............#US.........#GUID...........#Blob......................3..................................................'.....'...T.....G.....h.................g...........6.................Q.....:...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.4...K.T...S.

C:\Program Files (x86)\letsvpn\app-3.8.0\System.Threading.ThreadPool.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	14968
Entropy (8bit):	6.827078040196493
Encrypted:	false
SSDEEP:	384:gvs2Q3HKJNrWWRWhNynsAw/98E9VF3AM+ogHJFDn:guMOAw/KENAMxMjr
MD5:	5E13C886EF5015A62FA6C88BFC74F7AF
SHA1:	748C3998F37746E519CC8877E42971D2ADF9DE6C
SHA-256:	00252FEEACE0D97167252C5EE0A405A0E020832DE91AF83EA5704B66056AC7AE
SHA-512:	80E152DF5CE2CE16FA6E76222277CA8435859F30F0C2178171247A02C50BA72FC6EC6D8B6C508B2291A1E654F53827F8AC7EE15F63DB9EA58D3A773F54219E60
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0..............(... ...@....... ..............................7.....@..................................(..O....@..4...............x&...`......h'............................................... ............... ..H............text........ ...................... ..`.rsrc...4....@......................@..@.reloc.......`......................@..B.................(......H.......P .......................&......................................BSJB............v4.0.30319......l.......#~......`...#Strings....p.......#US.t.......#GUID...........#Blob......................3................................................../...q./...E.....O.....Y.................X...........'.....p...........B.....+...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.8...K.X...S.

C:\Program Files (x86)\letsvpn\app-3.8.0\System.Threading.Timer.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	14968
Entropy (8bit):	6.794466392459815
Encrypted:	false
SSDEEP:	384:vFz0Q6gcqRhcsMWdMW2NynsAw/98E9VF3AM+oQRp+g:vFz1c6QAw/KENAMxpg
MD5:	EFF0022270440772085CC273E079B3FD
SHA1:	12BE81EB6D56751D561F0336BBC5D5BE1037C51A
SHA-256:	7C07400155A112C2E9E9E298568AF13FF584F7DA0B0AFC8CB830F3E55C5FAA07
SHA-512:	7D31DC661810870A19694A38DBE81861569010DC451E774EDEE8D0CC4D4F973F78E8D35BE05F49CF31C48BBA01C54318229CE43F6799A9C469023063128E5F41
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0..............(... ...@....... ..............................i.....@.................................L(..O....@..................x&...`.......'............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................(......H.......P ..D....................&......................................BSJB............v4.0.30319......l.......#~......,...#Strings.... .......#US.$.......#GUID...4.......#Blob......................3......................................................\.....0...........D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.3...K.S...S.

C:\Program Files (x86)\letsvpn\app-3.8.0\System.Threading.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	15992
Entropy (8bit):	6.683301652018474
Encrypted:	false
SSDEEP:	384:I6xWA3W4aW/NWJNynsAw/98E9VF3AM+olHSDWiq8:IaBeAw/KENAMxZSD68
MD5:	D1E803EED362D2F8C50C6751455A6F88
SHA1:	0A05E893C230D1059BBDC78DF47E2AA3C958253B
SHA-256:	51B83B026A5FFC6AF74B987F84F43853C5ECAAE4099749A3B9E849FE31F8D662
SHA-512:	9492012607DE11F5467CB5F6DD011C0BC7F2E6CA15E84AB7FFB9FA3363AB4CF0AAFF0638C64056213CE0759E85BD8678BB2329B3DA7579004BE1D3F960143419
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0..............,... ...@....... ..............................w.....@..................................+..O....@..................x&...`...................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................+......H.......P .............................................................BSJB............v4.0.30319......l... ...#~..........#Strings............#US.........#GUID...........#Blob......................3......................................-.........O.k.....k.....X.....................1...........o.........................B...........9...........J.....J.....J...).J...1.J...9.J...A.J...I.J...Q.J...Y.J...a.J...i.J...q.J.......................#.....+.....3.....;.....C.-...K.M...S.

C:\Program Files (x86)\letsvpn\app-3.8.0\System.ValueTuple.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	72824
Entropy (8bit):	5.902251494742909
Encrypted:	false
SSDEEP:	1536:qIumja0tbe16pSc45EfL+4vD4SuJbhjXuE3FMqF1KAy4kHo05ureseh79uAwrx5:qIuAaGbeGq5rKASI0IChuhP
MD5:	669A0CCAEE2E11AF2947049D89608E23
SHA1:	780D076FA53E39E5378A3DDE53C84735D274D806
SHA-256:	EAA13B2AD1E33DEEB4E2BF4B64DD5B8DDB5672778C237379B4F7BBCAB01F5D4B
SHA-512:	20A1D0CA59017366FBE969D08AA5CBF05ACCA03DD3B21A74A9F57101BF868648DAD9FD8ABFB44DA7ED43681D0CF8586CDD8D5513D4C0041AF662AAFB627CA02D
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z.........." ..0.............~.... ... ....... .......................`......".....@.................................,...O.... ..x...............x&...@....................................................... ............... ..H............text........ ...................... ..`.rsrc...x.... ......................@..@.reloc.......@......................@..B................`.......H.......................d.......t.......................................6..o.........f..o...........o............o...........o...........o............o...........o...........o ...........o!...........o"..........o#..........o$...........o%...........o&............0..L.........o'..........o(..........o)...........o...........o+...........o,.........0..Y.........o-..........o...........o/...........o0...........o1...........o2...........o3.... .......0..k.........o4....

C:\Program Files (x86)\letsvpn\app-3.8.0\System.Web.Services.Description.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	17016
Entropy (8bit):	6.669402287046882
Encrypted:	false
SSDEEP:	384:dvx21MWeLqWMNynsAw/98E9VF3AM+o/TWRKY1:dJ2WMAw/KENAMxod
MD5:	3CEE4E9DAAB3AF19135141413A77392F
SHA1:	7CFF4468C50447ABD770F9E109EC8BB943B6F8F3
SHA-256:	CE2D0EC0CBA21A9D70A92B5501EDD8EE5F9E8884E5126C1FA37086C8C5C13596
SHA-512:	E5519D12FAF03B5FFB003243831EFC5DDAFACEDB08DDC12B8A4870B14893CE249ED54066CBC2A3F90C2B5107211493D9665D012D3A939FACCD848B5F037F830E
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...s.~..........." ..0.............:1... ...@....... ..............................5.....`..................................0..O....@..................x&...`......./..T............................................ ............... ..H............text...@.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................1......H.......P .. ...................p/......................................BSJB............v4.0.30319......l...h...#~..........#Strings............#US.........#GUID.......4...#Blob......................3................................F...............4.c.....c...o.<...............U...........m.......................T.............2.................6.....6.....6...).6...1.6...9.6...A.6...I.6...Q.6...Y.6...a.6...i.6...q.6.......................#.....+.*...+.F...+.\...3.r...;.....C.

C:\Program Files (x86)\letsvpn\app-3.8.0\System.Windows.Interactivity.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	49784
Entropy (8bit):	6.18565599671033
Encrypted:	false
SSDEEP:	1536:T3wBccZdxuB8mQen6JxKjrlMZgR0EofAwrxNz:jcHmQPUkfhX
MD5:	D2D5D9991439348507448C6C510B3716
SHA1:	7908019130EBE174E0BE3D17E59FDCDFE9B3343A
SHA-256:	21FE049C42937B7515ACB3175301FD4DFAF29FA4A55718B7FD337CFAC36271DD
SHA-512:	079F5AA388D9532373F6DA9FADF20268112718FB7D3594C4AB04B526B8FB8B8C01E7D7529CD21A17D36CF360344A720C0EB6382B715A854F9BC7331638BAAA3E
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...du.K...........!..................... ........ ;. ...................................@.................................\...O.......................x&........................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......4O..X`..........xD......P ......................................{c...2......q..Z,.C.....3.n.Z..7....R.....T.{yF")i.$JMv...,a.....U...M:,...Z.Q:..c..N.{....<....h%.....:s..T...Z.gSI.....6.(.....{.......0..&........(..............s....o.....s....}.......0..K........(.....{....o........,3..+&..( .........{.....o!..............X...(....2...0..L........{.....o"...,=(#...(..................($...o%.......(&...o%.....('...s(...z*.0...........o).......E............d

C:\Program Files (x86)\letsvpn\app-3.8.0\System.Xml.ReaderWriter.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	15480
Entropy (8bit):	6.816511093930926
Encrypted:	false
SSDEEP:	384:Fr97WquWHNynsAw/98E9VF3AM+obsFsg+:FRJdAw/KENAMxAX+
MD5:	A77D9D94BE29BC0D8139B17BEC55804C
SHA1:	ED2B58347EFBC9F167ADD207F5A5433D70E99518
SHA-256:	FBE75B7F2F9CB66B9CB72AEC2CDD6797B5B7B7958C45DE45BD1CCE9F738E5E5A
SHA-512:	C53356CF56104DC658DE69A2001FADBF18D1F6313642E3DAE1C0397A6AFAB413F57AE8EE5D686916F6F9CCEB41BEB591C3FEEBCCA0AB63ED8A62170CD6BEF8B8
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0..............+... ...@....... ...............................(....@.................................\+..O....@..................x&...`......$*............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................+......H.......P ..T....................)......................................BSJB............v4.0.30319......l.......#~..T.......#Strings....0.......#US.4.......#GUID...D.......#Blob......................3......................................z...........j.....j.....W...............B.....z.............................................................Q.....Q.....Q...).Q...1.Q...9.Q...A.Q...I.Q...Q.Q...Y.Q...a.Q...i.Q...q.Q.......................#.....+.....3.....;.....C.4...K.T...S.

C:\Program Files (x86)\letsvpn\app-3.8.0\System.Xml.XDocument.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	15480
Entropy (8bit):	6.756025815416238
Encrypted:	false
SSDEEP:	192:cih2uxSleWLDW5aNynC5c77bgfU5izh/y2sE9jBF3A5K+o2pt5b4h+:/16eWLDWgNynsAw/98E9VF3AM+o2JEh+
MD5:	7EA3C75125F2A445BEA2E02BFEDE965F
SHA1:	52504BC98C48A376BA216A3A24C16B705F981842
SHA-256:	2B59DFFF2CEC94C4D1B3E05847F767FDE778C3DFBB7AEEFD08E116C8DE19BAED
SHA-512:	D85F5D4B6B45B38813E6610493CD827F2E316A5A373B318982C91D1A5B73BEBC219B3F2DDBE4D42985B6C12B012394FCD8F8F88C735C923F82868BDC427E88D5
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0................. ...@....... ....................................@.................................\|..O....@..................x&...`......D)............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................*......H.......P ..t....................(......................................BSJB............v4.0.30319......l.......#~......8...#Strings....T.......#US.X.......#GUID...h.......#Blob......................3..................................................z.....z...u.g.................................>.....W.................r.....[...................a.....a.....a...).a...1.a...9.a...A.a...I.a...Q.a...Y.a...a.a...i.a...q.a.......................#.....+.....3.....;.....C.1...K.Q...S.

C:\Program Files (x86)\letsvpn\app-3.8.0\System.Xml.XPath.XDocument.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16504
Entropy (8bit):	6.752253773448567
Encrypted:	false
SSDEEP:	384:q8G4YC2W+wW8WpwWMNynsAw/98E9VF3AM+oQ4foQ1x:lGZ5mAw/KENAMxNx
MD5:	3D8BE4C8163A6E3BBC227ED526E54E81
SHA1:	553C4C2A723AD214F0ABD0632F34E8C858F3B7BE
SHA-256:	871B7271B514858DE7AD6C38DCC8F029B5FDE4E07CA1F64B8700E5BCB4FD8476
SHA-512:	7431D5E23BC5BFDE3EFD81967EBC8B0B5C81036F639C4E6260C7F21999CD79C9391E599DD01BA63DFBA34777E411FFF35E632669D0ADA9C9B3AF77163160C831
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z.........." ..0..............+... ...@....... ....................................@.................................z+..O....@..x...............x&...`...................................................... ............... ..H............text........ ...................... ..`.rsrc...x....@......................@..@.reloc.......`......................@..B.................+......H.......t ......................P........................................s....:.(......}....2.{....(....*BSJB............v4.0.30319......l.......#~..0.......#Strings............#US.........#GUID...........#Blob...........WW.........3..............................................................L.........4.H...}.H...u.v...........;...........;...=.;.................../.%...........P.....m.....................................v...S.......v...d.v...........v...m...............

C:\Program Files (x86)\letsvpn\app-3.8.0\System.Xml.XPath.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	14968
Entropy (8bit):	6.862211937541136
Encrypted:	false
SSDEEP:	384:f6ziqTEkGWvRWwNynsAw/98E9VF3AM+oxLMf7:fYT1RAw/KENAMxy
MD5:	C6F0C092B5A0CE91821D829F64798594
SHA1:	3393EF783595AAC06EDE7CD3F7D2E02DEAAFF6BE
SHA-256:	C88F7C7BCBB738BCFB50D16DAD68420C17A6883A9A6868A51A9E5D188D08EC32
SHA-512:	28932F38495E5DA0134664A14C4F855234FA81273A80A5493ECC262920F5B1BF5E3BDA14EF41AE9103390E1EFA84D30645389D122E22CF4CF944488F276D7953
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0..............)... ...@....... ....................................@..................................)..O....@..................x&...`......d(............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................)......H.......P .......................'......................................BSJB............v4.0.30319......l...0...#~..........#Strings....x.......#US.\|.......#GUID...........#Blob......................3................................................'...........~...................................G.....`.................{.....d...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.-...K.M...S.

C:\Program Files (x86)\letsvpn\app-3.8.0\System.Xml.XmlDocument.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	15480
Entropy (8bit):	6.775174798887032
Encrypted:	false
SSDEEP:	384:/Uv7c7iWNCWSNynsAw/98E9VF3AM+oSje6DskE7T:/M7c1SAw/KENAMx2e6gkm
MD5:	64797CD4D9CED3F18B68DCC1BD6CDB05
SHA1:	85B9ADF63B4BF56E6B89A6417C0E93BEE3099CE2
SHA-256:	C5FD0EB8248CE50649DE9A2E9154D4AF86B60C8854DF8FC1804B3BBFD203F44D
SHA-512:	F0D7C2CB7ACED5132B025AE07D0DE587C1DF5E77290D9520983308B8A71AC984DE1CA267CFCD9633164CDB548898A537BC0AC342BF06A6677C9BAA3700B7BA9D
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...C..Y.........." ..0................. ...@....... ....................................@....................................O....@..................x&...`......`)............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................*......H.......P .......................(......................................BSJB............v4.0.30319......l.......#~......l...#Strings....l.......#US.p.......#GUID...........#Blob......................3................................................4...........~.............H.....H.....H.....H...T.H...m.H.....H.....H.........d.H.................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.3...K.S...S.

C:\Program Files (x86)\letsvpn\app-3.8.0\System.Xml.XmlSerializer.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	15480
Entropy (8bit):	6.820960924216119
Encrypted:	false
SSDEEP:	192:c+vxmNWnRW56NynC5c77bgfU5izh/y2sE9jBF3A5K+orlMABfGf:hSWnRWMNynsAw/98E9VF3AM+orlbtGf
MD5:	B84DAC6E57104B5F6D2A04EC32E7B1C9
SHA1:	3E05D60BD3D5829FC49F64FFCDCE0FB001DA2A5E
SHA-256:	7B3095CFE1F5908C83B8E6AA4CACD760396F685D5F15F3AB6B12CCA38C8D9253
SHA-512:	90BB6588430B1C477A79FAE8AFBC4BBDFD7127CF439132DB4D9172F7B546D1557FFB2E41AA1FE8E74640FEEA98179CA50042EA99BFAC26A45983002F7F155148
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...C..Y.........." ..0..............+... ...@....... ....................................@.................................L+..O....@..$...............x&...`.......*............................................... ............... ..H............text........ ...................... ..`.rsrc...$....@......................@..@.reloc.......`......................@..B.................+......H.......P ..D....................)......................................BSJB............v4.0.30319......l.......#~..........#Strings.... .......#US.$.......#GUID...4.......#Blob......................3..................................................k.....k...U.@.........i.....=.........................................&.....'...................:.....:.....:...).:...1.:...9.:...A.:...I.:...Q.:...Y.:...a.:...i.:...q.:.......................#.....+.....3.....;.....C.5...K.U...S.

C:\Program Files (x86)\letsvpn\app-3.8.0\ToastNotifications.Messages.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	99960
Entropy (8bit):	4.653546637122732
Encrypted:	false
SSDEEP:	768:vHmt9tmMLbLR6330XUb9GYQ+Aw/KENAMxgmY:v+d6336UbIL+AwrxgZ
MD5:	67DA6B3D42812E850132C4861D1D60DF
SHA1:	4BD0D5180D4A9B181E8498729F3019D569033015
SHA-256:	4224010B896E95D7437E2866664E13CA2B01536B1CBD2974D38A3443F0EAC756
SHA-512:	FF4F6087BAB96137EDF02C8E170BEB70ABDE4D54DADE7FB4FCD986464F9FCAA068C9075762C85CE8D22B98A002C09F0E27DDA09E5AEFA766D7526A0811C8B80A
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....\.........." ..0................. ........... ...................................@.....................................O...................`..x&........................................................... ............... ..H............text...0.... ...................... ..`.rsrc..............................@..@.reloc...............^..............@..B........................H........(..."...........J..p... ........................................0.. .......s7......}........8...s....o...+.0..'.......s9......}......}........:...s....o...+..0.. .......s;......} .......<...s....o...+.0..'.......s=......}!.....}".......>...s....o...+..0.. .......s?......}#.......@...s....o...+.0..'.......sA......}$.....}%.......B...s....o...+..0.. .......sC......}&.......D...s....o...+.0..'.......sE......}'.....}(.......F...s....o...+R.(.....(......(...+2.(.

C:\Program Files (x86)\letsvpn\app-3.8.0\ToastNotifications.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	119416
Entropy (8bit):	5.02231958506658
Encrypted:	false
SSDEEP:	768:or7hqeNzclb+af/wFGfdpOOJWOQE9/TBLW/Uwm5Aw/KENAMx5X:or7hqeNzclR/CWpKsRBLW/E5Awrx5X
MD5:	B26C465D82F129F105F34C74D89E68EE
SHA1:	D04A03B233764E72BC1E677B60DA9C06573FB99C
SHA-256:	63FF28E55976BC9C9086A301B821BF6C55BFCBFCEA54C9B79A9C9AFD43A3E513
SHA-512:	CC1427F30BDFD26ED564C64D3917022426FE3F91560FC168BAB9DE24A13561761026CC836F46917B14E5061F379F1C4442A9CB9CD661AE852C04A0426B42F48F
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....\.........." ..0..$...........C... ...`....... ....................... ......].....@..................................C..O....`..................x&..........hB............................................... ............... ..H............text....#... ...$.................. ..`.rsrc........`.......&..............@..@.reloc..............................@..B.................C......H........N...n..................A......................................f.s....}.....(......}....v.(.....{.....o.........o.....0...........{..........(.....{....,..k.(......o....%-.&s.......}......o....}.....{.....o....o......o.....o.....o.....o.....s....}.......,..(..............s\|.......0..T.......s....%(....o....o......{.....o.....o....-.r...pr'..ps....z.o....-.re..pr'..ps....z.J.{....%-.&.o......{....*..0..M........{....-D..}.....{....%-.&+.(....%-.&+.o.....{....%-.

C:\Program Files (x86)\letsvpn\app-3.8.0\Utils.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	129656
Entropy (8bit):	5.92302925275891
Encrypted:	false
SSDEEP:	3072:9TWN+0f87fNkJfMrtab/nVeb9YjCW1NtLGi/yO+i1/Xg6iyhUku70qhI8:96l8l8VUx1hV
MD5:	D615A49B867921D097B87F5653D06DA8
SHA1:	9475F5BD2517A71D68388F04A247725814BB0A39
SHA-256:	CA0A071AFFF810CAE52CCE1DEF9456D4DDB8CA1A165A4B0AAE16951A6F337542
SHA-512:	1986D66A9638D0CC998EE0534FE9443A41F8988ACA226770934C5A9B7157931EC8C456FF0034EC63EF32DA842D6BAE31D97003AB5D65F3A7E51C2773DC758CBE
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...1............." ..0.................. ........... .......................@....... ....`.....................................O.......P...............x&... ..........8............................................ ............... ..H............text........ ...................... ..`.rsrc...P...........................@..@.reloc....... ......................@..B........................H.......D....9...........................................................0..........s......(9....j........(:...&...(.......0o.........+,.....o ...o!...o"...&...2..r...po"...&...Y...../..0...r...p(#.....(1....r5..po"...&...o$...o"...&...o$.............ag.0.....0..j.......~%....rQ..prY..ps&...%.o'...%.o(...%.o)...(.....o+...o,.......,..o-........r_..p(#....(1...r...p.s....z.*........0..>..........DJ.......0..........s/....(......l...%....%....o0......+r.....(1...-b...l...%..

C:\Program Files (x86)\letsvpn\app-3.8.0\View\Assets\notification_icon.png

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PNG image data, 256 x 256, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	12243
Entropy (8bit):	7.820583648387655
Encrypted:	false
SSDEEP:	192:WLj1H8FzmdclL4jx3c4yrJuhRof6YQURyMGf0gDSvGrEHsf8Aw47b:QpiYccZrZRof6YQUPPgDSvGr+q8D47b
MD5:	AA3CFA4A176584F79EEE7F74032E446F
SHA1:	752B97FF9A8D28E92F6FB35EE24FF3DA2E8DEEE5
SHA-256:	34A9425F58EDB250E7FBD9217D73A5AD96D1986ACA3520AFE8CADB66E32E3F33
SHA-512:	A824DA84DEDAFCDCEACDF9D602B5F89526168E6350E7478D31A5562A8B12D496FB5205B62EDFB2DF1C3896D6B24DA761A1211CF342C1AFF8E6235C4569A54BFF
Malicious:	false
Preview:	.PNG........IHDR.............k.XT....PLTE....g.H.\...O..E..E.jj..D..E.Q..rb.S...D.tc..H.H.P..ni.T..S...H.Q...F.N..L.N...E.....D.M..Y..yS.uW.O..S..ig.q[..D..H....}P.lc..D.T..bv.en.gk.n_.Q..]...L..D.D.D.D.[...N..D.F.[..cr..D.V...E.D.D.Y...D..D.P.._}..L..D..C..D..D.D.W...D.G.I..D.`z..D..D..E.D.m...D..D..C..G.o...C..N..O.w{.t...[.j..]...R.q..c...U..Q..N..i..Y..`..S..N.zw..n..N.g...N..N.\|r..N.N.....V..N..N....^..a..d...N.g......N.N.O..N.M.O.O.d..O.......U...N....z?.LN.n>....O..w..kb...eP.`2.`D.sq.........7.....W.w^.T=...sJ....f..xj....bk..$.....&.[[..&....g$.....u...m.....B......Vj..8.I....'.mx......1.k..Oy.........j.... .:..Fb..1....\.....@u.. .....H.L...f.-.........I.t".......g..1....G...(.E..........8..w...y....9..I.....i..............k......}...b..E.....tRNS..-.L...O...QQ..........'^..,iIDATx...MH.A.....].U3.Xw....B.2..K...A..i.%F...BWA..3.K..H...u.P...C..I..K..<...w....C_........>.../...+*+..v.@m..N.X.XG.qt.i.k+...(jXQ

C:\Program Files (x86)\letsvpn\app-3.8.0\WebSocket4Net.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	71800
Entropy (8bit):	6.211185765471526
Encrypted:	false
SSDEEP:	1536:5XSaVnItYw1N0tUUTAz/kI5JIol/NkIgJ4WFAwrxPC:55VnqzNaNE4IvIolSIgJjFhxC
MD5:	21E7454780CD73E68E63509FBCD20453
SHA1:	DDC407E891B46E0479C55F5236A75D0C6F3D662F
SHA-256:	4186DE61EA6F2E32B65D115D270368B3743115E7482DD2DCB39C1C65FA3FAD91
SHA-512:	F33A4DA347A3EAA4CA939B81D9A7877355AB37D4FF06386F979804D127A25561FBD77EB740FD2CCD0ABF5656DC1383F3A067D0A6CD65268FC48F8960D93BD223
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...FqZ.........." ..0.............V.... ... ....... .......................`......H`....`.....................................O.... ..4...............x&...@....................................................... ............... ..H............text...\.... ...................... ..`.rsrc...4.... ......................@..@.reloc.......@......................@..B................6.......H.......4k...............................................................{...."..}......{...."..}....V.(......(......(....:.(......(......{...."..}....Z...o....&.~....o....&Z...o....&.~....o....&V..o....&.~....o....&6.~....o....&...0...........~....Q..~......s.....8.....P(....,...Q8.....r...po....,..(....-&....o....-.......o....( ...o!...8......:o"........?........o#.......(....-...o..........Xo$.......(....-"..r...po....,...o%....1....o$.......(....-1.....o....

C:\Program Files (x86)\letsvpn\app-3.8.0\WindowsInput.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	32376
Entropy (8bit):	6.329946131967409
Encrypted:	false
SSDEEP:	384:70c3XP4cGqWpMgtZvtxsoOaY2ZXnFq+3xfJBRGCV3NynsAw/98E9VF3AM+ojRj8p:QsQtqwMkbvnFqqPgqdAw/KENAMxV+
MD5:	BCB37552900B6DDEFE7A011CB8732C57
SHA1:	8FFAA5E9950F9F3308CCBC0E65CE175173BF0F55
SHA-256:	7D1150386472EA5130022463526E76CCD1569C24F4CA5743E10296EDC09E1732
SHA-512:	1DCF0BEAE66C9C181F4F247634A33922CB0BB6275DF6286851B09A113475497A764A356485ED49B6470984E48A913333692A535E519D0AF4E2CBC3E530B5E98E
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......R...........!.....N..........>m... ........... ....................................@..................................l..W....................X..x&...........k............................................... ............... ..H............text...DM... ...N.................. ..`.rsrc................P..............@..@.reloc...............V..............@..B................ m......H......../...;..................P ......................................`.R...~d.5.......eQ..........EG2..D9.p....WPu.s.\|nn....1.....F..V7..W.(....od,...........!8....W..ez..e..Q.....h..:`...Qgr.(......}......}......}......(......sf...}......s....}.....s~...}......{......{......{......(.....-.r...ps....z..}.....s....}.....0..c........(.....-.r...ps....z.-=r...p.....(....o.........(....o.........(....o....(....s....z..}......}....2.{....o....6.{.....o=...*...0..

C:\Program Files (x86)\letsvpn\app-3.8.0\WpfAnimatedGif.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	52344
Entropy (8bit):	6.294149776481087
Encrypted:	false
SSDEEP:	768:ZDcl7W1UiZTo1ooEqzW3SQwiNsI8l5wwyvUPrYZBkcD4Aw/KENAMxbo:58QpZTsooEX3SQwr9y4UZRD4Awrxk
MD5:	FEF132A6F0E3D417CDDA7BA7F81527F7
SHA1:	C237AD7951465E058B7C934643A4B659C4AA6CBE
SHA-256:	70CED11B798270D1E8341C8BDE60DC581ECC196DB4CB0C0E88AC71BE7DB2160F
SHA-512:	5ECF4907AE083809FC005A4E590ECE8650B85D3AF058A18BB4361C8AD82EED180EE9DD6D345C7BB30D56E10831C3E071232CAB6A7C1517C98BA6A3003C9C55DA
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....5............" ..0.................. ........... ....................................@.................................J...O.......$...............x&..........h...T............................................ ............... ..H............text........ ...................... ..`.rsrc...$...........................@..@.reloc..............................@..B................~.......H........H..Hq...........................................................{......{....V.(......}......}.......0..;........u......,/(.....{.....{....o....,.(.....{.....{....o...... ...' )UU.Z(.....{....o....X )UU.Z(.....{....o....X.0...........r...p......%..{.....................-.q.............-.&.+.......o ....%..{.....................-.q.............-.&.+.......o ....(!....0..2..........(....~.......o"...-.~.....s#...%.o$.....o%...&...0..A..........(....~.......o"..

C:\Program Files (x86)\letsvpn\app-3.8.0\arm64\WebView2Loader.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32+ executable (DLL) (console) Aarch64, for MS Windows
Category:	dropped
Size (bytes):	125048
Entropy (8bit):	6.060261371449476
Encrypted:	false
SSDEEP:	1536:hDdMkQCUK86ryzDWs0MxThVvTe6sWkddGDGEtg3q2LOOCN+4Awrx7r:hDdef+yR17exwDGEtg3q2LOdN+4h5
MD5:	9E44F6749E52FADC48682EA7C7488D30
SHA1:	42F40A29288DE570F1F15A801670D9E6CD57B481
SHA-256:	4C53A1ED9F1B61503E4858E640566EB6667FB4F1F4884CEE587DE48A0ADFC6D9
SHA-512:	63BC017E0262060003067FC41F89A90EEF9623340D12C21898571F6ADBE7D0EA602EC23DFF278518746164DA9CCCB7F5E70E4851F45613E20E363D8D20A3C9A7
Malicious:	true
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......`.........." ................ C....................................... .......\....`A........................................_.......Q...(...............(.......x&......\|..........................@...(... !..0...................P........................text............................... ..`.rdata...... ......................@..@.data...\|...........................@....pdata..(...........................@..@.00cfg..............................@..@.tls................................@....rsrc...............................@..@.reloc..\|...........................@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\letsvpn\app-3.8.0\cs\System.Web.Services.Description.resources.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	19064
Entropy (8bit):	6.644905013531334
Encrypted:	false
SSDEEP:	384:6EZLkwA5qKV3XWe6lWUNynsAw/98E9VF3AM+o/NjOF:/xkwAlaJAw/KENAMx1yF
MD5:	55458A15553E015960CEDB807F4965BD
SHA1:	07EE2AEA05407D4BEC694711C575213DD39BC7FB
SHA-256:	037AC32E7F12D3FF515724274379A8C9D6744E9D51F8DBD5AF8147A96A56E7CA
SHA-512:	9786D2244EE9134FB77B5EFCAA225958B6A961842A73DB1C421D7CCAC881BADF3FA763756001CE89AFD78432B92112772AA90677A72758A53C8224E692023B44
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0..............8... ...@....... ..............................V.....@.................................D8..O....@...............$..x&...`......(8............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B................x8......H.......P ...............%.......7......................................BSJB............v4.0.30319......l...D...#~..........#Strings............#US.........#GUID...........#Blob......................3......................................,.......................r...........Z.....Z.....Z...A.Z...^.Z.....Z...*.Z.................l.....l.....l...).l...1.l...9.l...A.l...I.l...Q.l...Y.l.......................#.....+.....3.@...;.e...C.y...K.....S.@...................................

C:\Program Files (x86)\letsvpn\app-3.8.0\de\System.Web.Services.Description.resources.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	19064
Entropy (8bit):	6.638641088442008
Encrypted:	false
SSDEEP:	384:mqmGsHW08We6lW3NynsAw/98E9VF3AM+ooc6Do:mBGsH1xsAw/KENAMxLeo
MD5:	1152B68BD5ACA19771679D64C686138A
SHA1:	19D6B897804A95DDB956D53DD80900D75DDD62EE
SHA-256:	2737A588C6A03F52FD0D3F5545E25953D1C4BC7B4554DBEF3A32F534C179355E
SHA-512:	B6800F4EBA86339B20800B15BDA99F4F516CDE0154068FB4CCCD423EBB05AF887B8A87C8203D304430ECD3489B6519B3D738E4254281EAC766D2856C8575F8D9
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...G),..........." ..0..............9... ...@....... ....................................@..................................9..O....@...............$..x&...`.......9............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................9......H.......P ...............%..8....9......................................BSJB............v4.0.30319......l...D...#~...... ...#Strings............#US.........#GUID...........#Blob......................3....................................../.......................u...........].....].....]...D.]...a.].....]...-.].................o.....o.....o...).o...1.o...9.o...A.o...I.o...Q.o...Y.o.......................#.....+.....3.@...;.e...C.y...K.....S.@...................................

C:\Program Files (x86)\letsvpn\app-3.8.0\es\System.Web.Services.Description.resources.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	19064
Entropy (8bit):	6.603496302397367
Encrypted:	false
SSDEEP:	384:111LpDt4We6lWCNynsAw/98E9VF3AM+oHoq4D:/BdLAw/KENAMxQD
MD5:	61B5205FC92AC1A373FE891E069EC50C
SHA1:	DA34A3632AA920FB28B77FA1C256BC42109D41C4
SHA-256:	8441E69ED803EA006D7E43657B572431832286A8791AADC5A0F9F4E953900CDA
SHA-512:	9AA009AC5D2C32765751771B3F65EB3E8B1F03C6801161FC3E08FD89C2B42FBAB0EEF3A96185D9C22AA51F6A3F3EA977225D3643D38199E16C5A787E0D3F4089
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...k2............" ..0.............69... ...@....... ...............................x....@..................................8..O....@...............$..x&...`.......8............................................... ............... ..H............text...<.... ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................9......H.......P ...............%..x...H8......................................BSJB............v4.0.30319......l...D...#~..........#Strings............#US.........#GUID...........#Blob......................3......................................,.......................r...........Z.....Z.....Z...A.Z...^.Z.....Z...*.Z.................l.....l.....l...).l...1.l...9.l...A.l...I.l...Q.l...Y.l.......................#.....+.....3.@...;.e...C.y...K.....S.@...................................

C:\Program Files (x86)\letsvpn\app-3.8.0\fr\System.Web.Services.Description.resources.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	19064
Entropy (8bit):	6.64731118339437
Encrypted:	false
SSDEEP:	384:wsxhehdMDxbFWe6lWkNynsAw/98E9VF3AM+oM2yVH9:hvy+DANAw/KENAMx8l9
MD5:	F7C01E7B18B7AC7049D2462AA0719A28
SHA1:	D8D8DDCFD5043096912A7D8E7061079AEFC38B44
SHA-256:	B050B5A3E33E4B1FC8D4CB1DB74CA8ECAE016BF7F5D57EC730F1FB9E837AFA29
SHA-512:	A0AF1D7628E530F2841FEF926D875F6D5A3D1C305ED4773DC04197419D4474D8B408B1E63478C303C37F7BF0FD26F94C82D7927F19562DEDF1ABBAEA9411BB89
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....,E..........." ..0..............9... ...@....... ...............................l....@.................................`9..O....@...............$..x&...`......D9............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................9......H.......P ...............%.......8......................................BSJB............v4.0.30319......l...D...#~...... ...#Strings............#US.........#GUID...........#Blob......................3......................................,.......................u...........Z.....Z.....Z...A.Z...^.Z.....Z...*.Z.................o.....o.....o...).o...1.o...9.o...A.o...I.o...Q.o...Y.o.......................#.....+.....3.@...;.e...C.y...K.....S.@.....................l.............

C:\Program Files (x86)\letsvpn\app-3.8.0\it\System.Web.Services.Description.resources.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	19064
Entropy (8bit):	6.60872590751892
Encrypted:	false
SSDEEP:	384:89WLKzFWe6lWzNynsAw/98E9VF3AM+oWKdl6:kgKz+8Aw/KENAMxrd8
MD5:	8A8A507DFD7134650FCC20792FBEE644
SHA1:	0AE6035C76A4485F63D0D3AA1213EEFD524F03D4
SHA-256:	6CAC9EDE22E0EC38CA98B8A1F74E092C6EAF424ABB699E19335CAAF0B76F2521
SHA-512:	3B01DBDEC38D1DAA0DD2BBC345E3D84538D8FDC26E75A3FF13C2AE843280EB73C5E71B39282EDB6B65D08751B1C9765F58294FACFDA03CCFCCF8D8AF6D6C7861
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...(............." ..0..............9... ...@....... ....................................@.................................09..O....@...............$..x&...`.......9............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B................d9......H.......P ...............%.......8......................................BSJB............v4.0.30319......l...D...#~...... ...#Strings............#US.........#GUID...........#Blob......................3......................................,.......................r...........Z.....Z.....Z...A.Z...^.Z.....Z...*.Z.................l.....l.....l...).l...1.l...9.l...A.l...I.l...Q.l...Y.l.......................#.....+.....3.@...;.e...C.y...K.....S.@...................................

C:\Program Files (x86)\letsvpn\app-3.8.0\ja\System.Web.Services.Description.resources.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20088
Entropy (8bit):	6.7817693763826306
Encrypted:	false
SSDEEP:	384:yNeZmFLRnyGO00Ik4oF3eUntWe6lWsNynsAw/98E9VF3AM+ocKyWiLW:yQZmFLRnyGO00Ik4oF3eUnGhAw/KENAK
MD5:	3EBC6B6410BB9B09FB710B42B1C965D4
SHA1:	2E3F3F61D8314913F4B6998138A80AB0FD2FBFF1
SHA-256:	0A8CB37C46A330EFC5DF36907E4AECAE1B34D5C1F7DB24956BE33CDE502A8D8C
SHA-512:	04DDAC3B9DDB2DDA6B8AA8194D6829134AABE5A0758DA036ADC6F9D18118991F20EB24160EDAC613E3C809BF6E9AB79D7F5EDD48C65BB7C3461971BABBCD0551
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0.............2=... ...@....... ..............................Uj....@..................................<..O....@...............(..x&...`.......<............................................... ............... ..H............text...8.... ...................... ..`.rsrc........@....... ..............@..@.reloc.......`.......&..............@..B.................=......H.......P ...............%..p...D<......................................BSJB............v4.0.30319......l...D...#~...... ...#Strings............#US.........#GUID...........#Blob......................3....................................../.......................u...........].....].....]...D.]...a.].....]...-.].................o.....o.....o...).o...1.o...9.o...A.o...I.o...Q.o...Y.o.......................#.....+.....3.@...;.e...C.y...K.....S.@...................................

C:\Program Files (x86)\letsvpn\app-3.8.0\ko\System.Web.Services.Description.resources.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	19576
Entropy (8bit):	6.791409939356242
Encrypted:	false
SSDEEP:	384:ovP73AIGoWe6lWLNynsAw/98E9VF3AM+onVG1B1:o37AIGN4Aw/KENAMxVs
MD5:	559A2473D6AE9522FD6CA8262D8390C7
SHA1:	20AF914C1C5FBCD731AB00F65783B4E325249248
SHA-256:	898AF87C37E71F9D27F3796D59F341B89BCD7C9FB69EA88AB1F3B8E7A7E8BB16
SHA-512:	C84B97A2C4BE9C67AD0DBAFED337938F40CB3E9BDE91BC1CCA86D69A7126B1B588D7263FA6F9B9ACAE0A58B9D4B54A551096D2A45153FDBC4417E4DB9243A391
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....9..........." ..0.............2;... ...@....... ....................................@..................................:..O....@...............&..x&...`.......:............................................... ............... ..H............text...8.... ...................... ..`.rsrc........@......................@..@.reloc.......`.......$..............@..B.................;......H.......P ...............%..p...D:......................................BSJB............v4.0.30319......l...D...#~...... ...#Strings............#US.........#GUID...........#Blob......................3......................................,.......................u...........Z.....Z.....Z...A.Z...^.Z.....Z...*.Z.................o.....o.....o...).o...1.o...9.o...A.o...I.o...Q.o...Y.o.......................#.....+.....3.@...;.e...C.y...K.....S.@.....................l.............

C:\Program Files (x86)\letsvpn\app-3.8.0\libwin.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	10683000
Entropy (8bit):	6.353453221276462
Encrypted:	false
SSDEEP:	98304:sAWOFM9o/wmrWHP8Pltr+ccvANRYjb0Sp59tE/Ysg:1WOWhg8M2E/bg
MD5:	D25A37C649CAF226DBF1EBF80AF4E962
SHA1:	53C2049BB035D26C3BE87CA024A95EC6C019C2A2
SHA-256:	448E8E35343D9FC454B981A8EAC693B7014E17BE95DDCFB7B9E506725C2723CE
SHA-512:	5D660A9C8EBC3687B3AA12ADED4C4055291C56352FF201D558C4569D395F5C6ACF935697D1762952A967E0270E6B3AD1285B92A2665A30D14EE67BAF8D31A6DA
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: C:\Program Files (x86)\letsvpn\app-3.8.0\libwin.dll, Author: Joe Security
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..................#...*..K.....4............L...8b.........................p......}#....@... ...............................\......................x&... ..\M..........................`..........................`............................text.....K.......K.................`..`.data........L.......K.............@....rdata..D.N...O...N...O.............@..@.bss.....2...............................edata..............p..............@..@.idata..\...........z..............@....CRT....,..........................@....tls................................@....rsrc...............................@..@.reloc..\M... ...N..................@..B................................................................................................................................................................................................................................

C:\Program Files (x86)\letsvpn\app-3.8.0\log4net.config

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	3607
Entropy (8bit):	6.27044188314989
Encrypted:	false
SSDEEP:	96:l22xKLORF1pb5YrJWox7aI94UnvQdmrZ/xEKxD5q8fANY2Z:l22XFbawo1BvecZ/xXxF3INYY
MD5:	28F9077C304D8C626554818A5B5F3B3A
SHA1:	A01F735FE348383795D61AADD6AAB0CC3A9DB190
SHA-256:	746B5675EA85C21EF4FCC05E072383A7F83C5FE06AAA391FC3046F34B9817C90
SHA-512:	485C175BC13C64601B15243DAECBF72621883C2FF294852C9BBB2681937F7EF0BEA65361E0F83131EC989432326442EF387C1CCF2A7CA537C6788B8FD5C0021E
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8" ?>..<configuration>... Level........ -->... None > Fatal > ERROR > WARN > DEBUG > INFO > ALL-->... .....level.ERROR...cs......log4net.info()..............-->...<log4net>....<logger name="logger">.....<level value="ALL" />.....<appender-ref ref="LogAppender" />....</logger>.... ........-->.... <appender name="LogAppender" type="log4net.Appender.RollingFileAppender">-->....<appender name="LogAppender" type="log4net.Appender.RollingFileAppender">.....<param name="File" value="Log\\" />.....<param name="AppendToFile" value="true" />.....<param name="MaxFileSize" value="10240" />.....<param name="MaxSizeRollBackups" value="100" />.....<param name="StaticLogFileName" value="false" />.....<param name="DatePattern" value="yyyyMMdd".log"" />.....<param name="RollingStyle" value="Date" />..... ......-->.....<layout type="lo

C:\Program Files (x86)\letsvpn\app-3.8.0\log4net.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	280184
Entropy (8bit):	5.6860173046115605
Encrypted:	false
SSDEEP:	3072:6G0WgexKpGi8PnJcerXUaxX3HVeES4BEIqTTpX/4ormGpnaVTSGCkMhkEn7GAhCU:6JrycoB3HVeESME3pnaVTS1nh7hCafhD
MD5:	E281F008A6D29AE21E0173C97E63EF93
SHA1:	21004CD1D373563298738BDB70F66DCA3865C0BD
SHA-256:	146C386529E15C58CA7CB51927616B8310C7CA0855603BC22ADDBBCDD9502C11
SHA-512:	B8CEBC8BBF18AA03872DC74DBAB9569682C64DD5C2AD3C07E542BA08BDB1CCCFC5A956622DAA1C9E218F8D54B9E26B8533091C378B6F386E25F3FCCBDC201765
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...p3..........." ..0...... ........... ... ....... .......................`.......b....`.................................h...O.... ............... ..x&...@......L................................................ ............... ..H............text........ ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\letsvpn\app-3.8.0\microsoft.identitymodel.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1107576
Entropy (8bit):	5.828473300216417
Encrypted:	false
SSDEEP:	24576:A1WtBetKEfrsial0WV1pqfy+Jp15yKn6G/g:TtBetKEfrsial0WV7215yKn6Go
MD5:	3DC6EAE314A5181074233BFBF4F7900C
SHA1:	77004B3288F8B506B20F0CE2919981BF1386F1C2
SHA-256:	6775E8C1409EA5712A109739726A9D5FAC260F1D85AFED4AFBB74C7BB9CD1274
SHA-512:	EBDB10F4E278CA59B23A99B315128BAA159C21FA5527A432A906854B7122640DA876182C5B6B5F23AD769190889D2742723C01769D955FF73C324116379183C3
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...&..\...........!......... ......N.... ........@.. ....................................@.....................................W.......0...............x&..........P................................................ ............... ..H............text...T.... ...................... ..`.rsrc...0...........................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\letsvpn\app-3.8.0\netstandard.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	92280
Entropy (8bit):	5.4677409334882245
Encrypted:	false
SSDEEP:	1536:p2Ec05j4eAH64rh5fSt5T9nFcI94WKAwrxQ:olK4eA7mDmWKh+
MD5:	B6248E9061F9461852E7AA2BEFA94AB6
SHA1:	D660ADE010E6F4E64BEDAE921A8D932B608E9766
SHA-256:	45EB4B44B1EAD96DE4FFC85FCABDB24FD4D3CD0D913DC684E80531BB73138320
SHA-512:	2A1F4F37D4AF5E40CC23D1B69DC74AA69308557F3A8A384480ECE7BE92E60168610502C781381C12A8603FE9E00FB2E7ADD24F9D1717E00E58E5A24073ACEB84
Malicious:	true
Yara Hits:	Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Program Files (x86)\letsvpn\app-3.8.0\netstandard.dll, Author: Joe Security
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...M..Z.........." ..0..8...........U... ...`....... ....................................@..................................U..O....`..,............B..x&........................................................... ............... ..H............text....6... ...8.................. ..`.rsrc...,....`.......:..............@..@.reloc...............@..............@..B.................U......H.......P ...4..................,U......................................BSJB............v4.0.30319......l...\|...#~.....d...#Strings....L3......#US.T3......#GUID...d3..x...#Blob......................3................................q.....2B........e$.M...,.M.....M...4.M...1.M...1.M..v..M....M....M....p...........................!.....).....1.....9.....A.....I.................................#.......+.......3.......;.J.....C.f.....K.f...................2.....................

C:\Program Files (x86)\letsvpn\app-3.8.0\pl\System.Web.Services.Description.resources.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	19064
Entropy (8bit):	6.698628900071768
Encrypted:	false
SSDEEP:	384:cKss4wvEmF+4wpwlU+nACUOWe6lWPNynsAw/98E9VF3AM+oN256r:cK/PArYAw/KENAMxQA
MD5:	1B8A70C38AFAFB773DCBA2CE1D026B62
SHA1:	16074C1004D1F99C4A430A35038C0283E9D39F5F
SHA-256:	D9BBEBE78099A9E73E6F12B54CD9B5D513D1B04605BC692BB4E03BB2D3464CC6
SHA-512:	9BF94614E9D630A5261FB248C3065326AE0A415357D7F0335CD8A52FC5ACCFAD03108BCC625AFBA76DD19991C710F6D3ADDF072E6FFA4E7256BE340F0DE47AD1
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...I............." ..0..............9... ...@....... ..............................w(....@.................................x9..O....@...............$..x&...`......\9............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................9......H.......P ...............%.......8......................................BSJB............v4.0.30319......l...D...#~...... ...#Strings............#US.........#GUID...........#Blob......................3......................................,.......................u...........].....].....]...A.]...^.].....]...*.].................o.....o.....o...).o...1.o...9.o...A.o...I.o...Q.o...Y.o.......................#.....+.....3.@...;.e...C.y...K.....S.@.....................Z.............

C:\Program Files (x86)\letsvpn\app-3.8.0\pt-BR\System.Web.Services.Description.resources.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	19064
Entropy (8bit):	6.619485411945954
Encrypted:	false
SSDEEP:	384:CqXQfVeSN32XFZWe6lWkcNynsAw/98E9VF3AM+oqsC:Cg0Vyiv4Aw/KENAMxE
MD5:	BA8691F3326472491E7660BCF88F4E9C
SHA1:	9CAEA3F625380B2AC546829BB9E08B432348A531
SHA-256:	CC488533AC488E523883679100796313695828AF820C6CA80DBABBAEE3798788
SHA-512:	96E5DA2C01A7D9566E609D46D580AE6E04D8B84102C60FFAC5619E29C8AF1232667C93031AA94BA327CC361B9AC88BDF4DFA62BC4E25236D7036595A4B85FF88
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...m............." ..0.............V9... ...@....... ....................................@..................................9..O....@...............$..x&...`.......8............................................... ............... ..H............text...\.... ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B................89......H.......P ...............%......h8......................................BSJB............v4.0.30319......l...D...#~......$...#Strings............#US.........#GUID...........#Blob......................3......................................2.......................x...........`.....`.....`...G.`...d.`.....`...0.`.................r.....r.....r...).r...1.r...9.r...A.r...I.r...Q.r...Y.r.......................#.....+.....3.@...;.e...C.y...K.....S.@...................................

C:\Program Files (x86)\letsvpn\app-3.8.0\ru\LetsPRO.resources.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	76408
Entropy (8bit):	5.844265202743009
Encrypted:	false
SSDEEP:	1536:Hsu7jEnH3fyIJFGBLR+gP8874zGgSmR40sqXz2RgUgy/AwrxQ:H8uBV+gP8874zGgSmRwqXz2RgUgy/hi
MD5:	3DAE82A727FCBE14B2EE582131BEFF1F
SHA1:	63A13B2CF29904BA51640930F18CECB590F1BF23
SHA-256:	E022E918B98491B8A2EA80695219FEE3F0177ED65DF26BC258E869FA46DC01C8
SHA-512:	6471C917AD2557463776DE61624AADB7D3B9FD223A4B77CF69F67AEF36633584545D1B09036D80DC13D47B700AE0D60416BC8385382E1D3ACA179995B043BDC7
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....pf...........!................>.... ... ....... .......................`............@.....................................W.... ..................x&...@....................................................... ............... ..H............text...D.... ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B................ .......H...........$...........P ..n...........................................j..............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............PADPADP.S9.a.......dx.4.E.:.....u..n."..iP...T..:K..c7... ..n......Mn...~..*k;.E....5:.J.[..H.......1..&...+.@..s.............7.Tk[......ue./.N.M.i..:...v....F.b.b.S^m.........pE...k....D.../L.e..-...<r.......a...

C:\Program Files (x86)\letsvpn\app-3.8.0\ru\System.Web.Services.Description.resources.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20600
Entropy (8bit):	6.659699283465126
Encrypted:	false
SSDEEP:	384:X8knfHjuXOQWe6lWBNynsAw/98E9VF3AM+ohp3oT:MAuXO1CAw/KENAMxQT
MD5:	E603BFE5C3CA512229D958319F2E5567
SHA1:	991D9B1F12800A679985DA3785A2683E972B264C
SHA-256:	88C864FA482D93E9F51CD4AFBF68DEADC65A369F7CA5BB116962A241B7B0D4A6
SHA-512:	B9F674D3E53AAEE9289EDFEC43CE952DAC7008534743F0E30661E7C852D831E75C1B6B8E91903434F79F40E08BF5F468AD183EB6B472B7D7A1F5944137C6A0BB
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...(............." ..0.. ...........>... ...@....... ....................................@..................................>..O....@.................x&...`.......>............................................... ............... ..H............text........ ... .................. ..`.rsrc........@......."..............@..@.reloc.......`.......(..............@..B.................>......H.......P ...............%..8....>......................................BSJB............v4.0.30319......l...D...#~...... ...#Strings............#US.........#GUID...........#Blob......................3......................................,.......................r...........Z.....Z.....Z...A.Z...^.Z.....Z....Z.................l.....l.....l...).l...1.l...9.l...A.l...I.l...Q.l...Y.l.......................#.....+.....3.@...;.e...C.y...K.....S.@...................................

C:\Program Files (x86)\letsvpn\app-3.8.0\runtimes\win-arm\native\e_sqlite3.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) ARMv7 Thumb, for MS Windows
Category:	dropped
Size (bytes):	904312
Entropy (8bit):	7.129804131122757
Encrypted:	false
SSDEEP:	24576:0oXErM5iD28EYQg502GXoU5C0ParRvbLyi:lXriD28xj52X7arp3
MD5:	A3A581C464878B60B80571D4EF7BE5EA
SHA1:	047990D62D9F4BEEDFA12873A171B1C4B9D8EA34
SHA-256:	0B8A3861F184766F94ED773F09FFEC5CCE363EAA2E34E2FFED04ED505CDFB399
SHA-512:	D265AE21123EA708136D19CCF039957BB0388E026B86F7231A8F684D68D0D598972C9A49542F51ED6F04553F9782083F75159F3FEC00A326E391AC1D2CF297EA
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......`^ .$?N.$?N.$?N..WK..?N..WJ.?N..WO.'?N.$?O..?N.%RK.9?N.%RJ.)?N.%RM.?N..RJ.&?N..RN.%?N..R..%?N..RL.%?N.Rich$?N.........PE........^.........."!........................ ...........................................@A............................"......(............@..hO......x&.......?..0l..T............................l............... ...............................text............................... ..`.rdata..B.... ......................@..@.data...<J.......>..................@....pdata..hO...@...P..................@..@.rsrc................d..............@..@.reloc...?.......@...f..............@..B........................................................................................................................................................................................................................................................................

C:\Program Files (x86)\letsvpn\app-3.8.0\runtimes\win-x64\native\e_sqlite3.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1312888
Entropy (8bit):	6.544758831487914
Encrypted:	false
SSDEEP:	24576:gwDD7AuRNZxBNzFlbZcN16AL9hwYi20TAg7wkPoR:gIDbR1L/m9KYixcWO
MD5:	4864F0FC6010754D4AA89F4F41EE4F00
SHA1:	33B6E244EDA75F61A458D2A3DC57A764F9E4DA05
SHA-256:	B0F2DB4F2EE274D19F48DE95F9E11D0FF1AA881C50CA811E0D1808977D930461
SHA-512:	DCEB090FDD05487C2F90BCE19EA1A3FAB13650264F8A030FE565EB9228BD007AE15F582BDD8F4CEE0F90DB858FF83A715BD8BDF35875B1B2281C9AEA1D728DC3
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......:.[.~.5.~.5.~.5.%.1.u.5.%.6.v.5.%.0...5.%.4.}.5.~.4...5...0.`.5...1.p.5...6.v.5..1.\|.5..5...5......5..7...5.Rich~.5.........PE..d.....^.........." ................P........................................P............`A........................................ ...."..(...(.... .......@..h.......x&...0..........T............................................................................text............................... ..`.rdata..............................@..@.data....i.......T..................@....pdata..h....@......................@..@_RDATA..............................@..@.rsrc........ ......................@..@.reloc.......0......................@..B........................................................................................................................................................................................................

C:\Program Files (x86)\letsvpn\app-3.8.0\runtimes\win-x86\native\e_sqlite3.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1028216
Entropy (8bit):	6.747283377254892
Encrypted:	false
SSDEEP:	24576:SBvdKGB6hOsMxCmy+rAnpyAqhTz3RzVNUOxKKoSVr:6vdKGBmWNAnpc3Rz1KKoSF
MD5:	0A4F0810B5DEC798ABA4A796ABD93992
SHA1:	E163387D2580F38923327ADC71B9F296215EC53B
SHA-256:	A8287C6B6FCF3F740189975B59D19AE4DDE94945452A431566CB3ACBB2A99457
SHA-512:	F58E1701D0B43D187DCDA6D55F6C66A9165AB02872134F15D3C7A13902A766CEA810155A53AFF6C436092212FD3F74AE85BE8A5DE93D008C0072B1E02D2AFA9C
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........E......................#.....................2...........................z.......z.......z.......z.......Rich............................PE..L.....^...........!.....R...B..............p......................................1.....@A........................ ...."..(...(....`..................x&...p...\......T...........................(...@............p...............................text....Q.......R.................. ..`.rdata..z....p.......V..............@..@.data....K.......>..................@....rsrc........`.......*..............@..@.reloc...\...p...^...,..............@..B........................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\letsvpn\app-3.8.0\tr\System.Web.Services.Description.resources.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	19064
Entropy (8bit):	6.603697010371566
Encrypted:	false
SSDEEP:	384:5fH3xC8M83We6lW5NynsAw/98E9VF3AM+otxJTSsaR:1c8M8YGAw/KENAMxrU
MD5:	96A28156676D326BCCDA280355812EE0
SHA1:	A202E4342AAA7577BD1B33D1ECD17C88F4A655E7
SHA-256:	F302BEFCD5824867512CB649D769B684298F55EB8C50D754FFE179A7038212C4
SHA-512:	FE0D8ABAADCC25BA93A85D7B55D63A5FDADA694051E6460424253953BE1FD057053C26B56AE13E91177C7921A51DB307CBB6CAF94FA512E1027E59819C462F33
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...S............." ..0.............J8... ...@....... ..............................".....@..................................7..O....@...............$..x&...`.......7............................................... ............... ..H............text...P.... ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B................,8......H.......P ...............%......\7......................................BSJB............v4.0.30319......l...D...#~...... ...#Strings............#US.........#GUID...........#Blob......................3......................................,.......................u...........Z.....Z.....Z...A.Z...^.Z.....Z...*.Z.................l.....l.....l...).l...1.l...9.l...A.l...I.l...Q.l...Y.l.......................#.....+.....3.@...;.e...C.y...K.....S.@.....................r.............

C:\Program Files (x86)\letsvpn\app-3.8.0\x64\WebView2Loader.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	137336
Entropy (8bit):	6.167796134979499
Encrypted:	false
SSDEEP:	3072:y9MrTPTNy56J4JQSfB6yRkkGvaYhfls6DREtfw6aQ5ChcD:y+PTQ6Ga+BtakGvVEtCPhs
MD5:	C671A607C0C10E97B3215EB2C98936CB
SHA1:	552AAB0F8699839CDE13A48F8FCBABBB43AA8041
SHA-256:	33F987F31306173813CBC8AD93DA1418724EAB8F165130FFCC5EC22B5DA6CB74
SHA-512:	957498FFC7704C309F9D0AD9F335B16FA4F9DF2F2169E9935334DD2DA0187467CAD69C4486FD1872F079350C299F2523866F3092EF3EBB25AF9C8B86C0CF31A9
Malicious:	true
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......`.........." ................P9.......................................p............`A........................................G.......9...(....P..................x&...`......D...........................(....1..0..................8........................text............................... ..`.rdata.......0......................@..@.data...............................@....pdata..............................@..@.00cfg..(.... ......................@..@.tls.........0......................@..._RDATA.......@......................@..@.rsrc........P......................@..@.reloc.......`......................@..B................................................................................................................................................................................................................................................................

C:\Program Files (x86)\letsvpn\app-3.8.0\x86\WebView2Loader.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	111224
Entropy (8bit):	6.50303236163388
Encrypted:	false
SSDEEP:	3072:GlzhJmad5M+ekPfJFVwKrSDnuP7HCt+/NyIDfEtPsn/j481yhb6:GlzqaHM+eCTrSDuP7ZbEtUnr51yhb6
MD5:	BD183E6CD63EFE4F3162ED2694BE74ED
SHA1:	51413BA54A4D04DBB1BEF5E759E0E617C84994A0
SHA-256:	A2CCFACAA8797CB33992F085557782A2C50534159252E68C3CDDA7F859B5AE5C
SHA-512:	D46F6514B8BD3B574A93E1B486063EBAE9527751963DC7024324D2DAE343C53E1BED7BE5379F36450C145649C9A68C704BE73A7472D167062E0F6227D99F28CB
Malicious:	true
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L......`.........."!.................4...............................................Y....@A.........................k.......l..(.......................x&......L...Ph.......................f......`...............8n..8....i.......................text...e........................... ..`.rdata...k.......l..................@..@.data................d..............@....00cfg...............n..............@..@.tls.................p..............@....voltbl.H............r...................rsrc................t..............@..@.reloc..L............z..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\letsvpn\app-3.8.0\zh-CN\LetsPRO.resources.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	58488
Entropy (8bit):	6.197479369070506
Encrypted:	false
SSDEEP:	768:7lOlfuJ0GdnLImkLGecnuPndBnVt41IxZAw/KENAMxO2:ZA8NLLkpcnufzVtZZAwrxO2
MD5:	34CF107E7C1BB2FD74B22BBABA954603
SHA1:	D23D9F4C8FD0C4029BAFC79F1E9E170696EA4944
SHA-256:	CABCBFDAACEA728DB6C91782C478569465B1DD026649A792E2778EFB6FED610F
SHA-512:	7FBAEDA8D0C3851D0E70702F16489700B486A36823DAF1FC18788B61CC3FCC0470BBCBC162C5B57D85D3623B2F0CCD4D7687459CE23A8C741B42F1862B1C5C15
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....pf...........!..................... ........... ....................... ......U.....@.................................l...O.......................x&........................................................... ............... ..H............text....... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......D...(...........P ...........................................................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............PADPADP.S9.a.......dx.4.E.:.....u..n."..iP...T..:K..c7... ..n......Mn...~..*k;.E....5:.J.[..H.......1..&...+.@..s.............7.Tk[......ue./.N.M.i..:...v....F.b.b.S^m.........pE...k....D.../L.e..-...<r.......a...

C:\Program Files (x86)\letsvpn\app-3.8.0\zh-HK\LetsPRO.resources.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	58488
Entropy (8bit):	6.201961798435287
Encrypted:	false
SSDEEP:	768:xlOlfuqeGGdYokNvGFwhGO5yOZUiZ6zpcO+6jEHyYlFAw/KENAMx6U+k:LAWDYXqwD5yOZd++OEHzFAwrxAk
MD5:	E0EFA5AEDA4BA4E5E458402D84438A9B
SHA1:	7601D18AE6DD3B66ADC8137AA354BE66C04F2F36
SHA-256:	A304536ADAEAE63307820129C8A53331CD18CC4F36CD810938CA00D9FC58A9D1
SHA-512:	26B9F3BFAAAD2B687B8403F74ED6310D846980AF9275C5FF9BC053F3BD9A0617F4B164DF7BB37D9C9A5CE670903C2A6A8DCC6835D721CF6B04CDE2B9168E5810
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....pf...........!..................... ........... ....................... ......._....@.....................................S.......................x&........................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......p...(...........P .............................................................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............PADPADP.S9.a.......dx.4.E.:.....u..n."..iP...T..:K..c7... ..n......Mn...~..*k;.E....5:.J.[..H.......1..&...+.@..s.............7.Tk[......ue./.N.M.i..:...v....F.b.b.S^m.........pE...k....D.../L.e..-...<r.......a...

C:\Program Files (x86)\letsvpn\app-3.8.0\zh-Hans\System.Web.Services.Description.resources.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	18552
Entropy (8bit):	6.844463929915513
Encrypted:	false
SSDEEP:	384:XfX3HhVhLu4y8VWe6lWRNynsAw/98E9VF3AM+op1ZT3A:P3h/aSAw/KENAMxTdQ
MD5:	04C1D59617948852A5CB0460BB75E890
SHA1:	2729D2F70B737D35FF6520267266AF239E3E4D69
SHA-256:	307C89A6C9353978DABBBA9F6F4DDEAE5A433F2F3E30EF33E3F0E9B461679512
SHA-512:	7F6392CDCA800F629ACC65C0F4024B8CB2930746D4C0EE8C3786E10C9AD151EEE1D6560BF03BDB8A28408FA62450373C294879B4D1E51F9CDF3A8BFD0A038EAE
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....R]..........." ..0..............7... ...@....... ..............................v.....@.................................h7..O....@..............."..x&...`......L7............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`....... ..............@..B.................7......H.......P ...............%.......6......................................BSJB............v4.0.30319......l...D...#~......(...#Strings............#US.........#GUID...........#Blob......................3......................................,.......................r...........Z.....Z.....Z...A.Z...^.Z.....Z...*.Z.................l.....l.....l...).l...1.l...9.l...A.l...I.l...Q.l...Y.l.......................#.....+.....3.@...;.e...C.y...K.....S.@...................................

C:\Program Files (x86)\letsvpn\app-3.8.0\zh-Hant\System.Web.Services.Description.resources.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	18552
Entropy (8bit):	6.844818080079834
Encrypted:	false
SSDEEP:	384://wkIv2FCcTWe6lWwNynsAw/98E9VF3AM+oLP/cr:ngddAw/KENAMxLcr
MD5:	DCE2814D7628723380B41BF598A61EC3
SHA1:	3A971A7077642CB543D2E52DB97618D6A9AED85F
SHA-256:	AC22E50F609E3BE061EB6B8130A79B2E31EE4B3CEC60CB0A94A3527A45D3687E
SHA-512:	6F8B797BED67DBBA3B277EE159DE9280802A49BCF4E4BA29DE7BB80297A6E32837F8C8049E5593160BC81D102BC1D7F8C686FF2750A2D5CDC1D4167C937FF488
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....L............" ..0..............7... ...@....... ...............................S....@.................................`7..O....@..............."..x&...`......D7............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`....... ..............@..B.................7......H.......P ...............%.......6......................................BSJB............v4.0.30319......l...D...#~......(...#Strings............#US.........#GUID...........#Blob......................3......................................,.......................r...........Z.....Z.....Z...A.Z...^.Z.....Z...*.Z.................l.....l.....l...).l...1.l...9.l...A.l...I.l...Q.l...Y.l.......................#.....+.....3.@...;.e...C.y...K.....S.@...................................

C:\Program Files (x86)\letsvpn\app-3.8.0\zh-MO\LetsPRO.resources.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	58488
Entropy (8bit):	6.20237045425583
Encrypted:	false
SSDEEP:	768:7lOlfuqeGGdYokNvGFwhGO5yOZUiZ6zpcO+6jEHyplyAw/KENAMxJ:ZAWDYXqwD5yOZd++OEHayAwrxJ
MD5:	CC5C434B0A4ED1D8156CED79646223EB
SHA1:	3CD7639D33AA54E8579DF9362589563552A99016
SHA-256:	108854A19FC968C9F18C30FA70E1B08369830B9BFC275F87007417A960D7F16D
SHA-512:	73ABA80BB4ACDC3B866D0B34D5343AC011141134D8921045A14A2EE193F2CDF0B6FD5170DF8E066F0FC783441A9DB57BFA63DCC62C11406627051753EF3829E0
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....pf...........!..................... ........... ....................... .......v....@.....................................S.......................x&........................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......p...(...........P .............................................................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............PADPADP.S9.a.......dx.4.E.:.....u..n."..iP...T..:K..c7... ..n......Mn...~..*k;.E....5:.J.[..H.......1..&...+.@..s.............7.Tk[......ue./.N.M.i..:...v....F.b.b.S^m.........pE...k....D.../L.e..-...<r.......a...

C:\Program Files (x86)\letsvpn\app-3.8.0\zh-SG\LetsPRO.resources.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	58488
Entropy (8bit):	6.197920366785809
Encrypted:	false
SSDEEP:	768:glOlfuJ0GdnLImkLGecnuPndBnVt41TxnAw/KENAMxJw:IA8NLLkpcnufzVtKnAwrxJw
MD5:	CDB835CCA289E17422730398CE4ABEFD
SHA1:	F80DED8236CA9E50D31761AE37F066F911B8DEA2
SHA-256:	6BEBC6C4B3DC01E75F857A3025B7497E1543C993EFF6E665C17DFEADA444B1F4
SHA-512:	D258E29F5B45D66D287131A44C8E828FCA4A9111014BBC1A9C62E1FBD120F9F8197AA94F9C94444C69CA777275B5D5F55CCECA3BDE0AA78AD6E61A5F29AC5A76
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....pf...........!..................... ........... ....................... ......N.....@.................................l...O.......................x&........................................................... ............... ..H............text....... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......D...(...........P ...........................................................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............PADPADP.S9.a.......dx.4.E.:.....u..n."..iP...T..:K..c7... ..n......Mn...~..*k;.E....5:.J.[..H.......1..&...+.@..s.............7.Tk[......ue./.N.M.i..:...v....F.b.b.S^m.........pE...k....D.../L.e..-...<r.......a...

C:\Program Files (x86)\letsvpn\app-3.8.0\zh-TW\LetsPRO.resources.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	58488
Entropy (8bit):	6.200990487313
Encrypted:	false
SSDEEP:	768:6lOlfuqeGGdYokNvGFwhGO5yOZUiZ6zpcO+6jEHy7lVAw/KENAMxJRJFq:GAWDYXqwD5yOZd++OEHsVAwrxLJ4
MD5:	91B72B541549575A50A7F06F33360F76
SHA1:	96A0351A20ACF5519A2FDD476EABFD50ECB035DC
SHA-256:	4D3C31FCB656F33740829C788FC8F478EBB5867CA76F7908E2B6220808B657C8
SHA-512:	FA5091A2F34A6A7F65E1A4CD815AC4E5FB50F56CC67EDFAB7407705DCA7D2E6A591AA7A3F9E7DDAFBAED217740CADAC01D958DEBDC5AC067E3C32100BE84EF4F
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....pf...........!..................... ........... ....................... ......k.....@.....................................S.......................x&........................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......p...(...........P .............................................................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............PADPADP.S9.a.......dx.4.E.:.....u..n."..iP...T..:K..c7... ..n......Mn...~..*k;.E....5:.J.[..H.......1..&...+.@..s.............7.Tk[......ue./.N.M.i..:...v....F.b.b.S^m.........pE...k....D.../L.e..-...<r.......a...

C:\Program Files (x86)\letsvpn\driver\OemVista.inf

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	7632
Entropy (8bit):	5.063558190257152
Encrypted:	false
SSDEEP:	192:wr8tW9yCTi3x4vlQd22bjR+iAUC7bMP+io3DcNSj6jvKFkPs7EQTXvt1Ld4Z:LWlGNdkkzo3DcNSj6jvKFkPs7EQTXvtk
MD5:	26009F092BA352C1A64322268B47E0E3
SHA1:	E1B2220CD8DCAEF6F7411A527705BD90A5922099
SHA-256:	150EF8EB07532146F833DC020C02238161043260B8A565C3CFCB2365BAD980D9
SHA-512:	C18111982CA233A7FC5D1E893F9BD8A3ED739756A47651E0638DEBB0704066AF6B25942C7961CDEEDF953A206EB159FE50E0E10055C40B68EB0D22F6064BB363
Malicious:	false
Preview:	; ***************************************************************************..; Copyright (C) 2002-2014 OpenVPN Technologies, Inc. ..; This program is free software; you can redistribute it and/or modify ..; it under the terms of the GNU General Public License version 2 ..; as published by the Free Software Foundation. ..; *************************************************************************....; SYNTAX CHECKER..; cd \WINDDK\3790\tools\chkinf..; chkinf c:\src\openvpn\tap-win32\i386\oemvista.inf..; OUTPUT -> file:///c:/WINDDK/3790/tools/chkinf/htm/c%23+src+openvpn+tap-win32+i386+__OemWin2k.htm....; INSTALL/REMOVE DRIVER..; tapinstall install OemVista.inf tapoas..; tapinstall update OemVista.inf tapoas..; tapinstall remove tapoas....;*******************************************************..; Note to Developers:..;..; If you are bundling the TAP-Windows driver with your app,..; you should try

C:\Program Files (x86)\letsvpn\driver\tap0901.cat

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	data
Category:	dropped
Size (bytes):	10739
Entropy (8bit):	7.214364446291792
Encrypted:	false
SSDEEP:	192:JDVLGVDFfap5UEwQl/WGhYCt17vJ4qnaj6jQc:7GCpzlnh3t1x4l2jn
MD5:	F73AC62E8DF97FAF3FC8D83E7F71BF3F
SHA1:	619A6E8F7A9803A4C71F73060649903606BEAF4E
SHA-256:	CC74CDB88C198EB00AEF4CAA20BF1FDA9256917713A916E6B94435CD4DCB7F7B
SHA-512:	F81F5757E0E449AD66A632299BCBE268ED02DF61333A304DCCAFB76B2AD26BAF1A09E7F837762EE4780AFB47D90A09BF07CB5B8B519C6FB231B54FA4FBE17FFE
Malicious:	false
Preview:	0.)....H........).0.)....1.0...`.H.e......0..i..+.....7.....Z0..V0...+.....7.......r?.X.M.....F.A..201008141946Z0...+.....7.....0..T0.... .....S!F.3....#.a.2`..e...#e...1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0<..+.....7...1.0,...F.i.l.e........o.e.m.v.i.s.t.a...i.n.f...0U..+.....7...1G0E0...+.....7.......010...`.H.e....... .....S!F.3....#.a.2`..e...#e...0...."~..m..8C. i$.4.l..1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0:..+.....7...1,0...F.i.l.e........t.a.p.0.9.0.1...s.y.s...0.... ..j(.M<.cR..XrT....F..R.]....?1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0:..+.....7...1,0*...F.i.l.e........t.a.p.0.9.0.1...s.y.s...0]..+.....7...1O0M0...+.....7...0...........010...`.H.e....... ..j(.M<.cR..XrT....F..R.]....?0.....".....A.Rw..... .1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0<..+.....7...1.0,...F.i.l.e........o.e.m.v.i.s.t.a...i.n.f.......0...0....+.

C:\Program Files (x86)\letsvpn\driver\tap0901.sys

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	39920
Entropy (8bit):	6.338128217115975
Encrypted:	false
SSDEEP:	768:XtCuL1O/+AphG3F9NlXt5oZhDzbV104mmuiExsFwQvYp33U35:XdCoTxk1lmmjExsFNvYtk
MD5:	C10CCDEC5D7AF458E726A51BB3CDC732
SHA1:	0553AAB8C2106ABB4120353360D747B0A2B4C94F
SHA-256:	589C5667B1602837205DA8EA8E92FE13F8C36048B293DF931C99B39641052253
SHA-512:	7437C12AE5B31E389DE3053A55996E7A0D30689C6E0D10BDE28F1FBF55CEE42E65AA441B7B82448334E725C0899384DEE2645CE5C311F3A3CFC68E42AD046981
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........~..[...[...[....w..Z....w..^...[...m....w.._....w..^.../t..Q.../t..Z.../t..Z...Rich[...........................PE..d......_.........."......Z.....................@....................................=w....`A....................................................<.......X....p..T....x...#...........R..8............................S...............P...............................text..._>.......@.................. ..h.rdata.......P.......D..............@..H.data........`.......P..............@....pdata..T....p.......R..............@..HPAGE.................V.............. ..`INIT.................d.............. ..b.rsrc...X............p..............@..B.reloc...............v..............@..B................................................................................................................................................................................

C:\Program Files (x86)\letsvpn\driver\tapinstall.exe

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	101536
Entropy (8bit):	5.597950959538587
Encrypted:	false
SSDEEP:	1536:ImYSYxGfIZnRnD6M7EFOUakPhtUn6KXF4O7WfvZt9c:HYFZnRDGdvPXU6K1RW
MD5:	1E3CF83B17891AEE98C3E30012F0B034
SHA1:	824F299E8EFD95BECA7DD531A1067BFD5F03B646
SHA-256:	9F45A39015774EEAA2A6218793EDC8E6273EB9F764F3AEDEE5CF9E9CCACDB53F
SHA-512:	FA5CF687EEFD7A85B60C32542F5CB3186E1E835C01063681204B195542105E8718DA2F42F3E1F84DF6B0D49D7EEBAD6CB9855666301E9A1C5573455E25138A8B
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........V........-.....;......<.......+....%......S....%......2....~......,.....)...Rich..........PE..d...<..W..........".................Tv............................................... ....@.......... ..................................................h.......l....D...H...p..........................................................X............................text............................... ..`.data...............................@....pdata..l...........................@..@.rsrc...h...........................@..@.reloc..z....p.......B..............@..B................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\letsvpn\ndp462-web.exe

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1429344
Entropy (8bit):	7.9320530592846135
Encrypted:	false
SSDEEP:	24576:8XWYAlLlqSmtLvUDSRbm4Jah1rVxzY8Ja1xbLAAAOurzXuV1F+eAXvUS1vlPA:8mYAlLfeTUDBzrVxzYTOTOu3Xu5AX/l4
MD5:	B5A67867CDCE86E09E2625A6FA4D5FEA
SHA1:	C42E6ED280290648BBD59F664008852F4CFE4548
SHA-256:	5E21C85034311C51D8B0367A773D475AF2392B3DDCD90676C61697C6B5FD2E6A
SHA-512:	31D7081BFFEEB5F32457096E51A29236306E5D971DE7EDB80A51188BCCDA9B9F17F0C3593D30828FC140B7A023F5B6842BC922F2023C7B8EA3786C2DBEC40472
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......So....x...x...x.......x.0.....x......x.xx..<.x.xx....x.xx..~.x......x...y...x.....Q.x.......x.......x.......x.Rich..x.........................PE..L.....\V.........."......l...t...................@..........................@.......)....@...... ..................`z...................................>..........@................................V..@............................................text....j.......l.................. ..`.data...@7...........p..............@....idata..H...........................@..@.boxld01............................@..@.rsrc............ ..................@..@.reloc...(.......*..................@..B................................................................................................................................................................................................................................................

C:\Program Files (x86)\letsvpn\packages\RELEASES

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with no line terminators
Category:	dropped
Size (bytes):	85
Entropy (8bit):	4.93098207822302
Encrypted:	false
SSDEEP:	3:ZMfx+E8vVs8WXsJ1lVHrGrVe:Ze+TXlVLGrVe
MD5:	5306FFA7932955EE8E6EEB176A017409
SHA1:	CDF2502768C25B28460EF7CEEDB96C1DCE890E10
SHA-256:	8DAC17CA6107D4ED5CCA8BE6B697C6872B5B20D1230BAB3B10D3DB10028AE49D
SHA-512:	4CF254D5007AB03A8F98377AA7DD42B8955E7C87EB59F6ABD3D9EB30886AC4934D8A2B7640062388D0A222B0F50DC7A4AC45756AC157C995EF9B0BF9C9BEEEF5
Malicious:	false
Preview:	.F29105E51A423481829200F919DF079D65C23424 SquirrelLetsVPN-3.8.0-full.nupkg 12413789

C:\Program Files (x86)\letsvpn\uninst.exe

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	108559
Entropy (8bit):	7.185833153729316
Encrypted:	false
SSDEEP:	3072:rTJ4TJdRVDZ6Lt+uweLlt3cgATZ+eWeH+BCX273qw0t:rVGdx6x/xJcgGZ+Y273qTt
MD5:	9EB7CD5568061CFC6C6352DB2BEC305B
SHA1:	6D83269BD2A88DA71E23B905B9955043151743CC
SHA-256:	D944139BD46DF3FE6C91DD8917ED5A5D1595AB1F5A7881174E01C89F1BACFAF0
SHA-512:	695D6CE406ADC403A64213A4A7F2C4547C2D862595C87E2F35A110669CC482CFE7D062C159D49419289FE881F47959A3C11C5D87A88018C0005CAA0E849F640E
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1...Pf..Pf..Pf._9..Pf..Pg.LPf._;..Pf.sV..Pf..V`..Pf.Rich.Pf.........................PE..L...<.oZ.................h...........3............@..........................@.......w....@..........................................p..................x&...........................................................................................text...'f.......h.................. ..`.rdata...............l..............@..@.data...............................@....ndata... ...P...........................rsrc........p......................@..@................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\edb.log

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	1.3325402160406286
Encrypted:	false
SSDEEP:	3072:5JCnRjDxImmaooCEYhlOe2Pp4mH45l6MFXDaFXpVv1L0Inc4lfEnogVsiJKrvr5Q:KooCEYhgYEL0In
MD5:	3FDAA51122CB2BE87DAD53317FE1DCF6
SHA1:	AE5CA4B0A50AA3A6A7250307EFBE458364C2F6A4
SHA-256:	E7F78CDC0049D1896E536361B564CAD7E21A4ADAF050B533A2153F229E4D46ED
SHA-512:	C4036DCCA8344E69F0E962299C0BB112A6712784ECB8D9BB3E578247A9A00D8F9F495364616C25701DF0ACFE15E670BD43043A739A0B9E7C53137D43B4A87830
Malicious:	false
Preview:	z3..........@..@.;...{..................<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@..........................................#.................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x585078cc, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.4221423933681599
Encrypted:	false
SSDEEP:	1536:JSB2ESB2SSjlK/dvmdMrSU0OrsJzvdYkr3g16T2UPkLk+kTX/Iw4KKCzAkUk1kI6:Jaza/vMUM2Uvz7DO
MD5:	68E2BEF5B64C6DCC27031B06A3C4CDAD
SHA1:	6610CFF08A5B209AE99348AF1EE51FE34E975626
SHA-256:	1504B860BEB189937FACF403F2E825B8AE30E90E7A63DFCE6DB818C5F9E97112
SHA-512:	01C2F29E2CDBA5F2C485085900492EFB9D38854C6DF331F6C71B328D90557E27D0866E3331A0EACA3E32C361F8F71F5AC89D249DF2AD46F3A65208DB49788765
Malicious:	false
Preview:	XPx.... .......A.......X\...;...{......................0.!..........{A..9...\|7.h.#.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........;...{...............................................................................................................................................................................................2...{..................................#.n..9...\|7.................3}A>.9...\|7..........................#......h.#.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07622223829187431
Encrypted:	false
SSDEEP:	3:z8YeYJ0hvejjn13a/iRk/lAllcVO/lnlZMxZNQl:Yzy0hGj53qiGAOewk
MD5:	E48938BEAB856FFBBF36E26F4E719AFE
SHA1:	BF29E349AA5CFC5ABE5DF03B7828D7F03030EDB8
SHA-256:	CB8406931ED50C7ECAA38E6AD027063ABB13E0711860111CBAFD79C3FFF2B8C3
SHA-512:	AB56335F272EB0BADFC855D08158CD7D832751D89896EFB06F15E843F0A9C3FB726168508A2C95DA7A39613AC616D2B04AF7CA400DA8D21272DDD6227E3D4602
Malicious:	false
Preview:	.>.<.....................................;...{...9...\|7......{A..............{A......{A..........{A]................3}A>.9...\|7.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\AEED7C5D2183A1352C6D421D65F131F0

Download File

Process:	C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe
File Type:	data
Category:	dropped
Size (bytes):	4515
Entropy (8bit):	7.621047039569311
Encrypted:	false
SSDEEP:	96:Vxvh3PIKfCEjsBxvh3PIKA1+4gtIvZCvh3PIKfhigYP:7pPIK6EjsDpPIKA1+D5pPIKfhigQ
MD5:	FC4B99091DAFC19A739C073554D02DAC
SHA1:	B59459BCA6FAF643D92D6B66584F335CD5606229
SHA-256:	73233F5D24A81D97E37F94F67D3A3AD70DD76379CDEF1918B6FF3069A958B829
SHA-512:	2358E146A890A37857814B3254095F9BC8F23C07A86C1958AC65B003CE0C04C35C478DC4F7FF7D0038389EC60561956EC3CC2D4EC74C1D2E78CEA2892C909315
Malicious:	false
Preview:	0......H..........0......1.0....H.........t0..x0..`.......K,;......{[>.W0....H........0V1.0...U....GB1.0...U....Sectigo Limited1-0+..U...$Sectigo Public Code Signing Root R460...210322000000Z..460321235959Z0V1.0...U....GB1.0...U....Sectigo Limited1-0+..U...$Sectigo Public Code Signing Root R460.."0....H.............0...........".$t...#.....6..G.#.+>.}.1.Qo....R.....c$......;}.......'.ke..i..I9..mn..'..+P.K[..d6.~J=.q.a.s.<....3W.47..]...=..v..?f.1i.m.4..zx.P.d.-...j../...n....!.@..............v.' .........).p........6..O2.tFkG5.w.3Oc..-.e..k..q....m......>,......ug.m.cc.6.i...E>nZ_..[.0.0...@...8.g.S...0e.o.....ti>..h;..g3......H@...dF..s....le..U[..W..xF\|p............@...).\..+.E...gO(^..Lz.......>2F. 6....F...:.f.X\)....08<.F65\|.......v.~..@.5..z................n..ob..P..{...?. .u."Z............_........B0@0...U......2..5.H/(@Bp 6.\...0...U...........0...U.......0....0....H.............ve..."J...^.i^...Ms...(.7..!.._...l...\.....9..Aq..<.{..#

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\AEED7C5D2183A1352C6D421D65F131F0

Download File

Process:	C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe
File Type:	data
Category:	dropped
Size (bytes):	320
Entropy (8bit):	3.166667286753941
Encrypted:	false
SSDEEP:	6:kKjvnrlrRLjKFlkM4UPeXZe4X1saKTUMWKcll/:vlREX4UPeXZeQsaKwMzcll
MD5:	497CB15451F42973B0EABB4FBEAD638D
SHA1:	E833074ADFC1C51E0F95F3B5156CC8F713EFB0E1
SHA-256:	24B22C4902CAC601BF8722CFEF63A2B27E618C8B68C69FE86C4DB5A0E293A0C8
SHA-512:	F361302153A9B4E5143E6138A3DEC9CB244DF54BC8FACB02B1EBD42D27B2589B6109F7587D20B52F72B6CFCB65C53FCC0EB0F840B9D05CEAF0EFBCCD1972A4C8
Malicious:	false
Preview:	p...... ....v...f.3"U...(....................................................... ............s...Q..V...............h.t.t.p.:././.c.r.t...s.e.c.t.i.g.o...c.o.m./.S.e.c.t.i.g.o.P.u.b.l.i.c.C.o.d.e.S.i.g.n.i.n.g.R.o.o.t.R.4.6...p.7.c...".b.5.9.4.5.9.b.c.a.6.f.a.f.6.4.3.d.9.2.d.6.b.6.6.5.8.4.f.3.3.5.c.d.5.6.0.6.2.2.9."...

C:\Users\user\AppData\Local\LetsVPN\LetsPRO.exe_Url_hxshkzbjc0q41lfegqy3kmdsmir3z3d0\AppCenter.config (copy)

Download File

Process:	C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	199
Entropy (8bit):	5.101986507271284
Encrypted:	false
SSDEEP:	6:TMVBd1IGpOSAMBluqdU0DhqPMnyKbofG3QIT:TMHdGGpOKDd5lqPMnyAofG3xT
MD5:	DE5DCE2D9281119E2DA88AB1E17022B3
SHA1:	3B38FF97A1B52785AACBEBF590D5786E0144E5B6
SHA-256:	25367D0B6A24D768170184EC560F1D8262D6B1A3382A349A355756A419E61A84
SHA-512:	0FFFBC4982D025C55A202D034FEA6E191638324D76D2241A9CC08BD381076002D868B675C639F41BC7BB320116F1F5BA48D42911295346B318F1BCDB83E3B6C8
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <appSettings>.. <add key="AppCenterInstallId" value="81962f3f-6482-4fd3-a757-186e4e549f6f" />.. </appSettings>..</configuration>

C:\Users\user\AppData\Local\LetsVPN\LetsPRO.exe_Url_hxshkzbjc0q41lfegqy3kmdsmir3z3d0\wbbtjthb.newcfg

Download File

Process:	C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	199
Entropy (8bit):	5.101986507271284
Encrypted:	false
SSDEEP:	6:TMVBd1IGpOSAMBluqdU0DhqPMnyKbofG3QIT:TMHdGGpOKDd5lqPMnyAofG3xT
MD5:	DE5DCE2D9281119E2DA88AB1E17022B3
SHA1:	3B38FF97A1B52785AACBEBF590D5786E0144E5B6
SHA-256:	25367D0B6A24D768170184EC560F1D8262D6B1A3382A349A355756A419E61A84
SHA-512:	0FFFBC4982D025C55A202D034FEA6E191638324D76D2241A9CC08BD381076002D868B675C639F41BC7BB320116F1F5BA48D42911295346B318F1BCDB83E3B6C8
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <appSettings>.. <add key="AppCenterInstallId" value="81962f3f-6482-4fd3-a757-186e4e549f6f" />.. </appSettings>..</configuration>

C:\Users\user\AppData\Local\Microsoft\AppCenter\81962f3f-6482-4fd3-a757-186e4e549f6f\Logs.db

Download File

Process:	C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe
File Type:	SQLite 3.x database, last written using SQLite version 3031001, file counter 13, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 13
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	2.016233072299922
Encrypted:	false
SSDEEP:	48:TVW6r2ZCvmCxB3bN6X5JxB3AhdICbT9Rj/hlWxB3uhdICbT9Rj/hurxB3MhdICbT:ssfxJbN6bxJQC09tWxJOC09GrxJkC09B
MD5:	BF5D77CFCDC7ED220DDACDCE83A4FEF2
SHA1:	0A411A16344B020EE5DD1821CADB4ED3CF77515A
SHA-256:	E608684530BC3EA5AA19C48B050296713664EED29263BB85CC64F0E95C89443C
SHA-512:	157520D15B1E9588E554353C93918F5CD453F63BE6C2D58BC4995B9E2756BC5CE738EA67B08D8B0DE92DF27DC92184757D4C6C63B60413C423E7180057C6029A
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................?.........\|.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\AppCenter\81962f3f-6482-4fd3-a757-186e4e549f6f\Logs.db-journal

Download File

Process:	C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	2.6641331614946386
Encrypted:	false
SSDEEP:	96:7WfxJbN6bxJQC09tWxJOC09FrxJkC09Pug:7U58QC090OC09VkC09Pv
MD5:	A2DFBFB16663ABB765D2C717B7D1D740
SHA1:	27977B501C5B4C7001287B8C8EFF997376414571
SHA-256:	53E59D1DA951E98F4E6B0069AD2400DF0B0E967748CDBE0DBF76C216CA58B195
SHA-512:	C9C2C6634445D23085A65716C9CBAEE3CCD5F913BD650A2BB729F04DD3365FF9B4774A3427130281235B8D1351AFB6F5702083B1288D9894E090B65C5E69F130
Malicious:	false
Preview:	.... .c......nh.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\0204cf16-7ea8-41ce-a86e-9627bc05f036.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	8251
Entropy (8bit):	5.802979417543562
Encrypted:	false
SSDEEP:	192:fsNARKBeiRUarZQ3kiFY6qRAq1k8SPxVLZ7VTiB:fsNAgRHm0ia6q3QxVNZTiB
MD5:	F7B76A9B5A0C15219B5216B0EADD211F
SHA1:	9DFB54D06016CA5B092F5F1835456D34BF73A181
SHA-256:	D2989AD41FC4EA566389E0815F33CEE8B27328CAF85A27105A063B1EF4BD8ACA
SHA-512:	E6564B183EAF65E958E433E67D30FA6EE3FE64611B1B6F745326671902AA552031D0795D0F0FDC04772D94D001E59D84AC67B06DFE1FE5C145EDD6E72F5775F0
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Ve

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\03d58abe-dfde-4f97-bc4e-1dc61d110e23.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	62789
Entropy (8bit):	6.079546411043385
Encrypted:	false
SSDEEP:	1536:IMSzMtXija+5xaf8dP0S58H61Mia4RzXzeJ6JoGT:IMSuij758kdP0Sa6KifzXzoYT
MD5:	9E27E2FC52FB8371DD8CDEFE654C122C
SHA1:	5CABFAE9D472DB769ABFA11FB722BFE889FA53DA
SHA-256:	4130CA31CA9DBBE984FB1E9029E617B3A2D609A5DD06DF8D5E6ACAF8E0C91FE9
SHA-512:	4CA4411CA2F0011856F26CF0EADDFF336ADEBFCB07B8287EC007F7D88FFB666FF4CDF2D7F2BA9ED12FE92FAB25052C3D2A4CFD18269816E7FA9CB2D6C36A3309
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13365809832396644","browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\1023d7e8-c9aa-4618-b52a-8035d253014e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	8333
Entropy (8bit):	5.7967148656251855
Encrypted:	false
SSDEEP:	192:fsNwRKBeiRUVrZQ3kiFY6qRAq1k8SPxVLZ7VTiB:fsNwgRMm0ia6q3QxVNZTiB
MD5:	1519CC37B96B58C33CE7B2B694831631
SHA1:	71F31BF0384D0D46AEE1A632FD176D63E3F6BE7C
SHA-256:	89B7B6E0C5D9CC23B0BAED940A8344B01AC43403B194F168B55BCCA69383DB64
SHA-512:	163F53B688E98ECD59B22F90BCEF72B344A5674C95FED1E316E7744D10425A5D6AF588ADECC08DEEFA530640ABACA3E6B79AEC8CBDB38BB01803EA763CE4BFE2
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"oem_bookmarks_set":true,"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\1046fd3f-6cdb-444c-817b-70eaabf33b51.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	62750
Entropy (8bit):	6.079544338766441
Encrypted:	false
SSDEEP:	1536:IMSzMtXija++faf8dP0S58H61Mia4RzXzeJ6JoGT:IMSuij7+ykdP0Sa6KifzXzoYT
MD5:	1D30C4C51A36019A996B74B6FA955DED
SHA1:	F579B280DBBCF85F70684C598A9EEA2D12E35B04
SHA-256:	5586552853F70332C9B10602388433EF722918E4ED73CC92FB5CD06A38F170A2
SHA-512:	F3CAA1298D7C7ECCEEB3CA1AD27732D2BB7903827D6576E3DBD72B10DAAFCA88FE4730603080FDAC2CE74D55DC7BC471BAD077ED01713692A6001F435818B606
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13365809832396644","browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\485da463-3696-4253-a25f-9f37b0aabf88.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	8098
Entropy (8bit):	5.80154167289021
Encrypted:	false
SSDEEP:	192:asNARKVeiRUL+QFkimC6qRAq1k8SPxVLZ7VTiq:asNAg1u/WimC6q3QxVNZTiq
MD5:	8A43C896B03DB75802BFCFAD1DAE2CE7
SHA1:	1ECF0A06F2EDA4C80310C3B192E2E228C2D91C57
SHA-256:	FBBA60B2983A42F5FA95FE41177FE807ACB863970DC2C1F8F512CEBD7720BB1D
SHA-512:	A19013F2E05DFDAFA1F7C458694E5378C548902F83367494052B3A5474B5C09E517AF6B2381AA2399D23557F4B7F7B55FD6541D186AC709D8497B7B1AF7FD0D2
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_mig

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\4b8da291-5ac4-43fa-8f35-a3bfae03aecd.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	41929
Entropy (8bit):	6.0780881177019905
Encrypted:	false
SSDEEP:	768:IM7X2zt1jOXtXi3zahcOAG92paM478AvkVP+7SlAXzqOp/6yac7GT:IMSzMtXija+5xaf8dP0S6XztJ6JoGT
MD5:	7DF3C04C73977362A23F886E014951D7
SHA1:	123A9019478ADE386D1BDE7EAA41643E93263DDC
SHA-256:	4DB3633094E71ED17DA026AF4B676513D42BA0512EDF3504A6B48B6595C3E89D
SHA-512:	FAD596DD4EA9B15D13EB4CCEFC9FC926B80B3AACD54AE4C24B86D40A664AA3B68EB1F7B8291DFF7EEF7012A9F177BE9701F3525B5E4B81A904A267DA1258EA76
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13365809832396644","browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\59f50c2a-cd78-4719-9098-426281beabfb.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	8098
Entropy (8bit):	5.80154167289021
Encrypted:	false
SSDEEP:	192:asNARKVeiRUL+QFkimC6qRAq1k8SPxVLZ7VTiq:asNAg1u/WimC6q3QxVNZTiq
MD5:	8A43C896B03DB75802BFCFAD1DAE2CE7
SHA1:	1ECF0A06F2EDA4C80310C3B192E2E228C2D91C57
SHA-256:	FBBA60B2983A42F5FA95FE41177FE807ACB863970DC2C1F8F512CEBD7720BB1D
SHA-512:	A19013F2E05DFDAFA1F7C458694E5378C548902F83367494052B3A5474B5C09E517AF6B2381AA2399D23557F4B7F7B55FD6541D186AC709D8497B7B1AF7FD0D2
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_mig

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\627da78a-617e-4c8c-ad7a-9d047aae6ec7.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	23958
Entropy (8bit):	6.0641441458832395
Encrypted:	false
SSDEEP:	384:4tM7XKnG7EtlXrFJOg5+VCKP4gW5CiUMzcBhcsNw2KvCpw0iaWqr/w7bpXxSahD7:IM7X2zt1jOXtXi3zahciAGw0iap/6ya9
MD5:	C48B897501230BED051B0C8937BB034C
SHA1:	29C6FDA4545651C313B9A43A8CF771BF0DC34A12
SHA-256:	9CF7451E50058CD0FC4CF2BEC8D88E91C59AF69F29CC07146200FD738CE81127
SHA-512:	52FD4D369B68253DCF3E105E17FEC5A1A785B1B6041F461C79AB5DF5D9C1F6DE3854BFEF11DD908CCD33B7C2401F7A564C4660CEEF49C8145D8563636C4479A2
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13365809832396644","browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\81089f64-2840-4ca9-b799-45fbf88fe9e3.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.790016754010169
Encrypted:	false
SSDEEP:	96:iaqkHfZ6+6c5ih/cI9URLl8RotofMFVvlwhMe4IbONIeTC6XQS0qGqk+Z4uj+rj1:akRKxeiRUgh86qRAq1k8SPxVLZ7VTiq
MD5:	5168BC5CEA694D443D34B466D6D3B7DA
SHA1:	F619451562C1ED43B210518D9859292DB90B0154
SHA-256:	AEAC1349E63282B5191FA3CC3AD2528E93A7CFD92934B9F23CFAA1E7005DCD8A
SHA-512:	EF655A7760ED1E7620F87B1A4348BABEFBB6D2812E4AE095B68F369A44E4D9EB465408A37BA9B3E737320273BAAA78FFCBF79A0C6E2EA4ADC182472DB40C06EB
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAADgzkluQHrwTIT+m1rkijeAEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAD0mYqszp5OhOKySmNJd4jyMe12cNXAXOszreVM2ov6hAAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\840eff24-4fa6-4ceb-9e69-52b73c5d0332.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	28965
Entropy (8bit):	6.051393784776583
Encrypted:	false
SSDEEP:	768:IM7X2zt1jOXtXi3zahcOAG92eAXzqMp/6yac7GT:IMSzMtXija+57XzdJ6JoGT
MD5:	AB1DBE1D6604C74A25A13162D1D0DAC4
SHA1:	73F84894BB61C3F7C24AE975A630B6CEB86AD6C7
SHA-256:	6FE25D9F4F1F813AE5D3E4812BF01BA34A154B7944D8FE8DCFDD9DF52ECF18D7
SHA-512:	73EBF1ECDC668AB48C37B3226F28FEC34A3E9674C12613405B4DA7636197D32DCE3C68CA9C73698F4596DE8ACCB4A97A0212B3A2B75C942E16B28ED95D5BF032
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13365809832396644","browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\375674c8-ee76-4ef6-9674-5abba0a1d0bf.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640152892265458
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7s:fwUQC5VwBIiElEd2K57P7s
MD5:	21CD56820995C4514E60CF6C82134DFC
SHA1:	A474999736344AA8AEA008407B41931EEBD8DCAD
SHA-256:	98615125BD47487A65491F2C4A8EE0C4B5292D510883CE63CE6B7EA1A4CDF1C8
SHA-512:	81135B67AAE29842C59867D614923BE960D2B69AFABEBC2694D86E39C6CCAEBA789BE9EA3245E67418378E8754674B638502FFC77D7ED1C9A6F1C64DF4525969
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640152892265458
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7s:fwUQC5VwBIiElEd2K57P7s
MD5:	21CD56820995C4514E60CF6C82134DFC
SHA1:	A474999736344AA8AEA008407B41931EEBD8DCAD
SHA-256:	98615125BD47487A65491F2C4A8EE0C4B5292D510883CE63CE6B7EA1A4CDF1C8
SHA-512:	81135B67AAE29842C59867D614923BE960D2B69AFABEBC2694D86E39C6CCAEBA789BE9EA3245E67418378E8754674B638502FFC77D7ED1C9A6F1C64DF4525969
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-669981A5-1E5C.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.033198690476999984
Encrypted:	false
SSDEEP:	192:cb01utmqvDYKHjJviaVRaahMIMKgo0XV/oSEPhkVNEUxfIRQcTo:00EthEzghQhc3o
MD5:	19AFAD5D43EE2AF6C570C790D13CEBAC
SHA1:	B89490130C2DAD30BCBD58F0AAA136FD004E4A6C
SHA-256:	97C15F5D34016BE9E5AF9C7C298551F6E81FEFADE78E66EC192F85102E31BEB2
SHA-512:	754FA8B08A7BCCC63E4DA815276081C980D475CDF5A88BB18FEF46DC2994D061F51998ED7CA591DC65628BAEA606AF1FEE849DE2C023FC6AA53069ED4EA3F81C
Malicious:	false
Preview:	...@..@...@.....C.].....@................Q..@Q..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30....m.........117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".hqmmil20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@............./......................w..U].0r.....>.........."....."...2..."..:............B)..1.3.147.37.. .*.RegKeyNotFound2.windowsR...Z.....K7..E@..$...SF@.......Y@.......Y@.......Y@........?........?.................?.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@................Y@.......Y@.......Y@........?........?z...............................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-669981A6-1628.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.3322151424540386
Encrypted:	false
SSDEEP:	3072:z1vwf/oQi0oiMjDxINzJuhl4NrqjD7kK+edHGAnrupBO/rWrqNZdqpRcMbKfzfjc:+HRi+E7cedV9ZNvLNaHPJ1d
MD5:	9DA49655A7EC02B4A7224172A03B6FB7
SHA1:	F11C917772088F073B7591C0E0C1813896C3E5C6
SHA-256:	114B939137AE13B74EBBB3ECAF6E8F96D8DBBB3642988EC74985A1E3CB79A1CC
SHA-512:	1197B147F6D72EB8274829DF5BF1139BE9C58BE7E0DE61BB4442B23B01B0FEA9F9510140131EDF231DB24563BFAD110AE380E04D775518F4EAFDE73054D4D506
Malicious:	false
Preview:	...@..@...@.....C.].....@...................h...............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB*...Windows NT..10.0.190452....x86_64..?........".hqmmil20,1(.0..8..B....(.....10.0.19041.5462.Google Inc. (Google):bANGLE (Google, Vulkan 1.3.0 (SwiftShader Device (Subzero) (0x0000C0DE)), SwiftShader driver-5.0.0)M..BU..Be...?j...GenuineIntel... .. ..............x86_64...J../T...^o..J...Y...^o..J..w....^o..J..A....^o..J....c..^o..J...c=..^o..J....J..^o..J..3.(..^o..J.......^o..J...#...^o..J....k..^o..J....-..^o..J..S..O.^o..J..l.zL.^o..J..1.9..^o..J..@."..^o..J..?U...^o..J..aV...^o..J..z{...^o..J..n....^o..J..0....^o..J...@...^o..J...I.r.^o..J......^o..J..ZK...^o..J.....^o..J..@N...^o..J.......^o..J...'x#.^o..J......^o..J....\.^o..J.....f.^o.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-669981C0-2014.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.04663266440160322
Encrypted:	false
SSDEEP:	192:MG5d01utmCnOA7YxJdnBhr2qbtXWugXtqhgkNEm7ITMv1gQl2htK70Bn8y08TcmQ:Mud0Etlgr2iKchVlNg0itQA08T2RGOD
MD5:	DC40EE9889B7B1598322661AAE249242
SHA1:	1C32292978ED76726386E6AB1C6A684F461CA86D
SHA-256:	0347BCCC5921A5756D798C998674BB3E78477BCC6FCD54C450E56B4EAFBCEEC4
SHA-512:	7E9130A22792E3DCA69E6A48A0E17CCAD2BDF3C279A7E64CFFC11466BF48982F5A62FD19F53FB8B26CDA0B447B936631238218FA8BBB75085897DA20159A1C33
Malicious:	false
Preview:	...@..@...@.....C.].....@................g...V..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".hqmmil20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@............./......................w..U].0r........>.........."....."...24.."."zcfFUpV2gaxB0aMn/x6xBVY/lOH2Cxg6yztf2vvrX6Q=".:............B)..1.3.147.37.. .*.RegKeyNotFound2.windowsR...Z.....K7..E@..$...SF@.......Y@.......4@.......Y@........?........?.........................Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......4@.......Y@................Y@.......Y@.......Y@........?........?2........9...... .2.......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.3553968406659012
Encrypted:	false
SSDEEP:	12:biUXhV0xosU8xCe+JKlkQuMRxCb8ZXfgYJ0IJpP0KLsyW1L7Fx6:bFRqxosU8xWMk8xVZ4YWI30otWn
MD5:	CFAB81B800EDABACBF6CB61AA78D5258
SHA1:	2730D4DA1BE7238D701DC84EB708A064B8D1CF27
SHA-256:	452A5479B9A2E03612576C30D30E6F51F51274CD30EF576EA1E71D20C657376F
SHA-512:	EC188B0EE4D3DAABC26799B34EE471BEE988BDD7CEB011ED7DF3D4CF26F98932BBBB4B70DC2B7FD4DF9A3981B3CE22F4B5BE4A0DB97514D526E521575EFB2EC6
Malicious:	false
Preview:	...@.@...@..............@...................................`... ...i.y.........CrashpadMetrics.....i.y..Yd.h.......A.......e............,.........W.......................W....................Microsoft.UMA.PersistentAllocator.CrashpadMetrics.UsedPct.......h...i.y.[".................................!...&...+...0...6...;...@...E...K...P...U...Z...`...e...........i.y..Yd.........A............................E.[4.f..................E.[4.f.................Microsoft.UMA.PersistentAllocator.CrashpadMetrics.Errors............i.y..Yd.........A..................._..-`....h-.....................h-....................Crashpad.HandlerLifetimeMilestone.......0...i.y.[".........................................i.y..Yd.@.......C...........................VM....],................WM....],................Stability.BrowserExitCodes...... ...i.y......VM....],........H...i.y.1U!S............................................................ ...i.y...0...WM....],........................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	4.186545639374753
Encrypted:	false
SSDEEP:	3:FiWWltl/9g6gzST5kgBX/wBVP/Sh/JzvLi2RRIxINXj1jtll:o1/hgzSTfBX/wBVsJDG2Yq
MD5:	A3BE17A3170163A4E3501DADB518C3A7
SHA1:	C873EF3FE76ABB275DD8BD350BF10D5D3A09C128
SHA-256:	C96DEE56B5C3C792B579CBC84EF956731E4554DEDAA2F4E88BD660CDC0BBD01D
SHA-512:	401D4E7937422DE0CCD987B33C33E0D5D3A992229EE630C84B0CE4907C138693F5FA216E35AD173A16783697ADBD1E3F567C35BCC46DDFA923B9AA4286F10191
Malicious:	false
Preview:	sdPC......................5.y&.K.?...."zcfFUpV2gaxB0aMn/x6xBVY/lOH2Cxg6yztf2vvrX6Q="..................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................48ea0ba2-e9bb-4568-92cb-0f42a5c5d505............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\04047fb3-3fe5-4b54-85f7-68e2f697960c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9296
Entropy (8bit):	5.174930392123509
Encrypted:	false
SSDEEP:	96:sVMqlFJ10b9FS99oX354uaF2O9Yd4rY/sY5Th6Cp9/x+6M8muecmAeC4ze4zvrM/:sVMqJ+M9oZAFH+dsY/sYPpj+FVAcMFBf
MD5:	4C10C1974C10AA71EC6AFB48E71B8D64
SHA1:	52D6EAF11A271E75EBF34DF15EDD5DB1FC42A6DF
SHA-256:	1A8A124AE5149F70036F130E506B6596D55279E8E3E1E3ED17B4566C1E1DF15D
SHA-512:	541BA6961A590A08A66F6428BD5B60DB59586C9A828041346E129219027098AE3868BE9F07213B5322F23CF93FFDC009B42C45DE437D0EFA0B89735B9D01A736
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13365809832360009","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","5826"],"daily_received_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\107f7775-5276-4755-8c02-acff780dc041.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\108fb03e-afec-4f74-8233-586402df2be1.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	30210
Entropy (8bit):	5.565458873960217
Encrypted:	false
SSDEEP:	768:4t+ohQ7pLGL74JWPukffX8F1+UoAYDCx9Tuqh0VfUC9xbog/OVJaiM1zPrwrEpFa:4t+ohcc74JWPukffXu1jaMai6z8rKtU
MD5:	A84C529BA06C4063669F0E708D86C887
SHA1:	3038B396BC30275FE9F3C073957BE422BDDA9BE7
SHA-256:	883C70866C2937C8D7C3F4937A055DAFDB89A974F2EC1C7356DB0393CE134F71
SHA-512:	A4BBE015EFB22A5C53261594AAC38B1F2C4CA97745674110539885FC5F22B2DFACA0F67FEC34CE0F0D965F28171A291DB4542DE1CB498FAA9899075AE0ADEB0E
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13365809831850764","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13365809831850764","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\216e4c66-e5f3-451f-812e-0e1f01635671.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9224
Entropy (8bit):	5.175128795612422
Encrypted:	false
SSDEEP:	96:sVMqlFJ10b9FS99oX354uaF2O9Yd4rY/sY5Th6Cp9/x+6M8muecmAeCfe4zvrM24:sVMqJ+M9oZAFH+dsY/sYPpj+FVA/MFBf
MD5:	5E5A3FFCE4EAD1C73554772392DF7DF3
SHA1:	F100EC4336F9B6F2F770C976E7200638EE95DFD8
SHA-256:	74928945110FA15C9CCBEE0C3B0DA5ED6922CF5942F50CFCE7E0F35D9E44C1E2
SHA-512:	F12070874F32A36F0AD6C98317FC1C7847B4FDCFEBC299431F28D453036DCE79003EC761E21B7088DD30D2657C874280982B9F32CC245B6852E53430DD5C718F
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13365809832360009","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","5826"],"daily_received_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\3993802a-2391-4f4b-874d-eb4e2bc39900.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	28366
Entropy (8bit):	5.557865770416011
Encrypted:	false
SSDEEP:	768:4t+ohQ7pLGL74JWPukfAX8F1+UoAYDCx9Tuqh0VfUC9xbog/OVJM1zPrwKEpFtuM:4t+ohcc74JWPukfAXu1jaA6z8KKtD
MD5:	E6DC7EDC5AEEBFC9863F78944A45E435
SHA1:	668F6F551725FABC69E33FF29BE64ABFBA8A7FC1
SHA-256:	6B881756AFAEE6B1835F3018004260456606D06B3D825B0D154290B40FAB031D
SHA-512:	9B63CCB5D7AA36A1E49F707F3E400EB25C9D191E8E8C93DC15CBBF1D71857AE4DF177FAD27E8D736F82C68DBBAB080A88953074FC1FA29A2863EDE84944C8038
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13365809831850764","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13365809831850764","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\6e031063-f8bf-4ec6-9b17-d1b653164964.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	8569
Entropy (8bit):	5.061215461321853
Encrypted:	false
SSDEEP:	96:sVMqlFJ10b9FS99oX3548Y/sY5Th6Cp9/x+6M8muecmAeCCe4zvrM2X6gE5AtEHb:sVMqJ+M9oZXY/sYPpj+FVAEMFBf
MD5:	199D96CFFE298F44B1C923D9636070E8
SHA1:	D744EBF095A797970308C39EE71FB0E7981D4BCE
SHA-256:	E2E21FE42C8E44A25C72F97497F18C34585FB540B60C079969D6BE28BA52953D
SHA-512:	DB4A2D82F63819757FEEB748B32DF21174CB0663D8BE90509F3ED727404B91F37591E0EEE98F9DB721FEE80F38FA16FDBB42D74032B2CAA33D5ADABC04B97D78
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13365809832360009","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","5826"],"daily_received_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	12600
Entropy (8bit):	5.321550282360608
Encrypted:	false
SSDEEP:	192:uAOEH/WCxkD7MDPSYAxmemxb7mngJdv9TXJ4MQmLu5/4eeNdl:ROEOKSXs/J7mGnQmLu5/5eNdl
MD5:	D5B4D280DD41A9BBD096ACDB6FCF209C
SHA1:	235106EAFDD2DB42C2A5AF07F4984D68E4151A28
SHA-256:	1610CAF777765162A7EF2709F88B6CE0A98F8FF55C974BB19E0F84D2166D2055
SHA-512:	F5C97954FC46D0B0489178877969D0CD5FCBBF2491471A452DDDB3E467DED3DF5FF28AC3775E94F9A1B91663FCBC5C17C218752E86B5DBC3AC2E4916AB0AE083
Malicious:	false
Preview:	...m.................DB_VERSION.1....................QUERY_TIMESTAMP:arbitration_priority_list4...13365809834982979.$QUERY:arbitration_priority_list4....[{"name":"arbitration_priority_list","url":"https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?assetgroup=ArbitrationService","version":{"major":4,"minor":0,"patch":5},"hash":"2DPW9BV28WrPpgGHdKsEvldNQvD7dA0AAxPa3B/lKN0=","size":11989}]..A./..............'ASSET_VERSION:arbitration_priority_list.4.0.5..ASSET:arbitration_priority_list.]{.. "configVersion": 32,.. "PrivilegedExperiences": [.. "ShorelinePrivilegedExperienceID",.. "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT",.. "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND",.. "SHOPPING_AUTO_SHOW_BING_SEARCH",.. "SHOPPING_AUTO_SHOW_REBATES",.. "SHOPPING_AUTO_SHOW_REBATES_CONFIRMATION",.. "SHOPPING_AUTO_SHOW_REBATES_DEACTIVATED",.. "SHOPPING_AUTO_SHOW_REBATES_BING",.. "SHOPPING_AUTO_SHOW_REBATES_ORGANIC",.. "SHOPPING_AUTO_SHOW_PRICE_HIST

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	293
Entropy (8bit):	5.160318313357059
Encrypted:	false
SSDEEP:	6:BzBss1wkn23oH+Tcwt9Eh1ZB2KLlrJAq2Pwkn23oH+Tcwt9Eh1tIFUv:1WLfYeb9Eh1ZFLcvYfYeb9Eh16FUv
MD5:	0072EFCFB4CDC342D6D6AC97F7F3BBA9
SHA1:	B861D6F8D01967ED78AFEFA526EFEF71D27FF3AF
SHA-256:	AB93C54525F3ABDCA66B78DE3202422CAF98D635F03A9BCDE15268939C02643D
SHA-512:	FD5FB372572ABA92FB4311464115AE242DA60030722E152FFD37AC02D805A773C096CD675F59563E608949AA6D8E53591D0A2B6C4C560244169EFA303C46A6DC
Malicious:	false
Preview:	2024/07/18-16:57:13.625 16b0 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db since it was missing..2024/07/18-16:57:14.293 16b0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AssistanceHome\AssistanceHomeSQLite

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	0.3202460253800455
Encrypted:	false
SSDEEP:	6:l9bNFlEuWk8TRH9MRumWEyE4gLueXdNOmWxFxCxmWxYgCxmW5y/mWz4ynLAtD/W4:TLiuWkMORuHEyESeXdwDQ3SOAtD/ie
MD5:	40B18EC43DB334E7B3F6295C7626F28D
SHA1:	0E46584B0E0A9703C6B2EC1D246F41E63AF2296F
SHA-256:	85E961767239E90A361FB6AA0A3FD9DAA57CAAF9E30599BB70124F1954B751C8
SHA-512:	8BDACDC4A9559E4273AD01407D5D411035EECD927385A51172F401558444AD29B5AD2DC5562D1101244665EBE86BBDDE072E75ECA050B051482005EB6A52CDBD
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DawnCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DawnCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DawnCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DawnCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlxLl:Ls3xl
MD5:	1CF0F938282C3F975E844213B08DEB48
SHA1:	7D400653A485C30C14744F8C50BFDC94AB1C2ABE
SHA-256:	9C35B2A77C86ABC9F80CA8ABBFD1DA03779AE26F448F38A6528F4185661D8F76
SHA-512:	2DD65F71F95672BD8CD2496E5998B618B913A7852373FFA1232B64F6D45E06F8335BE797060962173B6E9494FF05ECECEB909FE580AF2812395C0590D6684702
Malicious:	false
Preview:	........................................~l6."\|/.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	3.5394429593752084
Encrypted:	false
SSDEEP:	3:iWstvhYNrkUn:iptAd
MD5:	F27314DD366903BBC6141EAE524B0FDE
SHA1:	4714D4A11C53CF4258C3A0246B98E5F5A01FBC12
SHA-256:	68C7AD234755B9EDB06832A084D092660970C89A7305E0C47D327B6AC50DD898
SHA-512:	07A0D529D9458DE5E46385F2A9D77E0987567BA908B53DDB1F83D40D99A72E6B2E3586B9F79C2264A83422C4E7FC6559CAC029A6F969F793F7407212BB3ECD51
Malicious:	false
Preview:	...m.................DB_VERSION.1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	305
Entropy (8bit):	5.203360200382513
Encrypted:	false
SSDEEP:	6:BmXbF+q1wkn23oH+TcwtnG2tbB2KLlrb+q2Pwkn23oH+TcwtnG2tMsIFUv:QAfYebn9VFLMvYfYebn9GFUv
MD5:	D4F880FB4C99B277437F3BEBC76542CF
SHA1:	62550D9AE2B11A27480EF15A900B489EB54CF069
SHA-256:	245CA2E4C243E17FFD0ACE56473A0694705317B2181921BD55F2150599155680
SHA-512:	1933ACD4B619666E3DD47A0B94990C33301677964612D392439F93075D3E20FD9AC4D54092642B8729FC6D53C014D313191A22361D8D0D357110FE9A93E84B48
Malicious:	false
Preview:	2024/07/18-16:57:11.981 1e18 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db since it was missing..2024/07/18-16:57:12.020 1e18 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeEDrop\EdgeEDropSQLite.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 14, database pages 8, cookie 0xe, schema 4, UTF-8, version-valid-for 14
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.494709561094235
Encrypted:	false
SSDEEP:	24:TLEC30OIcqIn2o0FUFlA2cs0US5S693Xlej2:ThLaJUnAg0UB6I
MD5:	CF7760533536E2AF66EA68BC3561B74D
SHA1:	E991DE2EA8F42AE7E0A96A3B3B8AF87A689C8CCD
SHA-256:	E1F183FAE5652BA52F5363A7E28BF62B53E7781314C9AB76B5708AF9918BE066
SHA-512:	38B15FE7503F6DFF9D39BC74AA0150A7FF038029F973BE9A37456CDE6807BCBDEAB06E624331C8DFDABE95A5973B0EE26A391DB2587E614A37ADD50046470162
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...i............t...c................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 5, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5094712832659277
Encrypted:	false
SSDEEP:	12:TLW4QpRSJDBJuqJSEDNvrWjJQ9Dl9np59yDLgHFUxOUDaaTXubHa7me5q4iZ7dV:TLqpR+DDNzWjJ0npnyXKUO8+j25XmL
MD5:	D4971855DD087E30FC14DF1535B556B9
SHA1:	9E00DEFC7E54C75163273184837B9D0263AA528C
SHA-256:	EC7414FF1DB052E8E0E359801F863969866F19228F3D5C64F632D991C923F0D2
SHA-512:	ACA411D7819B03EF9C9ACA292D91B1258238DF229B4E165A032DB645E66BFE1148FF3DCFDAC3126FCD34DBD0892F420148E280D9716C63AD9FCDD9E7CA58D71D
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...%.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	209
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	3:FQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlX:qTCTCTCTCTCTCTCTCTCTCT
MD5:	478D49D9CCB25AC14589F834EA70FB9E
SHA1:	5D30E87D66E279F8815AFFE4C691AAF1D577A21E
SHA-256:	BB6CC6DF54CF476D95409032C79E065F4E10D512E73F7E16018E550456F753D5
SHA-512:	FB5431054A23D3C532568B1F150873D9130DBC4A88BE19BC2A4907D0DC2888C5B55993154EAD4A6C466E2173092B8705684A6802B850F051639E1F2457387471
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	281
Entropy (8bit):	5.202831250876456
Encrypted:	false
SSDEEP:	6:BmSn1wkn23oH+Tcwt8aVdg2KLlrVP3+q2Pwkn23oH+Tcwt8aPrqIFUv:3mfYeb0LLP+vYfYebL3FUv
MD5:	2E98B2D249B3FA0999DB3E5CA876EB01
SHA1:	860872BD0D999CC7D13F4A63A57C5D0997B5DA80
SHA-256:	A7E698807DBC854DA91269412F5654AEB96185AC5FA02DAB9EDE7B1B6E7CF17F
SHA-512:	5668672E4827F05BCEE2A674281E513268F28CCA63279AE0E81AF23FAE0D02DADBDD13CB045DA2950B8149B62E5745900DAEF5D1845CDCE97547CF13005270A7
Malicious:	false
Preview:	2024/07/18-16:57:11.979 1d7c Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules since it was missing..2024/07/18-16:57:12.048 1d7c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	209
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	3:FQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlX:qTCTCTCTCTCTCTCTCTCTCT
MD5:	478D49D9CCB25AC14589F834EA70FB9E
SHA1:	5D30E87D66E279F8815AFFE4C691AAF1D577A21E
SHA-256:	BB6CC6DF54CF476D95409032C79E065F4E10D512E73F7E16018E550456F753D5
SHA-512:	FB5431054A23D3C532568B1F150873D9130DBC4A88BE19BC2A4907D0DC2888C5B55993154EAD4A6C466E2173092B8705684A6802B850F051639E1F2457387471
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.179403470718703
Encrypted:	false
SSDEEP:	6:B12FD1wkn23oH+Tcwt86FB2KLlr5413+q2Pwkn23oH+Tcwt865IFUv:P2FyfYeb/FFLL413+vYfYeb/WFUv
MD5:	D1A27B4910FBD3D3C2E7A10439EE1171
SHA1:	DB75CB37B99B7F3C67B6E05594C0BD6B1D5E008A
SHA-256:	D4DAC99BB0385E975956342B16FE28B40FE1406074D9A0827E89D157450788C4
SHA-512:	96C8438780841B2E70455F450BB9D5370D8FF0B6900C5C2E6D6DCE9E6BC3E848D0A343872705845A0046A0015AE6B22D18326A0A15D2F2889671635616734846
Malicious:	false
Preview:	2024/07/18-16:57:12.050 1d7c Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts since it was missing..2024/07/18-16:57:12.098 1d7c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1197
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	12:qWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWW:
MD5:	A2A3B1383E3AAC2430F44FC7BF3E447E
SHA1:	B807210A1205126A107A5FE25F070D2879407AA4
SHA-256:	90685D4E050DA5B6E6F7A42A1EE21264A68F1734FD3BD4A0E044BB53791020A2
SHA-512:	396FAB9625A2FF396222DBC86A0E2CDE724C83F3130EE099F2872AED2F2F2ECE13B0853D635F589B70BD1B5E586C05A3231D68CAF9E46B6E2DAC105A10D0A1C8
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.195996297012913
Encrypted:	false
SSDEEP:	6:BPWQL+q2Pwkn23oH+Tcwt8NIFUt84PWGKWZmw+4pQLVkwOwkn23oH+Tcwt8+eLJ:9+vYfYebpFUt8AKW/+7V5JfYebqJ
MD5:	7CE9A22E40C53AB7A823A82B164B2D29
SHA1:	1D233543828205F925447686DA24C2A327716B27
SHA-256:	4A4C2676481F60BC5F3FD5CB5E4326956EF7D44DCBA04F2DBC3317841E2EF19F
SHA-512:	14EBF6FD7ED6E043B1D945FF319F73E55F52864C0606FE0B04045F281CA5012DE077A756A13C326C92FF2C7B4E5C818500EA8F5C447B79D59108FE6BF1D524D1
Malicious:	false
Preview:	2024/07/18-16:57:12.625 1cec Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/07/18-16:57:12.625 1cec Recovering log #3.2024/07/18-16:57:12.626 1cec Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.195996297012913
Encrypted:	false
SSDEEP:	6:BPWQL+q2Pwkn23oH+Tcwt8NIFUt84PWGKWZmw+4pQLVkwOwkn23oH+Tcwt8+eLJ:9+vYfYebpFUt8AKW/+7V5JfYebqJ
MD5:	7CE9A22E40C53AB7A823A82B164B2D29
SHA1:	1D233543828205F925447686DA24C2A327716B27
SHA-256:	4A4C2676481F60BC5F3FD5CB5E4326956EF7D44DCBA04F2DBC3317841E2EF19F
SHA-512:	14EBF6FD7ED6E043B1D945FF319F73E55F52864C0606FE0B04045F281CA5012DE077A756A13C326C92FF2C7B4E5C818500EA8F5C447B79D59108FE6BF1D524D1
Malicious:	false
Preview:	2024/07/18-16:57:12.625 1cec Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/07/18-16:57:12.625 1cec Recovering log #3.2024/07/18-16:57:12.626 1cec Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\ExtensionActivityComp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 1, cookie 0x1, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	0.3169096321222068
Encrypted:	false
SSDEEP:	3:lSWbNFl/sl+ltl4ltllOl83/XWEEabIDWzdWuAzTgdWj3FtFIU:l9bNFlEs1ok8fDEPDadUTgd81Z
MD5:	2554AD7847B0D04963FDAE908DB81074
SHA1:	F84ABD8D05D7B0DFB693485614ECF5204989B74A
SHA-256:	F6EF01E679B9096A7D8A0BD8151422543B51E65142119A9F3271F25F966E6C42
SHA-512:	13009172518387D77A67BBF86719527077BE9534D90CB06E7F34E1CCE7C40B49A185D892EE859A8BAFB69D5EBB6D667831A0FAFBA28AC1F44570C8B68F8C90A4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\ExtensionActivityEdge

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 8, cookie 0x8, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.40981274649195937
Encrypted:	false
SSDEEP:	24:TL1WK3iOvwxwwweePKmJIOAdQBVA/kjo/TJZwJ9OV3WOT/5eQQ:Tmm+/9ZW943WOT/
MD5:	1A7F642FD4F71A656BE75B26B2D9ED79
SHA1:	51BBF587FB0CCC2D726DDB95C96757CC2854CFAD
SHA-256:	B96B6DDC10C29496069E16089DB0AB6911D7C13B82791868D583897C6D317977
SHA-512:	FD14EADCF5F7AB271BE6D8EF682977D1A0B5199A142E4AB353614F2F96AE9B49A6F35A19CC237489F297141994A4A16B580F88FAC44486FCB22C05B2F1C3F7D1
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j............M.....8...b..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\computed_hashes.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	429
Entropy (8bit):	5.809210454117189
Encrypted:	false
SSDEEP:	6:Y8U0vEjrAWT0VAUD9lpMXO4SrqiweVHUSENjrAWT0HQQ9/LZyVMQ3xqiweVHlrSQ:Y8U5j0pqCjJA7tNj0pHx/LZ4hcdQ
MD5:	5D1D9020CCEFD76CA661902E0C229087
SHA1:	DCF2AA4A1C626EC7FFD9ABD284D29B269D78FCB6
SHA-256:	B829B0DF7E3F2391BFBA70090EB4CE2BA6A978CCD665EEBF1073849BDD4B8FB9
SHA-512:	5F6E72720E64A7AC19F191F0179992745D5136D41DCDC13C5C3C2E35A71EB227570BD47C7B376658EF670B75929ABEEBD8EF470D1E24B595A11D320EC1479E3C
Malicious:	false
Preview:	{"file_hashes":[{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","6RbL+qKART8FehO4s7U0u67iEI8/jaN+8Kg3kII+uy4=","CuN6+RcZAysZCfrzCZ8KdWDkQqyaIstSrcmsZ/c2MVs="],"block_size":4096,"path":"content.js"},{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","UL53sQ5hOhAmII/Yx6muXikzahxM+k5gEmVOh7xJ3Rw=","u6MdmVNzBUfDzMwv2LEJ6pXR8k0nnvpYRwOL8aApwP8="],"block_size":4096,"path":"content_new.js"}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 39, 1st free page 10, free pages 4, cookie 0x45, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.5241404324800358
Encrypted:	false
SSDEEP:	96:56U+bGzPDLjGQLBE3up+U0jBo4tgi3JMe9xJDECVjN:5R+GPXBBE3upb0HtTTDxVj
MD5:	241322143A01979D346689D9448AC8C0
SHA1:	DD95F97EE1CCB8FD9026D2156DE9CB8137B816D1
SHA-256:	65EEBDEC4F48A111AC596212A1D71C3A5CFA996797500E5344EEABDFA02527C8
SHA-512:	9C7241462A9DADEF25D8EEB1C14BABFBA65C451EBAFBC068B9856E4EF0EB6F894A44686CBB0D1F46C7F546335D0C53A3E386E6C1A017082DE127F8F9C0A54BD2
Malicious:	false
Preview:	SQLite format 3......@ .......'...........E......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	0.3275668640251306
Encrypted:	false
SSDEEP:	6:WA/J3+t76Y4QZZofU99pO0BYySqR4EZY4QZvGZ:XhHQws9LdLZBQZGZ
MD5:	C284F973DCD54479B110A91B52A52862
SHA1:	61448EF25E9C6DDE775F82E2E67CACD56712FC20
SHA-256:	7DCBEF0BA3EFEC58935C61C69A549F9F7012F5435E8F5B5DDFB1C80DA6651596
SHA-512:	5D1A8A6FE416F0A8F2ABFF8F4FBEEE6A6D18A3B70002A9EA6A2D143D963034BBFC45D83214729F4886CE18F30047996B3E6DB383E20B214DA55D8EB71C0824F1
Malicious:	false
Preview:	..............5*...'....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps Icons

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.33890226319329847
Encrypted:	false
SSDEEP:	12:TLMfly7aoxrRGcAkSQdC6ae1//fxEjkE/RFL2iFV1eHFxOUwa5qgufTsZ75fOSI:TLYcjr0+Pdajk+FZH1W6UwccI5fBI
MD5:	971F4C153D386AC7ED39363C31E854FC
SHA1:	339841CA0088C9EABDE4AACC8567D2289CCB9544
SHA-256:	B6468DA6EC0EAE580B251692CFE24620D39412954421BBFDECB13EF21BE7BC88
SHA-512:	1A4DD0C2BE163AAB3B81D63DEB4A7DB6421612A6CF1A5685951F86B7D5A40B67FC6585B7E52AA0CC20FF47349F15DFF0C9038086E3A7C78AE0FFBEE6D8AA7F7E
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...:.8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	406
Entropy (8bit):	5.298444155792772
Encrypted:	false
SSDEEP:	12:5FUzvYfYeb8rcHEZrELFUt8D/+Z5JfYeb8rcHEZrEZSJ:boYfYeb8nZrExg8iJfYeb8nZrEZe
MD5:	CDFE7B848A3F4835922EBE2CAC071C1E
SHA1:	68B3F25801973DCE4498FE3D16447636681FF2D5
SHA-256:	F8CF295E15A9CF278D22726D576FFE8FDBE421046F501B002B9D7AD6593CB374
SHA-512:	A2283E44525103CA8D1C56238B93269290371F42AB09BC2DDA902A003725859217B22EF63AC67F81FACBD8A9CF1A6E42E7355F0AC37193EB58F8442A4DD2C329
Malicious:	false
Preview:	2024/07/18-16:57:13.424 1e20 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/07/18-16:57:13.425 1e20 Recovering log #3.2024/07/18-16:57:13.425 1e20 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	406
Entropy (8bit):	5.298444155792772
Encrypted:	false
SSDEEP:	12:5FUzvYfYeb8rcHEZrELFUt8D/+Z5JfYeb8rcHEZrEZSJ:boYfYeb8nZrExg8iJfYeb8nZrEZe
MD5:	CDFE7B848A3F4835922EBE2CAC071C1E
SHA1:	68B3F25801973DCE4498FE3D16447636681FF2D5
SHA-256:	F8CF295E15A9CF278D22726D576FFE8FDBE421046F501B002B9D7AD6593CB374
SHA-512:	A2283E44525103CA8D1C56238B93269290371F42AB09BC2DDA902A003725859217B22EF63AC67F81FACBD8A9CF1A6E42E7355F0AC37193EB58F8442A4DD2C329
Malicious:	false
Preview:	2024/07/18-16:57:13.424 1e20 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/07/18-16:57:13.425 1e20 Recovering log #3.2024/07/18-16:57:13.425 1e20 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.204538612448227
Encrypted:	false
SSDEEP:	6:But+q2Pwkn23oH+Tcwt8a2jMGIFUt84r5Zmw+49kFNVkwOwkn23oH+Tcwt8a2jM4:lvYfYeb8EFUt8I/+CI5JfYeb8bJ
MD5:	4F14F7743308BAA03CA75E2F6CAECF7B
SHA1:	E8DA1FD116CC9F28C484CEBF72E364A13013A426
SHA-256:	6FD70221DE13EF61E152A04202E61029E8CB35005449A69D7F7B4A1F8EC0E579
SHA-512:	9303971573A40CE688934D755775B08AA0E126569E730B053C075D959FD85216A1A40169B000F63A38967A66928FA3F24618B2CD61AD69ABFFC14925505E4D11
Malicious:	false
Preview:	2024/07/18-16:57:12.282 1e48 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/07/18-16:57:12.283 1e48 Recovering log #3.2024/07/18-16:57:12.286 1e48 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.204538612448227
Encrypted:	false
SSDEEP:	6:But+q2Pwkn23oH+Tcwt8a2jMGIFUt84r5Zmw+49kFNVkwOwkn23oH+Tcwt8a2jM4:lvYfYeb8EFUt8I/+CI5JfYeb8bJ
MD5:	4F14F7743308BAA03CA75E2F6CAECF7B
SHA1:	E8DA1FD116CC9F28C484CEBF72E364A13013A426
SHA-256:	6FD70221DE13EF61E152A04202E61029E8CB35005449A69D7F7B4A1F8EC0E579
SHA-512:	9303971573A40CE688934D755775B08AA0E126569E730B053C075D959FD85216A1A40169B000F63A38967A66928FA3F24618B2CD61AD69ABFFC14925505E4D11
Malicious:	false
Preview:	2024/07/18-16:57:12.282 1e48 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/07/18-16:57:12.283 1e48 Recovering log #3.2024/07/18-16:57:12.286 1e48 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 28, cookie 0x1d, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	57344
Entropy (8bit):	0.863060653641558
Encrypted:	false
SSDEEP:	96:u7/KLPeymOT7ynlm+yKwt7izhGnvgbn8MouB6wznP:u74CnlmVizhGE7IwD
MD5:	C681C90B3AAD7F7E4AF8664DE16971DF
SHA1:	9F72588CEA6569261291B19E06043A1EFC3653BC
SHA-256:	ADB987BF641B2531991B8DE5B10244C3FE1ACFA7AD7A61A65D2E2D8E7AB34C1D
SHA-512:	4696BF334961E4C9757BAC40C41B4FBE3E0B9F821BD242CE6967B347053787BE54D1270D7166745126AFA42E8193AC2E695B0D8F11DE8F0B2876628B7C128942
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network Action Predictor

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 11, cookie 0x6, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	45056
Entropy (8bit):	0.40293591932113104
Encrypted:	false
SSDEEP:	24:TLVgTjDk5Yk8k+/kCkzD3zzbLGfIzLihje90xq/WMFFfeFzfXVVlYWOT/CUFSe:Tmo9n+8dv/qALihje9kqL42WOT/9F
MD5:	ADC0CFB8A1A20DE2C4AB738B413CBEA4
SHA1:	238EF489E5FDC6EBB36F09D415FB353350E7097B
SHA-256:	7C071E36A64FB1881258712C9880F155D9CBAC693BADCC391A1CB110C257CC37
SHA-512:	38C8B7293B8F7BEF03299BAFB981EEEE309945B1BDE26ACDAD6FDD63247C21CA04D493A1DDAFC3B9A1904EFED998E9C7C0C8E98506FD4AC0AB252DFF34566B66
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......=......\.t.+.>...,...=........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\418d0736-e296-4c1f-9ad2-38c44d4b9319.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	188
Entropy (8bit):	5.423404609678128
Encrypted:	false
SSDEEP:	3:YWRAWNjBSVVLTRn0xmuRA9E+L3x8HQXwlm9yJUA6XcIR6RX77XMqGwmvXjz2SQ:YWyWN1iL50xHA9vh8wXwlmUUAnIMp5sO
MD5:	6833E2FEEACF2930174137246FC7E09F
SHA1:	7707DD22D2CFD3C3B79D727C93AE1D3DFD90B307
SHA-256:	839EB286A9A424BFB655D9DA050BE4CAE90B3DE4894CFE1F352919B551F17C0C
SHA-512:	B987F42C327EA83EE824E0E9BBC2AE5727CBB3B8DF29659C7E11798E24D5F8A94A05644200B6B57754876050E805EEAB90A0DAC437296BFED54C49535AF133C0
Malicious:	false
Preview:	{"sts":[{"expiry":1727869700.805692,"host":"dUymlFcJcEIuWrPNRCRXYtREHxXDHdPfT47kO1IQnQ0=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1696333700.805702}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\54c308cd-41bf-49dc-a023-fb63911820d0.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKtiVY:YHpoeS7PMVKJTnMRK3VY
MD5:	285252A2F6327D41EAB203DC2F402C67
SHA1:	ACEDB7BA5FBC3CE914A8BF386A6F72CA7BAA33C6
SHA-256:	5DFC321417FC31359F23320EA68014EBFD793C5BBED55F77DAB4180BBD4A2026
SHA-512:	11CE7CB484FEE66894E63C31DB0D6B7EF66AD0327D4E7E2EB85F3BCC2E836A3A522C68D681E84542E471E54F765E091EFE1EE4065641B0299B15613EB32DCC0D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\5ccba08d-1636-4b76-b6d9-d1e2dd12eb64.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\88e0b574-f6b2-4102-8230-e8ba0e28580d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\8c66875b-1d79-4eaf-9763-584360ef63b8.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\9ff095fd-17d3-430a-8769-f88bcf658dd4.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	61
Entropy (8bit):	3.926136109079379
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LSL:YHpoeSL
MD5:	4DF4574BFBB7E0B0BC56C2C9B12B6C47
SHA1:	81EFCBD3E3DA8221444A21F45305AF6FA4B71907
SHA-256:	E1B77550222C2451772C958E44026ABE518A2C8766862F331765788DDD196377
SHA-512:	78B14F60F2D80400FE50360CF303A961685396B7697775D078825A29B717081442D357C2039AD0984D4B622976B0314EDE8F478CDE320DAEC118DA546CB0682A
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State~RF2d4f9.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	61
Entropy (8bit):	3.926136109079379
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LSL:YHpoeSL
MD5:	4DF4574BFBB7E0B0BC56C2C9B12B6C47
SHA1:	81EFCBD3E3DA8221444A21F45305AF6FA4B71907
SHA-256:	E1B77550222C2451772C958E44026ABE518A2C8766862F331765788DDD196377
SHA-512:	78B14F60F2D80400FE50360CF303A961685396B7697775D078825A29B717081442D357C2039AD0984D4B622976B0314EDE8F478CDE320DAEC118DA546CB0682A
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State~RF3c092.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	61
Entropy (8bit):	3.926136109079379
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LSL:YHpoeSL
MD5:	4DF4574BFBB7E0B0BC56C2C9B12B6C47
SHA1:	81EFCBD3E3DA8221444A21F45305AF6FA4B71907
SHA-256:	E1B77550222C2451772C958E44026ABE518A2C8766862F331765788DDD196377
SHA-512:	78B14F60F2D80400FE50360CF303A961685396B7697775D078825A29B717081442D357C2039AD0984D4B622976B0314EDE8F478CDE320DAEC118DA546CB0682A
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 4, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.555790634850688
Encrypted:	false
SSDEEP:	48:TsIopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSB:QIEumQv8m1ccnvS6
MD5:	0247E46DE79B6CD1BF08CAF7782F7793
SHA1:	B3A63ED5BE3D8EC6E3949FC5E2D21D97ACC873A6
SHA-256:	AAD0053186875205E014AB98AE8C18A6233CB715DD3AF44E7E8EB259AEAB5EEA
SHA-512:	148804598D2A9EA182BD2ADC71663D481F88683CE3D672CE12A43E53B0D34FD70458BE5AAA781B20833E963804E7F4562855F2D18F7731B7C2EAEA5D6D52FBB6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}.........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF2b125.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF2c162.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	203
Entropy (8bit):	5.4042796420747425
Encrypted:	false
SSDEEP:	6:YAQN1iL50xHA9vh8wXwlmUUAnIMp5sXX2SQ:Y45Sg9vt+UAnIXZQ
MD5:	24D66E5F1B8C76C76511DA68057CDE5E
SHA1:	70225FEC1AE3FEF8D8A767D9EA0B0E108BF8F10D
SHA-256:	D5CB3A4A104E2EC4F13E8B4CDF3BD469E0AB638713928BEA1EAEAF03998B794C
SHA-512:	1CA093B4BB4E0B3EE0B791AD0E6B39AC9640CEB6ED005BD10A10B4AF904858F4898D86D26B60B625CDA9425FF317C6B9FE0DF2E12C897A52720AF775B19491AA
Malicious:	false
Preview:	{"expect_ct":[],"sts":[{"expiry":1727869700.805692,"host":"dUymlFcJcEIuWrPNRCRXYtREHxXDHdPfT47kO1IQnQ0=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1696333700.805702}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity~RF2d509.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	203
Entropy (8bit):	5.4042796420747425
Encrypted:	false
SSDEEP:	6:YAQN1iL50xHA9vh8wXwlmUUAnIMp5sXX2SQ:Y45Sg9vt+UAnIXZQ
MD5:	24D66E5F1B8C76C76511DA68057CDE5E
SHA1:	70225FEC1AE3FEF8D8A767D9EA0B0E108BF8F10D
SHA-256:	D5CB3A4A104E2EC4F13E8B4CDF3BD469E0AB638713928BEA1EAEAF03998B794C
SHA-512:	1CA093B4BB4E0B3EE0B791AD0E6B39AC9640CEB6ED005BD10A10B4AF904858F4898D86D26B60B625CDA9425FF317C6B9FE0DF2E12C897A52720AF775B19491AA
Malicious:	false
Preview:	{"expect_ct":[],"sts":[{"expiry":1727869700.805692,"host":"dUymlFcJcEIuWrPNRCRXYtREHxXDHdPfT47kO1IQnQ0=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1696333700.805702}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 9, cookie 0x6, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.36515621748816035
Encrypted:	false
SSDEEP:	24:TLH3lIIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:Tb31DtX5nDOvyKDhU1cSB
MD5:	25363ADC3C9D98BAD1A33D0792405CBF
SHA1:	D06E343087D86EF1A06F7479D81B26C90A60B5C3
SHA-256:	6E019B8B9E389216D5BDF1F2FE63F41EF98E71DA101F2A6BE04F41CC5954532D
SHA-512:	CF7EEE35D0E00945AF221BEC531E8BF06C08880DA00BD103FA561BC069D7C6F955CBA3C1C152A4884601E5A670B7487D39B4AE9A4D554ED8C14F129A74E555F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......X..g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\f862dd1b-88e5-4030-97af-f57ae80dd3f4.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	881
Entropy (8bit):	5.304060439775176
Encrypted:	false
SSDEEP:	24:YXseZVMdBsSOiZFRudFGcskZFGJ/dbG7nby:YXsa8sSOWfcdscgzbZ
MD5:	AA7889AB23DE59116448E2237BE0E0C7
SHA1:	66E104E454CCD39FAEA34AA375F650A920542924
SHA-256:	B9A9E4F5EDC580D016A978042C590FD03F5E2F235CBCD61A03BB304BC7B81D68
SHA-512:	FA0C1A464245670285FB9E9A9EDDB4838544D6781802C45D34162F2553580C6F345FF224B38F3FB1485196F904086DE0CB4A668EC3E216C11FBB874C3893AFC7
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13368401833733678","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com"},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13368401834853508","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com"},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13368401839675451","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com"}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.46731661083066856
Encrypted:	false
SSDEEP:	12:TL1QAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3is25q0S9K0xHZ75fOV:TLiOUOq0afDdWec9sJf5Q7J5fc
MD5:	E93ACF0820CA08E5A5D2D159729F70E3
SHA1:	2C1A4D4924B9AEC1A796F108607404B000877C5D
SHA-256:	F2267FDA7F45499F7A01186B75CEFB799F8D2BC97E2E9B5068952D477294302C
SHA-512:	3BF36C20E04DCF1C16DC794E272F82F68B0DE43F16B4A9746B63B6D6BBC953B00BD7111CDA7AFE85CEBB2C447145483A382B15E2B0A5B36026C3441635D4E50C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	8569
Entropy (8bit):	5.061215461321853
Encrypted:	false
SSDEEP:	96:sVMqlFJ10b9FS99oX3548Y/sY5Th6Cp9/x+6M8muecmAeCCe4zvrM2X6gE5AtEHb:sVMqJ+M9oZXY/sYPpj+FVAEMFBf
MD5:	199D96CFFE298F44B1C923D9636070E8
SHA1:	D744EBF095A797970308C39EE71FB0E7981D4BCE
SHA-256:	E2E21FE42C8E44A25C72F97497F18C34585FB540B60C079969D6BE28BA52953D
SHA-512:	DB4A2D82F63819757FEEB748B32DF21174CB0663D8BE90509F3ED727404B91F37591E0EEE98F9DB721FEE80F38FA16FDBB42D74032B2CAA33D5ADABC04B97D78
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13365809832360009","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","5826"],"daily_received_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF32607.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	8569
Entropy (8bit):	5.061215461321853
Encrypted:	false
SSDEEP:	96:sVMqlFJ10b9FS99oX3548Y/sY5Th6Cp9/x+6M8muecmAeCCe4zvrM2X6gE5AtEHb:sVMqJ+M9oZXY/sYPpj+FVAEMFBf
MD5:	199D96CFFE298F44B1C923D9636070E8
SHA1:	D744EBF095A797970308C39EE71FB0E7981D4BCE
SHA-256:	E2E21FE42C8E44A25C72F97497F18C34585FB540B60C079969D6BE28BA52953D
SHA-512:	DB4A2D82F63819757FEEB748B32DF21174CB0663D8BE90509F3ED727404B91F37591E0EEE98F9DB721FEE80F38FA16FDBB42D74032B2CAA33D5ADABC04B97D78
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13365809832360009","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","5826"],"daily_received_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF359aa.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	8569
Entropy (8bit):	5.061215461321853
Encrypted:	false
SSDEEP:	96:sVMqlFJ10b9FS99oX3548Y/sY5Th6Cp9/x+6M8muecmAeCCe4zvrM2X6gE5AtEHb:sVMqJ+M9oZXY/sYPpj+FVAEMFBf
MD5:	199D96CFFE298F44B1C923D9636070E8
SHA1:	D744EBF095A797970308C39EE71FB0E7981D4BCE
SHA-256:	E2E21FE42C8E44A25C72F97497F18C34585FB540B60C079969D6BE28BA52953D
SHA-512:	DB4A2D82F63819757FEEB748B32DF21174CB0663D8BE90509F3ED727404B91F37591E0EEE98F9DB721FEE80F38FA16FDBB42D74032B2CAA33D5ADABC04B97D78
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13365809832360009","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","5826"],"daily_received_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF3b920.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	8569
Entropy (8bit):	5.061215461321853
Encrypted:	false
SSDEEP:	96:sVMqlFJ10b9FS99oX3548Y/sY5Th6Cp9/x+6M8muecmAeCCe4zvrM2X6gE5AtEHb:sVMqJ+M9oZXY/sYPpj+FVAEMFBf
MD5:	199D96CFFE298F44B1C923D9636070E8
SHA1:	D744EBF095A797970308C39EE71FB0E7981D4BCE
SHA-256:	E2E21FE42C8E44A25C72F97497F18C34585FB540B60C079969D6BE28BA52953D
SHA-512:	DB4A2D82F63819757FEEB748B32DF21174CB0663D8BE90509F3ED727404B91F37591E0EEE98F9DB721FEE80F38FA16FDBB42D74032B2CAA33D5ADABC04B97D78
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13365809832360009","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","5826"],"daily_received_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\PreferredApps

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	4.051821770808046
Encrypted:	false
SSDEEP:	3:YVXADAEvTLSJ:Y9AcEvHSJ
MD5:	2B432FEF211C69C745ACA86DE4F8E4AB
SHA1:	4B92DA8D4C0188CF2409500ADCD2200444A82FCC
SHA-256:	42B55D126D1E640B1ED7A6BDCB9A46C81DF461FA7E131F4F8C7108C2C61C14DE
SHA-512:	948502DE4DC89A7E9D2E1660451FCD0F44FD3816072924A44F145D821D0363233CC92A377DBA3A0A9F849E3C17B1893070025C369C8120083A622D025FE1EACF
Malicious:	false
Preview:	{"preferred_apps":[],"version":1}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	28366
Entropy (8bit):	5.557865770416011
Encrypted:	false
SSDEEP:	768:4t+ohQ7pLGL74JWPukfAX8F1+UoAYDCx9Tuqh0VfUC9xbog/OVJM1zPrwKEpFtuM:4t+ohcc74JWPukfAXu1jaA6z8KKtD
MD5:	E6DC7EDC5AEEBFC9863F78944A45E435
SHA1:	668F6F551725FABC69E33FF29BE64ABFBA8A7FC1
SHA-256:	6B881756AFAEE6B1835F3018004260456606D06B3D825B0D154290B40FAB031D
SHA-512:	9B63CCB5D7AA36A1E49F707F3E400EB25C9D191E8E8C93DC15CBBF1D71857AE4DF177FAD27E8D736F82C68DBBAB080A88953074FC1FA29A2863EDE84944C8038
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13365809831850764","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13365809831850764","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF30f05.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	28366
Entropy (8bit):	5.557865770416011
Encrypted:	false
SSDEEP:	768:4t+ohQ7pLGL74JWPukfAX8F1+UoAYDCx9Tuqh0VfUC9xbog/OVJM1zPrwKEpFtuM:4t+ohcc74JWPukfAXu1jaA6z8KKtD
MD5:	E6DC7EDC5AEEBFC9863F78944A45E435
SHA1:	668F6F551725FABC69E33FF29BE64ABFBA8A7FC1
SHA-256:	6B881756AFAEE6B1835F3018004260456606D06B3D825B0D154290B40FAB031D
SHA-512:	9B63CCB5D7AA36A1E49F707F3E400EB25C9D191E8E8C93DC15CBBF1D71857AE4DF177FAD27E8D736F82C68DBBAB080A88953074FC1FA29A2863EDE84944C8038
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13365809831850764","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13365809831850764","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	232
Entropy (8bit):	2.7061121767675385
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFljljljljljljljljljl:S85aEFljljljljljljljljljl
MD5:	8A30A1FDD0459D9EA8B1E78A8E636856
SHA1:	9D7225E97F9CFCFB225CFBFD0B0BBA21D4EFDD20
SHA-256:	88FE1D31608930F2738D102D45C75DC77ACDF01A1B69BFB7E7C0281575B75E33
SHA-512:	B529BCE870CD8165BF82F3EBF94F07552467BD0993B9D35145182E54E26FB2AE8E7BB167D88267B632757E2146F27DFDDF8867DB0C66E5DCC306DB12EC6B7BEF
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f.................&f.................&f.................&f.................&f.................&f.................&f.................&f.................&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.179872971996662
Encrypted:	false
SSDEEP:	6:BYA+q2Pwkn23oH+TcwtrQMxIFUt84YBgZmw+4YwtVkwOwkn23oH+TcwtrQMFLJ:EvYfYebCFUt8jg/+G5JfYebtJ
MD5:	9BE6D5BD758394CF702F677E8E1520A9
SHA1:	EF4086D52E346E75ECB0607E1EF96BFAF28F9313
SHA-256:	3CFC0FC380232C5B89A90B94D58B90CCC1B7DF64DAEFA0E54809A6788B9204F8
SHA-512:	3527D381F60685558401D158950D680DDBF7495B1DCAA681AD11F04EE583D7D507A14C22F7D11C4B9F08239A36DAFE9DE5D26EFA6A3374102824B9F0329FE7F0
Malicious:	false
Preview:	2024/07/18-16:57:28.123 1e48 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/07/18-16:57:28.125 1e48 Recovering log #3.2024/07/18-16:57:28.127 1e48 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.179872971996662
Encrypted:	false
SSDEEP:	6:BYA+q2Pwkn23oH+TcwtrQMxIFUt84YBgZmw+4YwtVkwOwkn23oH+TcwtrQMFLJ:EvYfYebCFUt8jg/+G5JfYebtJ
MD5:	9BE6D5BD758394CF702F677E8E1520A9
SHA1:	EF4086D52E346E75ECB0607E1EF96BFAF28F9313
SHA-256:	3CFC0FC380232C5B89A90B94D58B90CCC1B7DF64DAEFA0E54809A6788B9204F8
SHA-512:	3527D381F60685558401D158950D680DDBF7495B1DCAA681AD11F04EE583D7D507A14C22F7D11C4B9F08239A36DAFE9DE5D26EFA6A3374102824B9F0329FE7F0
Malicious:	false
Preview:	2024/07/18-16:57:28.123 1e48 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/07/18-16:57:28.125 1e48 Recovering log #3.2024/07/18-16:57:28.127 1e48 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	350
Entropy (8bit):	5.174584913737187
Encrypted:	false
SSDEEP:	6:Bm1hN+q2Pwkn23oH+Tcwt7Uh2ghZIFUt84m1hZZmw+4mObVkwOwkn23oH+Tcwt7w:tvYfYebIhHh2FUt8//+wB5JfYebIhHLJ
MD5:	56746A985F3E0FB8728DFFCC9753E318
SHA1:	36A3AE483843087B67CC5F21BBA324641CFF5378
SHA-256:	55BACBFB4893D530056D1E15D37F44AC2642E407DD1B6495C091C68472A728DF
SHA-512:	03E064A14498C3FC9DAFB3ED4287BE85CC08FD9A69900EC6467961A2766ED135A06E131A8C85D0B1D35CB2AD447EEC5AF97606DB18C90B21A47D45848832DF6B
Malicious:	false
Preview:	2024/07/18-16:57:11.921 1e18 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/07/18-16:57:11.921 1e18 Recovering log #3.2024/07/18-16:57:11.922 1e18 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	350
Entropy (8bit):	5.174584913737187
Encrypted:	false
SSDEEP:	6:Bm1hN+q2Pwkn23oH+Tcwt7Uh2ghZIFUt84m1hZZmw+4mObVkwOwkn23oH+Tcwt7w:tvYfYebIhHh2FUt8//+wB5JfYebIhHLJ
MD5:	56746A985F3E0FB8728DFFCC9753E318
SHA1:	36A3AE483843087B67CC5F21BBA324641CFF5378
SHA-256:	55BACBFB4893D530056D1E15D37F44AC2642E407DD1B6495C091C68472A728DF
SHA-512:	03E064A14498C3FC9DAFB3ED4287BE85CC08FD9A69900EC6467961A2766ED135A06E131A8C85D0B1D35CB2AD447EEC5AF97606DB18C90B21A47D45848832DF6B
Malicious:	false
Preview:	2024/07/18-16:57:11.921 1e18 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/07/18-16:57:11.921 1e18 Recovering log #3.2024/07/18-16:57:11.922 1e18 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	524656
Entropy (8bit):	5.027445846313988E-4
Encrypted:	false
SSDEEP:	3:LsulBUl/:Ls0Ut
MD5:	E7E2CB213298D2125CCF6D5C3D032381
SHA1:	3A4FC554C00040D3FE7A64D198A7F90DDE741E80
SHA-256:	09A14BF0D10B04C6B925E3956C9BBFF303703AEF592A1DAC5F795E0BFD7FD10E
SHA-512:	B1782DED07B190808D27985D09DE2EBDCF0469174C0746498E05B552E5A19F671550C79255AA55348F90827F82A05BC58F186484C0D80C3D6FDD0BF36DC07483
Malicious:	false
Preview:	........................................a.m."\|/.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlZUKl/:Ls3z/
MD5:	4DEA4476C6017892DDD51F59B1E1FD8F
SHA1:	07F709A532EF2A61433FB7B075FD5E42B19BBD0F
SHA-256:	7919EE366498F044E2A336778CE59670158F2B3950170F7189812B80F392D607
SHA-512:	FC3CC8188E6053F29AA0C8DC1B38FAB0159CBB1ED26C060EDCBDDD588938CE2991EF36A371F8E431429595727CFA1C5E9A7ABC4E5DD8EA3D1824C0A2EF3311FE
Malicious:	false
Preview:	..........................................8."\|/.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	432
Entropy (8bit):	5.2808069627688665
Encrypted:	false
SSDEEP:	6:B727+q2Pwkn23oH+TcwtzjqEKj3K/2jMGIFUt847lZZmw+4sz3VkwOwkn23oH+Ts:dvYfYebvqBQFUt8W/+fF5JfYebvqBvJ
MD5:	B0097F2D01E4FE44274B2C043B9F3FC6
SHA1:	1A51E90B0B9E552EF40145F02398243D0FDA8A71
SHA-256:	09990BCC680508114C41A6FA87145F48D36587E9FF345345025E668B37733603
SHA-512:	9869321AB6B2FCC4BBDF8FAB91FB6503E2AC333BF625F496E469D5A35E0DA93ADB16DD77B3705358E4C81518E61B00C482968310AC08CA49D850B2F801122CC1
Malicious:	false
Preview:	2024/07/18-16:57:12.475 1e48 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/07/18-16:57:12.476 1e48 Recovering log #3.2024/07/18-16:57:12.480 1e48 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	432
Entropy (8bit):	5.2808069627688665
Encrypted:	false
SSDEEP:	6:B727+q2Pwkn23oH+TcwtzjqEKj3K/2jMGIFUt847lZZmw+4sz3VkwOwkn23oH+Ts:dvYfYebvqBQFUt8W/+fF5JfYebvqBvJ
MD5:	B0097F2D01E4FE44274B2C043B9F3FC6
SHA1:	1A51E90B0B9E552EF40145F02398243D0FDA8A71
SHA-256:	09990BCC680508114C41A6FA87145F48D36587E9FF345345025E668B37733603
SHA-512:	9869321AB6B2FCC4BBDF8FAB91FB6503E2AC333BF625F496E469D5A35E0DA93ADB16DD77B3705358E4C81518E61B00C482968310AC08CA49D850B2F801122CC1
Malicious:	false
Preview:	2024/07/18-16:57:12.475 1e48 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/07/18-16:57:12.476 1e48 Recovering log #3.2024/07/18-16:57:12.480 1e48 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\05c25186-02d8-43d4-afff-56137db716bb.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\0ce573cb-5598-4225-97fa-a8ed82b7dee0.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\92b53f12-c382-4f54-be52-8e5d6ec9eeec.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	193
Entropy (8bit):	4.864047146590611
Encrypted:	false
SSDEEP:	6:YHpoueH2a9a1o3/QBR70S7PMVKJTnMRK3VY:YH/u2caq3QH7E4T3y
MD5:	18D8AE83268DD3A59C64AAD659CF2FD3
SHA1:	018C9736438D095A67B1C9953082F671C2FDB681
SHA-256:	D659029D35ADEBB7918AF32FFF3202C63D8047043A8BDF329B2A97751CF95056
SHA-512:	BB0962F930E9844E8C0E9CD209C07F46259E4C7677D5443B7AEE90DCF7B7E8F9960C5E3FCB8A83B9BB40862FBE0442C547083A9FD421D86674B88B2BEBBEB2FB
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State~RF3ceab.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	193
Entropy (8bit):	4.864047146590611
Encrypted:	false
SSDEEP:	6:YHpoueH2a9a1o3/QBR70S7PMVKJTnMRK3VY:YH/u2caq3QH7E4T3y
MD5:	18D8AE83268DD3A59C64AAD659CF2FD3
SHA1:	018C9736438D095A67B1C9953082F671C2FDB681
SHA-256:	D659029D35ADEBB7918AF32FFF3202C63D8047043A8BDF329B2A97751CF95056
SHA-512:	BB0962F930E9844E8C0E9CD209C07F46259E4C7677D5443B7AEE90DCF7B7E8F9960C5E3FCB8A83B9BB40862FBE0442C547083A9FD421D86674B88B2BEBBEB2FB
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 4, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.555790634850688
Encrypted:	false
SSDEEP:	48:TsIopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSB:QIEumQv8m1ccnvS6
MD5:	0247E46DE79B6CD1BF08CAF7782F7793
SHA1:	B3A63ED5BE3D8EC6E3949FC5E2D21D97ACC873A6
SHA-256:	AAD0053186875205E014AB98AE8C18A6233CB715DD3AF44E7E8EB259AEAB5EEA
SHA-512:	148804598D2A9EA182BD2ADC71663D481F88683CE3D672CE12A43E53B0D34FD70458BE5AAA781B20833E963804E7F4562855F2D18F7731B7C2EAEA5D6D52FBB6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}.........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF2c162.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 9, cookie 0x6, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.36515621748816035
Encrypted:	false
SSDEEP:	24:TLH3lIIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:Tb31DtX5nDOvyKDhU1cSB
MD5:	25363ADC3C9D98BAD1A33D0792405CBF
SHA1:	D06E343087D86EF1A06F7479D81B26C90A60B5C3
SHA-256:	6E019B8B9E389216D5BDF1F2FE63F41EF98E71DA101F2A6BE04F41CC5954532D
SHA-512:	CF7EEE35D0E00945AF221BEC531E8BF06C08880DA00BD103FA561BC069D7C6F955CBA3C1C152A4884601E5A670B7487D39B4AE9A4D554ED8C14F129A74E555F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......X..g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\ed6a1c0d-f97a-4d43-b160-4594dcb35ca3.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKtiVY:YHpoeS7PMVKJTnMRK3VY
MD5:	285252A2F6327D41EAB203DC2F402C67
SHA1:	ACEDB7BA5FBC3CE914A8BF386A6F72CA7BAA33C6
SHA-256:	5DFC321417FC31359F23320EA68014EBFD793C5BBED55F77DAB4180BBD4A2026
SHA-512:	11CE7CB484FEE66894E63C31DB0D6B7EF66AD0327D4E7E2EB85F3BCC2E836A3A522C68D681E84542E471E54F765E091EFE1EE4065641B0299B15613EB32DCC0D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	80
Entropy (8bit):	3.4921535629071894
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFljl:S85aEFljl
MD5:	69449520FD9C139C534E2970342C6BD8
SHA1:	230FE369A09DEF748F8CC23AD70FD19ED8D1B885
SHA-256:	3F2E9648DFDB2DDB8E9D607E8802FEF05AFA447E17733DD3FD6D933E7CA49277
SHA-512:	EA34C39AEA13B281A6067DE20AD0CDA84135E70C97DB3CDD59E25E6536B19F7781E5FC0CA4A11C3618D43FC3BD3FBC120DD5C1C47821A248B8AD351F9F4E6367
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	420
Entropy (8bit):	5.298547602953716
Encrypted:	false
SSDEEP:	12:AlOvYfYebvqBZFUt83aZ/+v5JfYebvqBaJ:ACYfYebvyg83aaJfYebvL
MD5:	DA062F1194D25FD1E4BC2672D826495E
SHA1:	442D5898866329BBD1DCB5106832C6BB811E8AC7
SHA-256:	31D08C0B10F2D7D0CE03E09546384480F1A21240228F2A0270D176155F9AA5B0
SHA-512:	C680C632FC9D4D4B33F645C5B9575F52690FC660C1173EE6DE7121EBBBA4743154CEDD5E24A631D961F69E053A801737BF0A46753189BEF0D8030E3E0B4567CD
Malicious:	false
Preview:	2024/07/18-16:57:28.328 1e48 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/07/18-16:57:28.329 1e48 Recovering log #3.2024/07/18-16:57:28.333 1e48 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	420
Entropy (8bit):	5.298547602953716
Encrypted:	false
SSDEEP:	12:AlOvYfYebvqBZFUt83aZ/+v5JfYebvqBaJ:ACYfYebvyg83aaJfYebvL
MD5:	DA062F1194D25FD1E4BC2672D826495E
SHA1:	442D5898866329BBD1DCB5106832C6BB811E8AC7
SHA-256:	31D08C0B10F2D7D0CE03E09546384480F1A21240228F2A0270D176155F9AA5B0
SHA-512:	C680C632FC9D4D4B33F645C5B9575F52690FC660C1173EE6DE7121EBBBA4743154CEDD5E24A631D961F69E053A801737BF0A46753189BEF0D8030E3E0B4567CD
Malicious:	false
Preview:	2024/07/18-16:57:28.328 1e48 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/07/18-16:57:28.329 1e48 Recovering log #3.2024/07/18-16:57:28.333 1e48 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.228225915899623
Encrypted:	false
SSDEEP:	6:BJyq2Pwkn23oH+TcwtpIFUt84t1Zmw+47RkwOwkn23oH+Tcwta/WLJ:XyvYfYebmFUt8G/+eR5JfYebaUJ
MD5:	0876BE3630ECC7A8319C3BC1FA3D06CC
SHA1:	C43CD2BD70953B6DEC3784FF0034F5BF9297851A
SHA-256:	5E3595BF223B871547E89BCCD78133186DE9808938C33E0C6588BADA0257011B
SHA-512:	36A0C0F1538076F41A7627D0885284BE4DAEB3416D730B8E85F5CE4475E1EC31A8592F1A314C2706EF382BB3C1875F2FF7A7120B7FFEF8219EE4CC7DE8D11806
Malicious:	false
Preview:	2024/07/18-16:57:12.002 1e34 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/07/18-16:57:12.008 1e34 Recovering log #3.2024/07/18-16:57:12.008 1e34 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.228225915899623
Encrypted:	false
SSDEEP:	6:BJyq2Pwkn23oH+TcwtpIFUt84t1Zmw+47RkwOwkn23oH+Tcwta/WLJ:XyvYfYebmFUt8G/+eR5JfYebaUJ
MD5:	0876BE3630ECC7A8319C3BC1FA3D06CC
SHA1:	C43CD2BD70953B6DEC3784FF0034F5BF9297851A
SHA-256:	5E3595BF223B871547E89BCCD78133186DE9808938C33E0C6588BADA0257011B
SHA-512:	36A0C0F1538076F41A7627D0885284BE4DAEB3416D730B8E85F5CE4475E1EC31A8592F1A314C2706EF382BB3C1875F2FF7A7120B7FFEF8219EE4CC7DE8D11806
Malicious:	false
Preview:	2024/07/18-16:57:12.002 1e34 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/07/18-16:57:12.008 1e34 Recovering log #3.2024/07/18-16:57:12.008 1e34 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Top Sites

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 7, 1st free page 5, free pages 2, cookie 0x5, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.26707851465859517
Encrypted:	false
SSDEEP:	12:TLPp5yN8h6MvDOH+FxOUwa5qVZ7Nkl25Pe2d:TLh8Gxk+6Uwc8NlYC
MD5:	04F8B790DF73BD7CD01238F4681C3F44
SHA1:	DF12D0A21935FC01B36A24BF72AB9640FEBB2077
SHA-256:	96BD789329E46DD9D83002DC40676922A48A3601BF4B5D7376748B34ECE247A0
SHA-512:	0DD492C371D310121F7FD57D29F8CE92AA2536A74923AC27F9C4C0C1580C849D7779348FC80410DEBB5EEE14F357EBDF33BF670D1E7B6CCDF15D69AC127AB7C3
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.......j.j................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 4, database pages 87, cookie 0x66, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	180224
Entropy (8bit):	0.9237410161604507
Encrypted:	false
SSDEEP:	192:vyMUfTfnGCTjHbRJkkqtXaWTK+hGgH+6e7E:vyffrnzkkqtXnTK+hNH+5
MD5:	C97C2FBAAEA45BB3C728D02689216CB2
SHA1:	CA75AE4F32B49EA8EE1C3FDC4A6A6729460AE9F2
SHA-256:	DB3E522850328F9150FF442E3680DF9F8A332B504ECECE26F4983D79C0D1482B
SHA-512:	5CDF0D3D8069092E9656482D2F4BEAAAF0E58CA20B6066FE0EAB0C84EB60DBCF292EC5A6988F93A8077087FD80E887371EF67A443CCDC99CCFDBE42E708D938E
Malicious:	false
Preview:	SQLite format 3......@ .......W...........f......................................................j............O........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2568
Entropy (8bit):	0.06569804787746027
Encrypted:	false
SSDEEP:	3:eS4Fl1lhtlwC:c3n
MD5:	E2D76C5C334238F6E85BA9F168974255
SHA1:	61F0D0BBF0236FAEB23AE315054C89C35C4C86D0
SHA-256:	CA74F363FF4F5AAD73A2798A006438667FCD2912DA3AC049810B263903BFB389
SHA-512:	E650C886C0CF5EFA4D1E6C0FAB06923DC1036D588E0121126575E8F0166F25CE3859129BB9C89AAFBA598955D8C4EDEE764B788AF6AF042E1F7647B8E81A8D7B
Malicious:	false
Preview:	............Q......W....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\arbitration_service_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3951), with CRLF line terminators
Category:	dropped
Size (bytes):	11755
Entropy (8bit):	5.190465908239046
Encrypted:	false
SSDEEP:	192:hH4vrmqRBB4W4PoiUDNaxvR5FCHFcoaSbqGEDI:hH4vrmUB6W4jR3GaSbqGEDI
MD5:	07301A857C41B5854E6F84CA00B81EA0
SHA1:	7441FC1018508FF4F3DBAA139A21634C08ED979C
SHA-256:	2343C541E095E1D5F202E8D2A0807113E69E1969AF8E15E3644C51DB0BF33FBF
SHA-512:	00ADE38E9D2F07C64648202F1D5F18A2DFB2781C0517EAEBCD567D8A77DBB7CB40A58B7C7D4EC03336A63A20D2E11DD64448F020C6FF72F06CA870AA2B4765E0
Malicious:	false
Preview:	{.. "DefaultCohort": {.. "21f3388b-c2a5-4791-8f6e-a4cad6d17f4f.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.BingHomePage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Covid.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Finance.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Jobs.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.KnowledgeCard.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Local.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NTP3PCLICK.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NotifySearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Recipe.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.SearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Sports.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Travel.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Weather.Bubble": 1,.. "2cb2db96-3bd0-403e-abe2-9269b3761041.Bubble": 1,.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\cc6a4792-0b4b-4aac-9ddb-8912eda4fbc6.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\edee5f82-8f50-4a74-a0a6-f9cf44a98504.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9334
Entropy (8bit):	5.173756111910127
Encrypted:	false
SSDEEP:	96:sVMqlFJ10b9FS99oX354uaF2O9Yd4rY/sY5Th6Cp9/x+6M8muecmAeC8ze4zvrM/:sVMqJ+M9oZAFH+dsY/sYPpj+FVA8MFBf
MD5:	3E8B5C672C302A100A64CDC05FFB19A7
SHA1:	A1D86C72561AE5588A767E71954735F544EF1D82
SHA-256:	F3D78DE6B547D3250A91B0B77F962F85DA3D1626F158435DCA2CEC9AF970668C
SHA-512:	D8E7CE8E24478F0B2430CE5B346800DE099C7738D3D518D0E770229EFABAFC601C421AA76D82426107D7915DEA4BF65EB8425C0B41190E998300446A1A502F83
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13365809832360009","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","5826"],"daily_received_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\heavy_ad_intervention_opt_out.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 4, cookie 0x2, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.35226517389931394
Encrypted:	false
SSDEEP:	12:TLC+waBg9LBgVDBgQjiZBgKuFtuQkMbmgcVAzO5kMCgGUg5OR:TLPdBgtBgJBgQjiZS53uQFE27MCgGZsR
MD5:	D2CCDC36225684AAE8FA563AFEDB14E7
SHA1:	3759649035F23004A4C30A14C5F0B54191BEBF80
SHA-256:	080AEE864047C67CB1586A5BA5EDA007AFD18ECC2B702638287E386F159D7AEE
SHA-512:	1A915AF643D688CA68AEDC1FF26C407D960D18DFDE838B417C437D7ADAC7B91C906E782DCC414784E64287915BD1DE5BB6A282E59AA9FEB8C384B4D4BC5F70EC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......Q......Q......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-shm

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	250
Entropy (8bit):	3.7656505578017114
Encrypted:	false
SSDEEP:	3:VVXntjQPEnjQvxljlq0+Wll3seGKT9rcQ6xONEOtlTxotlTxotlTxotlTxotl:/XntM+4ljlqVWll3sedhOONEOuuuu
MD5:	412BD43AAAB0626539DE9B6777CAC34A
SHA1:	6084B5CB51642D53FCD4727343489950BBB32D40
SHA-256:	688710B3464CCD20409886B3CE6407DD7AD7FF95CC44DDD1C8B4B8A7AF285D2A
SHA-512:	3F7158E9A00EAB5A85F2CA1733820834F14FA3DEF7DDB9A33655995A97133CE86C715D9D13840E7C4F3EDBCCDBECF6F1716F0D582D9004A9B9AA4C2A54E347AC
Malicious:	false
Preview:	A..r.................20_1_1...1.,U.................20_1_1...1..&f.................&f...................0................39_config..........6.....n ....1u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	281
Entropy (8bit):	5.248769813102607
Encrypted:	false
SSDEEP:	6:BFj+q1wkn23oH+Tcwtfrl2KLlrHdFN+q2Pwkn23oH+TcwtfrK+IFUv:bufYeb1LPOvYfYeb23FUv
MD5:	393FC62A8F49BD33CDF34C7C584800A1
SHA1:	654B4BE1B3587A024AF0CB20A44EDB729C444C4C
SHA-256:	9DC93E19E6AFDDDBD2217EB7B9B709C5C90C21B85638A18BF55F4D5425A3BF46
SHA-512:	AEE1B3DBF8459641E935152C4CF46D97A7883A2247839AB8223EC659687F968FD888DD818CBE8495C818264C507616814642E4A9841D5A60F1EFDF517CADD871
Malicious:	false
Preview:	2024/07/18-16:57:12.543 1e18 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db since it was missing..2024/07/18-16:57:12.703 1e18 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	617
Entropy (8bit):	3.9212598392563565
Encrypted:	false
SSDEEP:	12:G0nYUtTNop//z3p/Uz0RuWlJh/UmZyL5n01zv0:G0nYUtypD3RUovhHZIy0
MD5:	124361CC7102061D527D4C31AA936423
SHA1:	56A48F9133CE6AFE48A03F66D2E4E1A47C98406D
SHA-256:	7C18DCB88715F5C78A0C213C2D4CCCCBA2175A2C8AAE3913C5C05147F8CE608E
SHA-512:	97D03C4EAC00792ACC88FDE2103EA545611A36547299B1903A28F0357ACFF2696A3891EDE075E79AE6091F0DDE0101B5BCC9F26E15342EAB1C9B445AF20DD158
Malicious:	false
Preview:	.h.6.................__global... .t...................__global... .9..b.................33_..........................33_........v.................21_.....vuNX.................21_.....<...................20_.....,.1..................19_.....QL.s.................18_.....<.J\|.................37_...... .A.................38_..........................39_........].................20_.....{a...................19_.....4.9..................20_.......\|.................37_..........................18_..........................38_......\e..................39_.....dz.\|.................9_.....'\c..................9_.....

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	299
Entropy (8bit):	5.202066640599768
Encrypted:	false
SSDEEP:	6:BDJh+q1wkn23oH+Tcwtfrzs52KLlrFgdFN+q2Pwkn23oH+TcwtfrzAdIFUv:TAfYebs9LDYOvYfYeb9FUv
MD5:	48803910456220BBDB9658B47E9B5910
SHA1:	04CCBAEB863FA31AE33F95E919B565453EE81258
SHA-256:	D0D46E2338205759CCEB753D976DD018E9F826569F1DE3D6770AA30C9EFA6CEA
SHA-512:	889A8B8C929AA156B1D5E6D0B1926795E3BEA0DF96B4665EF81E66A525EC1637045774C872FBC78CA2F9837F237FC73E37A7501D749CE680F5D95C59E69617FC
Malicious:	false
Preview:	2024/07/18-16:57:12.361 1e18 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata since it was missing..2024/07/18-16:57:12.531 1e18 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlDc:Ls3Dc
MD5:	A232F830CD92B28B2A8DF7EC29E6F150
SHA1:	0FAF53C6208873F8C5E971752BEC4CDED6160FD1
SHA-256:	F328B29A02D038F0462AF446F173A033AA696838F763881BE8C05600642D40B0
SHA-512:	3208B46FACA12CE6711B8375844CE8E9B9E01B6A73D17E546F0E6F6D898DAE34886FD76F2C1DB9A5237A226AF61EAB757BDABF5354EC361073D0414C43DAC0AF
Malicious:	false
Preview:	..........................................,."\|/.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNl09:Ls309
MD5:	90D205B8C17647222F96C224DF4F0C45
SHA1:	733E9F792501DC485F84B28D0CC9689DEC897FBE
SHA-256:	A48C1E2F5C1F39F4E793C68440FD0529B9AB2CBDC2BC48C9B17F85EF96A1F0ED
SHA-512:	F9CDA08C519662B207C4FA5D05D65C00DE026C4281C0EDA307D3DE710FD342EF5289AE834DAD72144A8A4DE22FA54694D95056B53051236A29382845A5046C40
Malicious:	false
Preview:	.........................................2.."\|/.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Browser

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	120
Entropy (8bit):	3.32524464792714
Encrypted:	false
SSDEEP:	3:tbloIlrJFlXnpQoWcNylRjlgbYnPdJiG6R7lZAUAl:tbdlrYoWcV0n1IGi7kBl
MD5:	A397E5983D4A1619E36143B4D804B870
SHA1:	AA135A8CC2469CFD1EF2D7955F027D95BE5DFBD4
SHA-256:	9C70F766D3B84FC2BB298EFA37CC9191F28BEC336329CC11468CFADBC3B137F4
SHA-512:	4159EA654152D2810C95648694DD71957C84EA825FCCA87B36F7E3282A72B30EF741805C610C5FA847CA186E34BDE9C289AAA7B6931C5B257F1D11255CD2A816
Malicious:	false
Preview:	C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.7192945256669794
Encrypted:	false
SSDEEP:	3:NYLFRQI:ap2I
MD5:	BF16C04B916ACE92DB941EBB1AF3CB18
SHA1:	FA8DAEAE881F91F61EE0EE21BE5156255429AA8A
SHA-256:	7FC23C9028A316EC0AC25B09B5B0D61A1D21E58DFCF84C2A5F5B529129729098
SHA-512:	F0B7DF5517596B38D57C57B5777E008D6229AB5B1841BBE74602C77EEA2252BF644B8650C7642BD466213F62E15CC7AB5A95B28E26D3907260ED1B96A74B65FB
Malicious:	false
Preview:	117.0.2045.47

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.790016754010169
Encrypted:	false
SSDEEP:	96:iaqkHfZ6+6c5ih/cI9URLl8RotofMFVvlwhMe4IbONIeTC6XQS0qGqk+Z4uj+rj1:akRKxeiRUgh86qRAq1k8SPxVLZ7VTiq
MD5:	5168BC5CEA694D443D34B466D6D3B7DA
SHA1:	F619451562C1ED43B210518D9859292DB90B0154
SHA-256:	AEAC1349E63282B5191FA3CC3AD2528E93A7CFD92934B9F23CFAA1E7005DCD8A
SHA-512:	EF655A7760ED1E7620F87B1A4348BABEFBB6D2812E4AE095B68F369A44E4D9EB465408A37BA9B3E737320273BAAA78FFCBF79A0C6E2EA4ADC182472DB40C06EB
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAADgzkluQHrwTIT+m1rkijeAEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAD0mYqszp5OhOKySmNJd4jyMe12cNXAXOszreVM2ov6hAAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2a4c2.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.790016754010169
Encrypted:	false
SSDEEP:	96:iaqkHfZ6+6c5ih/cI9URLl8RotofMFVvlwhMe4IbONIeTC6XQS0qGqk+Z4uj+rj1:akRKxeiRUgh86qRAq1k8SPxVLZ7VTiq
MD5:	5168BC5CEA694D443D34B466D6D3B7DA
SHA1:	F619451562C1ED43B210518D9859292DB90B0154
SHA-256:	AEAC1349E63282B5191FA3CC3AD2528E93A7CFD92934B9F23CFAA1E7005DCD8A
SHA-512:	EF655A7760ED1E7620F87B1A4348BABEFBB6D2812E4AE095B68F369A44E4D9EB465408A37BA9B3E737320273BAAA78FFCBF79A0C6E2EA4ADC182472DB40C06EB
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAADgzkluQHrwTIT+m1rkijeAEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAD0mYqszp5OhOKySmNJd4jyMe12cNXAXOszreVM2ov6hAAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2a84c.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.790016754010169
Encrypted:	false
SSDEEP:	96:iaqkHfZ6+6c5ih/cI9URLl8RotofMFVvlwhMe4IbONIeTC6XQS0qGqk+Z4uj+rj1:akRKxeiRUgh86qRAq1k8SPxVLZ7VTiq
MD5:	5168BC5CEA694D443D34B466D6D3B7DA
SHA1:	F619451562C1ED43B210518D9859292DB90B0154
SHA-256:	AEAC1349E63282B5191FA3CC3AD2528E93A7CFD92934B9F23CFAA1E7005DCD8A
SHA-512:	EF655A7760ED1E7620F87B1A4348BABEFBB6D2812E4AE095B68F369A44E4D9EB465408A37BA9B3E737320273BAAA78FFCBF79A0C6E2EA4ADC182472DB40C06EB
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAADgzkluQHrwTIT+m1rkijeAEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAD0mYqszp5OhOKySmNJd4jyMe12cNXAXOszreVM2ov6hAAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2a89a.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.790016754010169
Encrypted:	false
SSDEEP:	96:iaqkHfZ6+6c5ih/cI9URLl8RotofMFVvlwhMe4IbONIeTC6XQS0qGqk+Z4uj+rj1:akRKxeiRUgh86qRAq1k8SPxVLZ7VTiq
MD5:	5168BC5CEA694D443D34B466D6D3B7DA
SHA1:	F619451562C1ED43B210518D9859292DB90B0154
SHA-256:	AEAC1349E63282B5191FA3CC3AD2528E93A7CFD92934B9F23CFAA1E7005DCD8A
SHA-512:	EF655A7760ED1E7620F87B1A4348BABEFBB6D2812E4AE095B68F369A44E4D9EB465408A37BA9B3E737320273BAAA78FFCBF79A0C6E2EA4ADC182472DB40C06EB
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAADgzkluQHrwTIT+m1rkijeAEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAD0mYqszp5OhOKySmNJd4jyMe12cNXAXOszreVM2ov6hAAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2ceee.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.790016754010169
Encrypted:	false
SSDEEP:	96:iaqkHfZ6+6c5ih/cI9URLl8RotofMFVvlwhMe4IbONIeTC6XQS0qGqk+Z4uj+rj1:akRKxeiRUgh86qRAq1k8SPxVLZ7VTiq
MD5:	5168BC5CEA694D443D34B466D6D3B7DA
SHA1:	F619451562C1ED43B210518D9859292DB90B0154
SHA-256:	AEAC1349E63282B5191FA3CC3AD2528E93A7CFD92934B9F23CFAA1E7005DCD8A
SHA-512:	EF655A7760ED1E7620F87B1A4348BABEFBB6D2812E4AE095B68F369A44E4D9EB465408A37BA9B3E737320273BAAA78FFCBF79A0C6E2EA4ADC182472DB40C06EB
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAADgzkluQHrwTIT+m1rkijeAEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAD0mYqszp5OhOKySmNJd4jyMe12cNXAXOszreVM2ov6hAAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF30a61.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.790016754010169
Encrypted:	false
SSDEEP:	96:iaqkHfZ6+6c5ih/cI9URLl8RotofMFVvlwhMe4IbONIeTC6XQS0qGqk+Z4uj+rj1:akRKxeiRUgh86qRAq1k8SPxVLZ7VTiq
MD5:	5168BC5CEA694D443D34B466D6D3B7DA
SHA1:	F619451562C1ED43B210518D9859292DB90B0154
SHA-256:	AEAC1349E63282B5191FA3CC3AD2528E93A7CFD92934B9F23CFAA1E7005DCD8A
SHA-512:	EF655A7760ED1E7620F87B1A4348BABEFBB6D2812E4AE095B68F369A44E4D9EB465408A37BA9B3E737320273BAAA78FFCBF79A0C6E2EA4ADC182472DB40C06EB
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAADgzkluQHrwTIT+m1rkijeAEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAD0mYqszp5OhOKySmNJd4jyMe12cNXAXOszreVM2ov6hAAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF30a71.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.790016754010169
Encrypted:	false
SSDEEP:	96:iaqkHfZ6+6c5ih/cI9URLl8RotofMFVvlwhMe4IbONIeTC6XQS0qGqk+Z4uj+rj1:akRKxeiRUgh86qRAq1k8SPxVLZ7VTiq
MD5:	5168BC5CEA694D443D34B466D6D3B7DA
SHA1:	F619451562C1ED43B210518D9859292DB90B0154
SHA-256:	AEAC1349E63282B5191FA3CC3AD2528E93A7CFD92934B9F23CFAA1E7005DCD8A
SHA-512:	EF655A7760ED1E7620F87B1A4348BABEFBB6D2812E4AE095B68F369A44E4D9EB465408A37BA9B3E737320273BAAA78FFCBF79A0C6E2EA4ADC182472DB40C06EB
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAADgzkluQHrwTIT+m1rkijeAEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAD0mYqszp5OhOKySmNJd4jyMe12cNXAXOszreVM2ov6hAAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF38fae.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.790016754010169
Encrypted:	false
SSDEEP:	96:iaqkHfZ6+6c5ih/cI9URLl8RotofMFVvlwhMe4IbONIeTC6XQS0qGqk+Z4uj+rj1:akRKxeiRUgh86qRAq1k8SPxVLZ7VTiq
MD5:	5168BC5CEA694D443D34B466D6D3B7DA
SHA1:	F619451562C1ED43B210518D9859292DB90B0154
SHA-256:	AEAC1349E63282B5191FA3CC3AD2528E93A7CFD92934B9F23CFAA1E7005DCD8A
SHA-512:	EF655A7760ED1E7620F87B1A4348BABEFBB6D2812E4AE095B68F369A44E4D9EB465408A37BA9B3E737320273BAAA78FFCBF79A0C6E2EA4ADC182472DB40C06EB
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAADgzkluQHrwTIT+m1rkijeAEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAD0mYqszp5OhOKySmNJd4jyMe12cNXAXOszreVM2ov6hAAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3b6dd.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.790016754010169
Encrypted:	false
SSDEEP:	96:iaqkHfZ6+6c5ih/cI9URLl8RotofMFVvlwhMe4IbONIeTC6XQS0qGqk+Z4uj+rj1:akRKxeiRUgh86qRAq1k8SPxVLZ7VTiq
MD5:	5168BC5CEA694D443D34B466D6D3B7DA
SHA1:	F619451562C1ED43B210518D9859292DB90B0154
SHA-256:	AEAC1349E63282B5191FA3CC3AD2528E93A7CFD92934B9F23CFAA1E7005DCD8A
SHA-512:	EF655A7760ED1E7620F87B1A4348BABEFBB6D2812E4AE095B68F369A44E4D9EB465408A37BA9B3E737320273BAAA78FFCBF79A0C6E2EA4ADC182472DB40C06EB
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAADgzkluQHrwTIT+m1rkijeAEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAD0mYqszp5OhOKySmNJd4jyMe12cNXAXOszreVM2ov6hAAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3f1e3.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.790016754010169
Encrypted:	false
SSDEEP:	96:iaqkHfZ6+6c5ih/cI9URLl8RotofMFVvlwhMe4IbONIeTC6XQS0qGqk+Z4uj+rj1:akRKxeiRUgh86qRAq1k8SPxVLZ7VTiq
MD5:	5168BC5CEA694D443D34B466D6D3B7DA
SHA1:	F619451562C1ED43B210518D9859292DB90B0154
SHA-256:	AEAC1349E63282B5191FA3CC3AD2528E93A7CFD92934B9F23CFAA1E7005DCD8A
SHA-512:	EF655A7760ED1E7620F87B1A4348BABEFBB6D2812E4AE095B68F369A44E4D9EB465408A37BA9B3E737320273BAAA78FFCBF79A0C6E2EA4ADC182472DB40C06EB
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAADgzkluQHrwTIT+m1rkijeAEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAD0mYqszp5OhOKySmNJd4jyMe12cNXAXOszreVM2ov6hAAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF4a13d.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.790016754010169
Encrypted:	false
SSDEEP:	96:iaqkHfZ6+6c5ih/cI9URLl8RotofMFVvlwhMe4IbONIeTC6XQS0qGqk+Z4uj+rj1:akRKxeiRUgh86qRAq1k8SPxVLZ7VTiq
MD5:	5168BC5CEA694D443D34B466D6D3B7DA
SHA1:	F619451562C1ED43B210518D9859292DB90B0154
SHA-256:	AEAC1349E63282B5191FA3CC3AD2528E93A7CFD92934B9F23CFAA1E7005DCD8A
SHA-512:	EF655A7760ED1E7620F87B1A4348BABEFBB6D2812E4AE095B68F369A44E4D9EB465408A37BA9B3E737320273BAAA78FFCBF79A0C6E2EA4ADC182472DB40C06EB
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAADgzkluQHrwTIT+m1rkijeAEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAD0mYqszp5OhOKySmNJd4jyMe12cNXAXOszreVM2ov6hAAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF4d03d.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.790016754010169
Encrypted:	false
SSDEEP:	96:iaqkHfZ6+6c5ih/cI9URLl8RotofMFVvlwhMe4IbONIeTC6XQS0qGqk+Z4uj+rj1:akRKxeiRUgh86qRAq1k8SPxVLZ7VTiq
MD5:	5168BC5CEA694D443D34B466D6D3B7DA
SHA1:	F619451562C1ED43B210518D9859292DB90B0154
SHA-256:	AEAC1349E63282B5191FA3CC3AD2528E93A7CFD92934B9F23CFAA1E7005DCD8A
SHA-512:	EF655A7760ED1E7620F87B1A4348BABEFBB6D2812E4AE095B68F369A44E4D9EB465408A37BA9B3E737320273BAAA78FFCBF79A0C6E2EA4ADC182472DB40C06EB
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAADgzkluQHrwTIT+m1rkijeAEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAD0mYqszp5OhOKySmNJd4jyMe12cNXAXOszreVM2ov6hAAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.46731661083066856
Encrypted:	false
SSDEEP:	12:TL1QAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3is25q0S9K0xHZ75fOV:TLiOUOq0afDdWec9sJf5Q7J5fc
MD5:	E93ACF0820CA08E5A5D2D159729F70E3
SHA1:	2C1A4D4924B9AEC1A796F108607404B000877C5D
SHA-256:	F2267FDA7F45499F7A01186B75CEFB799F8D2BC97E2E9B5068952D477294302C
SHA-512:	3BF36C20E04DCF1C16DC794E272F82F68B0DE43F16B4A9746B63B6D6BBC953B00BD7111CDA7AFE85CEBB2C447145483A382B15E2B0A5B36026C3441635D4E50C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlLu:Ls3Lu
MD5:	BB467E69BD17D5F0C3C99C01ACD20596
SHA1:	ED867EA333E6A25AA5CEB987D2420A2C2F5615C8
SHA-256:	0D7982D70F8AD588F9B4396C42CDE9BD7F2E15EB20F399E2F7E12D43A657C3B8
SHA-512:	2BAB9C869054692753504A961B084E3CB626A417FEA2775D5B25E18CB555620C8C8802C54ECF61061A4B2A0FCCE8DFD42A76145F9B0077BBA34D663457AEC58B
Malicious:	false
Preview:	..........................................1."\|/.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSynchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	3.922828737239167
Encrypted:	false
SSDEEP:	3:2NGw+K+:fwZ+
MD5:	7BAAFE811F480ACFCCCEE0D744355C79
SHA1:	24B89AE82313084BB8BBEB9AD98A550F41DF7B27
SHA-256:	D5743766AF0312C7B7728219FC24A03A4FB1C2A54A506F337953FBC2C1B847C7
SHA-512:	70FE1C197AF507CC0D65E99807D245C896A40A4271BA1121F9B621980877B43019E584C48780951FC1AD2A5D7D146FC6EA4678139A5B38F9B6F7A5F1E2E86BA3
Malicious:	false
Preview:	customSynchronousLookupUris_0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSynchronousLookupUris_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	35302
Entropy (8bit):	7.99333285466604
Encrypted:	true
SSDEEP:	768:rRhaFePY38QBsj61g3g01LXoDGPpgb8KbMcnjrQCckBuJyqk3x8cBBT:rLP+TBK6ZQLXSsaMcnHQQcox80
MD5:	0E06E28C3536360DE3486B1A9E5195E8
SHA1:	EB768267F34EC16A6CCD1966DCA4C3C2870268AB
SHA-256:	F2658B1C913A96E75B45E6ADB464C8D796B34AC43BAF1635AA32E16D1752971C
SHA-512:	45F1E909599E2F63372867BC359CF72FD846619DFEB5359E52D5700E0B1BCFFE5FF07606511A3BFFDDD933A0507195439457E4E29A49EB6451F26186B7240041
Malicious:	false
Preview:	.......murmur3.....IN...9.......0..X..#l....C....]......pv..E..........,..?.N?....V..B-..F.1....g\|..._.>'.-(V... .=.7P.m....#}.r.....>.LE...G.A.h5........J..=..L^-.Zl++,..h..o.y..~j.]u...W...&s.........M..........h3b..[.5.]..V^w.........a....6g3..%.gy../{\|Z.B..X.}5.]..t.1.H&B.[.).$Y......2....L.t...{...[WE.yy.]..e.v0..\.J3..T.`1Lnh.../..-=w...W.&N7.nz.P...z......'i..R6....../....t.[..&-.....T&l..e....$.8.."....Iq....J.v..\|.6.M...zE...a9uw..'.$6.L..m$......NB).JL.G.7}8(`....J.)b.E.m...c.0I.V...\|$....;.k.......8v..l.:..@.F.........K..2...%(...kA......LJd~._A.N.....$3...5....Z"...X=.....%.........6.k.....F..1..l,ia..i.i....y.M..Cl........}.I..r..-+=b.6....%...#...W..K.....=.F....~.....[.......-...../;....~.09..d.....GR..H.lR...m.Huh9.:..A H./)..D.F..Y.n7.....7D.O.a;>Z.K....w...sq..qo3N...8@.zpD.Ku......+.Z=.zNFgP._@.z.ic.......3.....+..j...an%...X..7.q..A.l.7.S2..+....1.s.b..z...@v..!.y...N.C.XQ.p.\..x8(.<.....cq.(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	18
Entropy (8bit):	3.5724312513221195
Encrypted:	false
SSDEEP:	3:kDnaV6bVon:kDYa2
MD5:	5692162977B015E31D5F35F50EFAB9CF
SHA1:	705DC80E8B32AC8B68F7E13CF8A75DCCB251ED7D
SHA-256:	42CCB5159B168DBE5D5DDF026E5F7ED3DBF50873CFE47C7C3EF0677BB07B90D4
SHA-512:	32905A4CC5BCE0FE8502DDD32096F40106625218BEDC4E218A344225D6DF2595A7B70EEB3695DCEFDD894ECB2B66BED479654E8E07F02526648E07ACFE47838C
Malicious:	false
Preview:	edgeSettings_2.0-0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings_2.0-0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3581
Entropy (8bit):	4.459693941095613
Encrypted:	false
SSDEEP:	96:JTMhnytNaSA4BOsNQNhnUZTFGKDIWHCgL5tfHaaJzRHF+P1sYmnfHUdT+GWBH7Y/:KyMot7vjFU
MD5:	BDE38FAE28EC415384B8CFE052306D6C
SHA1:	3019740AF622B58D573C00BF5C98DD77F3FBB5CD
SHA-256:	1F4542614473AE103A5EE3DEEEC61D033A40271CFF891AAA6797534E4DBB4D20
SHA-512:	9C369D69298EBF087412EDA782EE72AFE5448FD0D69EA5141C2744EA5F6C36CDF70A51845CDC174838BAC0ADABDFA70DF6AEDBF6E7867578AE7C4B7805A8B55E
Malicious:	false
Preview:	{"models":[],"geoidMaps":{"gw_my":"https://malaysia.smartscreen.microsoft.com/","gw_tw":"https://taiwan.smartscreen.microsoft.com/","gw_at":"https://austria.smartscreen.microsoft.com/","gw_es":"https://spain.smartscreen.microsoft.com/","gw_pl":"https://poland.smartscreen.microsoft.com/","gw_se":"https://sweden.smartscreen.microsoft.com/","gw_kr":"https://southkorea.smartscreen.microsoft.com/","gw_br":"https://brazil.smartscreen.microsoft.com/","au":"https://australia.smartscreen.microsoft.com/","dk":"https://denmark.smartscreen.microsoft.com/","gw_sg":"https://singapore.smartscreen.microsoft.com/","gw_fr":"https://france.smartscreen.microsoft.com/","gw_ca":"https://canada.smartscreen.microsoft.com/","test":"https://eu-9.smartscreen.microsoft.com/","gw_il":"https://israel.smartscreen.microsoft.com/","gw_au":"https://australia.smartscreen.microsoft.com/","gw_ffl4mod":"https://unitedstates4.ss.wd.microsoft.us/","gw_ffl4":"https://unitedstates1.ss.wd.microsoft.us/","gw_eu":"https://europe.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.493433469104717
Encrypted:	false
SSDEEP:	3:kfKbQSQSuLA5:kyUc5
MD5:	3F90757B200B52DCF5FDAC696EFD3D60
SHA1:	569A2E1BED9ECCDF7CD03E270AEF2BD7FF9B0E77
SHA-256:	1EE63F0A3502CFB7DF195FABBA41A7805008AB2CCCDAEB9AF990409D163D60C8
SHA-512:	39252BBAA33130DF50F36178A8EAB1D09165666D8A229FBB3495DD01CBE964F87CD2E6FCD479DFCA36BE06309EF18FEDA7F14722C57545203BBA24972D4835C8
Malicious:	false
Preview:	synchronousLookupUris_636976985063396749.rel.v2

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris_636976985063396749.rel.v2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	35302
Entropy (8bit):	7.99333285466604
Encrypted:	true
SSDEEP:	768:rRhaFePY38QBsj61g3g01LXoDGPpgb8KbMcnjrQCckBuJyqk3x8cBBT:rLP+TBK6ZQLXSsaMcnHQQcox80
MD5:	0E06E28C3536360DE3486B1A9E5195E8
SHA1:	EB768267F34EC16A6CCD1966DCA4C3C2870268AB
SHA-256:	F2658B1C913A96E75B45E6ADB464C8D796B34AC43BAF1635AA32E16D1752971C
SHA-512:	45F1E909599E2F63372867BC359CF72FD846619DFEB5359E52D5700E0B1BCFFE5FF07606511A3BFFDDD933A0507195439457E4E29A49EB6451F26186B7240041
Malicious:	false
Preview:	.......murmur3.....IN...9.......0..X..#l....C....]......pv..E..........,..?.N?....V..B-..F.1....g\|..._.>'.-(V... .=.7P.m....#}.r.....>.LE...G.A.h5........J..=..L^-.Zl++,..h..o.y..~j.]u...W...&s.........M..........h3b..[.5.]..V^w.........a....6g3..%.gy../{\|Z.B..X.}5.]..t.1.H&B.[.).$Y......2....L.t...{...[WE.yy.]..e.v0..\.J3..T.`1Lnh.../..-=w...W.&N7.nz.P...z......'i..R6....../....t.[..&-.....T&l..e....$.8.."....Iq....J.v..\|.6.M...zE...a9uw..'.$6.L..m$......NB).JL.G.7}8(`....J.)b.E.m...c.0I.V...\|$....;.k.......8v..l.:..@.F.........K..2...%(...kA......LJd~._A.N.....$3...5....Z"...X=.....%.........6.k.....F..1..l,ia..i.i....y.M..Cl........}.I..r..-+=b.6....%...#...W..K.....=.F....~.....[.......-...../;....~.09..d.....GR..H.lR...m.Huh9.:..A H./)..D.F..Y.n7.....7D.O.a;>Z.K....w...sq..qo3N...8@.zpD.Ku......+.Z=.zNFgP._@.z.ic.......3.....+..j...an%...X..7.q..A.l.7.S2..+....1.s.b..z...@v..!.y...N.C.XQ.p.\..x8(.<.....cq.(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	85
Entropy (8bit):	4.3488360343066725
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ25AmIpozQan:YQ3Kq9X0dMgAEiLIM
MD5:	BC6142469CD7DADF107BE9AD87EA4753
SHA1:	72A9AA05003FAB742B0E4DC4C5D9EDA6B9F7565C
SHA-256:	B26DA4F8C7E283AA74386DA0229D66AF14A37986B8CA828E054FC932F68DD557
SHA-512:	47D1A67A16F5DC6D50556C5296E65918F0A2FCAD0E8CEE5795B100FE8CD89EAF5E1FD67691E8A57AF3677883A5D8F104723B1901D11845B286474C8AC56F6182
Malicious:	false
Preview:	{"user_experience_metrics.stability.exited_cleanly":true,"variations_crash_streak":0}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\e20e874b-cd7d-4ebb-ab1d-054f8b3a184c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	26660
Entropy (8bit):	6.058067721112062
Encrypted:	false
SSDEEP:	768:IM7X2zt1jOXtXi3zahctAG9AXzqLp/6yac7GT:IMSzMtXija++HXzyJ6JoGT
MD5:	5C7C0E815A37ED2E7A0064259C215D1B
SHA1:	9FD5E63E1FA3E3C9D315F57C9F6AEBE39AE11747
SHA-256:	93C73312E4811EE3ADC4D13B29328A8B5C13571B747936E7F563387EB1514B9A
SHA-512:	DC54BBD0D53F2CB67B837444BE2926C2A88CBB9ABE1D223155DA98E5F5E3A9F859EC8477B741C7313005AA31A4C765472ED3080993E6A901DA0887189BE59F05
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13365809832396644","browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd1

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2278
Entropy (8bit):	3.8490574427706514
Encrypted:	false
SSDEEP:	48:uiTrlKxrgxqxl9Il8ur4HIAaTh2ybTbq40/QGJzzd1rc:mzYt4daF2q90/QGNU
MD5:	D01B61075B2FE7D56F011BD49FBA95BA
SHA1:	31574E66BC7BF2265FF37700DF75AB93D803EA59
SHA-256:	7757D6BE72A3C893854701B717B686943D0382937F0EAC28338BED5EA72D58E1
SHA-512:	9694CF0B308055EA0660B422F049F08FFED8D47E486D6F8E0D50A3B85FB8E31231F9575F6E722D95AF36E0F5B1D6397C7FD837B40379F3E63FD8160F83B6254E
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".W.i.p.w.W.M.+.N.H.l.b.C.D.m.s.Z.p.8.S.O.s.j.h.t.F.B.s.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.F.m.t.c.l.3.Z.2.g.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.4.M.5.J.b.k.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\cf7513a936f7effbb38627e56f8d1fce10eb12cc.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4622
Entropy (8bit):	4.00401931287714
Encrypted:	false
SSDEEP:	96:iYtq/P0irqrg5+qSmB34+EZhBS24j5J5u5d3dQxUF3:iIq02Mg5+cB3dFjn2V/F3
MD5:	D5BCAC4CA09CB1EA024675434054F33B
SHA1:	9A24D76F7D9BD7E11A56C4D4D8625274DC1DF636
SHA-256:	F94B6B42D7EB1467CD7FC86530D70959ADC66B176E91550ED53F1B5E0073F185
SHA-512:	CDF04771256861540AD2E0B14A7ACCEE17DF10BAFB23E890105D1648665816D0C4D976CF90F129D594EB23D75CABD66C19B45D80EED4DD98ADBB385AF20FCF08
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".z.3.U.T.q.T.b.3.7./.u.z.h.i.f.l.b.4.0.f.z.h.D.r.E.s.w.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".l.O.9.o.W.F.X.Z.2.g.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.w.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.4.M.5.J.b.k.

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Download File

Process:	C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe
File Type:	data
Category:	dropped
Size (bytes):	34383
Entropy (8bit):	5.053402703870376
Encrypted:	false
SSDEEP:	768:QPV3IpNBQkj2Ph4iUxsfrRJv5FqvXhARlardFRgrOdBPtAHkDNZbNKeCMiYo6:QPV3CNBQkj2Ph4iUxsflJnqv6qdPgrOf
MD5:	D63CB5E171D7FCFE28C9E904F6855F08
SHA1:	8C6B004EC20FF61EF4CA9EAFA6F0254364A960AB
SHA-256:	F081E30CF5BB68206C7A59B83BC914B9BD2ED59FBEE26843075D2D0CD7393354
SHA-512:	E9F534C0087182A51D5BE60E14FA992B2B933F444D32C2A2DBA3C7D4FCD6A1F418CF7A6A8B37165A61ED4D5B096716308035E117199A5B94FA796B58C041DB74
Malicious:	false
Preview:	PSMODULECACHE.......CB.z..q...C:\Windows\system32\WindowsPowerShell\v1.0\Modules\DirectAccessClientComponents\DirectAccessClientComponents.psd1........Set-DAEntryPointTableItem....#...Set-DAClientExperienceConfiguration...."...Enable-DAManualEntryPointSelection........Get-DAEntryPointTableItem........Reset-DAEntryPointTableItem....%...Reset-DAClientExperienceConfiguration........Remove-DAEntryPointTableItem........New-DAEntryPointTableItem....#...Get-DAClientExperienceConfiguration....#...Disable-DAManualEntryPointSelection........Rename-DAEntryPointTableItem.........{HB.z..S...C:\Windows\system32\WindowsPowerShell\v1.0\Modules\NetSwitchTeam\NetSwitchTeam.psd1........Get-NetSwitchTeam........Add-NetSwitchTeamMember........Get-NetSwitchTeamMember........Remove-NetSwitchTeamMember........New-NetSwitchTeam........Rename-NetSwitchTeam........Remove-NetSwitchTeam..........zB.z..E...C:\Windows\system32\WindowsPowerShell\v1.0\Modules\NetQos\NetQos.psd1........Get-NetQosPolicy........Remove-Ne

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	2240
Entropy (8bit):	5.363430800301509
Encrypted:	false
SSDEEP:	48:bWSU4xympjgZ9tz4RIoUl8NPP8l7u1iMuge//Zf0UyuE:bLHxvCZfIfSKHOOugo1E
MD5:	51DA01CAEB4BB0BB4796834DDEABA7C7
SHA1:	979661C15FECA9259A6CE69BA2546A213F6951AD
SHA-256:	EDE568A477E17C902A9D29031B0DF241067A2D7F9BF69D225E9229B672F54FEC
SHA-512:	29DC7F57D2AF0CC16609CE754224D36293A36546CF7897CB484C91AB694550CF4BB2711D904AA58E223B4C75BAFD45FCE4967352D60CE8C4E3E3B5429E7E976A
Malicious:	false
Preview:	@...e...........................................................P................1]...E.....j.....(.Microsoft.PowerShell.Commands.ManagementH...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.Automation<...............i..VdqF...\|...........System.Configuration4.................%...K... ...........System.Xml..4.....................@.[8]'.\........System.Data.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServicesH................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<...............V.}...@...i...........System.Transactions.L.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.8..................1...L..U;V.<}........System.Numerics.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Com

C:\Users\user\AppData\Local\Temp\6769954d-eb62-49c5-bc62-915b227bdef1.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0u45maxg.4nm.ps1

Download File

Process:	C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4acs4lxg.44n.ps1

Download File

Process:	C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_dctg1r21.v24.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gla0pqfc.5qf.psm1

Download File

Process:	C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gojapzbd.ht5.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_j1z03n1d.zqk.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_o4w1gltr.mym.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_qxg2esjn.ua0.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_us0ujl5v.xfa.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xviyykxy.cqd.psm1

Download File

Process:	C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\a3b1ef25-dbe9-4025-8d9d-3d469c2dea8f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	105751
Entropy (8bit):	7.719305738470107
Encrypted:	false
SSDEEP:	1536:E+v9bp/IOfeGw7RcWD+64Evk7R1jK5TXHqorAtDwh0dNlTFkfFWG+D85KK:LvLIOm/F9X4EM7LKlKat0nlTqfgRAsK
MD5:	040B397C77DA6B98111443AA677BF619
SHA1:	DF90E14E654EB59AF6A341C8DB17D69195C0D810
SHA-256:	E52D2E8C626E3D3AEC16AB502E53137B3C434326FBE4B178C25967F3B6C4CE7B
SHA-512:	0472F7FD9F94172CDC1D78155DA69ABE9FE218237E6A9E8C6940C5986B02E8A374D55F16D9F163981D3827D41B3D244A59A34139419CF23A4176CF4C4A3ECCD0
Malicious:	false
Preview:	Cr24....8.........0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[........s..'.67.o7..'.....9.G....u....ZP.Y...n.#..^._...t.y.=......@.<.l.8..HC........=B....=..#^y."hnZ!.v......x\b..\|.... Y..ioO.P.......7.iO[....S....+rVB..C..Z.m..Y.c.T'R?ui1..N..'.......O...M..^Xu...$.a.$.....q.$F....O....Zn...@`...H.^..w@.a..lW......[0Y0....H.=....*.H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...G0E. <P......9!.N..7#;.;h'zI.x2HW.....!.. ........g+...:x.@....)...W".&............o..:....~}[...T.].`..........0U.lBUH....>......-m){'.........K....<..K.....n.k..C....gU..._..G_..K?.......5..u).y.....v-.]+.....U=.O..s=}...^..I..'..q..~...E..C{9..7qK...ku.Y\|>..C.52.8..)n?nU..?...[..%......F\<...G..18R=."@.....

C:\Users\user\AppData\Local\Temp\c2748038-a9bb-49a1-9e30-f236c7219e97.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\cv_debug.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	353
Entropy (8bit):	5.369676714402126
Encrypted:	false
SSDEEP:	6:YEtJnmMTc3HAgEu56s/utJnmMznHTg78aLQJjDrwv/utJnmM8HJ56s/C:Y6Q3ggEu56s/APu5L0Dkv/A8p56s/C
MD5:	A855358D63D8B805701C00881BA54F95
SHA1:	56DF955A6FE68AA2469A591D69FFAF8EC28090DD
SHA-256:	FF25F43DBEB2D8C92BA9F9A664574E2EAF7793723C92E662327FBAB2267D57E3
SHA-512:	BA45C3AB82760BA01DB0CB30F0E3074D7C179188E02F3B87C5EA39E09E6C04EE86D6A33BD3D88A0B60EE7D551035EBE49808F02E505EC538AFEFD72E18225983
Malicious:	false
Preview:	{"logTime": "0718/205716", "correlationVector":"e4yzOjsEcKpUD4l3GKfLBQ","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "0718/205716", "correlationVector":"E43E86D6C2A041309BA0AEDBF81F49CD","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "0718/205716", "correlationVector":"1jOZtoZB8Px9C8siZ9XR9i","action":"EXTENSION_UPDATER", "result":""}.

C:\Users\user\AppData\Local\Temp\f9a7a4aa-89d8-4a13-b930-29c55e6fcc45.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\nst47D0.tmp\System.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	11776
Entropy (8bit):	5.890541747176257
Encrypted:	false
SSDEEP:	192:X24sihno0bW+l97H4GB7QDs91kMtwtobTr4u+QHbazMNHT7dmNIEr:m8vJl97JeoxtN/r3z7YV
MD5:	75ED96254FBF894E42058062B4B4F0D1
SHA1:	996503F1383B49021EB3427BC28D13B5BBD11977
SHA-256:	A632D74332B3F08F834C732A103DAFEB09A540823A2217CA7F49159755E8F1D7
SHA-512:	58174896DB81D481947B8745DAFE3A02C150F3938BB4543256E8CCE1145154E016D481DF9FE68DAC6D48407C62CBE20753320EBD5FE5E84806D07CE78E0EB0C4
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......qr.5.D.5.D.5.D...J.2.D.5.E.!.D.....2.D.a0t.1.D.V1n.4.D..3@.4.D.Rich5.D.........PE..L.....oZ...........!..... ...........).......0...............................`............@..........................2.......0..P............................P.......................................................0..X............................text............ .................. ..`.rdata..c....0.......$..............@..@.data...x....@.......(..............@....reloc..~....P.....................@..B................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nst47D0.tmp\modern-header.bmp

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PC bitmap, Windows 3.x format, 150 x 57 x 8, image size 8666, resolution 2834 x 2834 px/m, 255 important colors, cbSize 9740, bits offset 1074
Category:	dropped
Size (bytes):	9740
Entropy (8bit):	6.554125039233327
Encrypted:	false
SSDEEP:	192:bDIK82wKywC116+rwdTKMRjwgKhww4R1jwlIHvNbmwQo8TTJG4:bv82wKywC7DrwdTKMRjwgKhwwY1jwlQq
MD5:	5ACF495828FEAE7F85E006B7774AF497
SHA1:	5D2EEF3EEBB9A72678DCCD404475341116508306
SHA-256:	6CFEBB59F0BA1B9F1E8D7AA6387F223A468EB2FF74A9ED3C3F4BB688C2B6455E
SHA-512:	D1D40C88E2167315A309005B831ACBEAB0919D5A3B1FF5AAA273DB945C8818FC2118EFDB503E4BDA055F309306E72224F54DEF0B1F0AB6F61FE4DBA66784ED68
Malicious:	false
Preview:	BM.&......2...(.......9............!..................,...788.WXX.................................................................h...;m..i...f...O...l...)J[. :G.n...p...o...%AO.....y...W.......o...........8O[.C^l...........#.....................................p...........................................................?AB.....;....+;.>...+y..4....BY.V...f...H...5bz.%DU.j...j...h...d...b...W...N...]....0<.m...Dy..3Zo.c...U...q....Pb.s...v...v...M...y...{...q...}...}.......y............+3.............g...................................Nn..Hfv.................&5=.................................................................................................................................^s~.............................................................................................................................8....Tt.G....!+..........%..................................................\gn.............................................#$%.oqs.....zz{...................................

C:\Users\user\AppData\Local\Temp\nst47D0.tmp\modern-wizard.bmp

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PC bitmap, Windows 3.x format, 164 x 314 x 8, image size 51498, resolution 2834 x 2834 px/m, 255 important colors, cbSize 52572, bits offset 1074
Category:	dropped
Size (bytes):	52572
Entropy (8bit):	7.144132089574
Encrypted:	false
SSDEEP:	192:mfR2FYRtCc9X1uikvgqm+LPTTw9Bu8Skn+x23acmHjZXuxZpCAe9Crxpn319UDSQ:mf0YRt/km+b3wG0nt2UC6rOf
MD5:	7F8E1969B0874C8FB9AB44FC36575380
SHA1:	3057C9CE90A23D29F7D0854472F9F44E87B0F09A
SHA-256:	076221B4527FF13C3E1557ABBBD48B0CB8E5F7D724C6B9171C6AADADB80561DD
SHA-512:	7AA65CFADC2738C0186EF459D0F5F7F770BA0F6DA4CCD55A2CECA23627B7F13BA258136BAB88F4EEE5D9BB70ED0E8EB8BA8E1874B0280D2B08B69FC9BDD81555
Malicious:	false
Preview:	BM\.......2...(.......:...........*.......................Y[[.....z}~.................................................5by.k...6by.m...o...p...q...9dz.s...t...w...x...`...=f{.{.......}...................~...Q...........b.......-FS.~...m...v............%+.................................................................-;B.................................................................................................................................prs.;....AY.4...(m..E...P...\...f...l...n...o...8cz.l...r...q...q...r...s...t...l...v...u...;dz.v...y...w...w...z...i...y...z...{...~...}.......W...Jw..@g\|.....................]...@ey.................Go..............Ch\|.<]o.............................\|...@bt.9Wg.........5P_.....................................................`...c...t...q...............................................[q}.........................Rcl.....................................:....~...Ts.m........... 1;.......................................!.............+,-...........

C:\Users\user\AppData\Local\Temp\nst47D0.tmp\nsDialogs.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	9728
Entropy (8bit):	5.101872593207892
Encrypted:	false
SSDEEP:	192:oF8cSzvTyl4tgi8pPjQM0PuAg0YNy8IFtSP:EBSzm+t18pZ0WAg0R8IFg
MD5:	CA95C9DA8CEF7062813B989AB9486201
SHA1:	C555AF25DF3DE51AA18D487D47408D5245DBA2D1
SHA-256:	FEB6364375D0AB081E9CDF11271C40CB966AF295C600903383B0730F0821C0BE
SHA-512:	A30D94910204D1419C803DC12D90A9D22F63117E4709B1A131D8C4D5EAD7E4121150E2C8B004A546B33C40C294DF0A74567013001F55F37147D86BB847D7BBC9
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......\|..c8O`08O`08O`08Oa0.O`0.@=05O`0llP0=O`0.If09O`0.od09O`0Rich8O`0........PE..L.....oZ...........!.........0...............0............................................@..........................6..k....0.......p...............................................................................0...............................text............................... ..`.rdata..{....0......................@..@.data...h!...@......................@....rsrc........p....... ..............@..@.reloc..v............"..............@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nst47D0.tmp\nsExec.dll

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6656
Entropy (8bit):	5.156301589898623
Encrypted:	false
SSDEEP:	96:cjHFiKaoggCtJzTlKXb0tbo68qD853Ns7GgmkNG3m+s:9bogRtJzTlNR8qD85uGgmkNP
MD5:	3D366250FCF8B755FCE575C75F8C79E4
SHA1:	2EBAC7DF78154738D41AAC8E27D7A0E482845C57
SHA-256:	8BDD996AE4778C6F829E2BCB651C55EFC9EC37EEEA17D259E013B39528DDDBB6
SHA-512:	67D2D88DE625227CCD2CB406B4AC3A215D1770D385C985A44E2285490F49B45F23CE64745B24444E2A0F581335FDA02E913B92781043E8DFD287844435BA9094
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........................,..................Rich...........PE..L.....oZ...........!......................... ...............................P............@..........................$..l.... ..P............................@....................................................... ...............................text............................... ..`.rdata..L.... ......................@..@.data........0......................@....reloc.......@......................@..B................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\scoped_dir5672_2050194923\CRX_INSTALL\128.png

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4982
Entropy (8bit):	7.929761711048726
Encrypted:	false
SSDEEP:	96:L7Rf7U1ylWb3KfyEfOXE+PIcvBirQFiAql1ZwKREkXCSAk:pTvWqfD+gl0sAql1u7kySAk
MD5:	913064ADAAA4C4FA2A9D011B66B33183
SHA1:	99EA751AC2597A080706C690612AEEEE43161FC1
SHA-256:	AFB4CE8882EF7AE80976EBA7D87F6E07FCDDC8E9E84747E8D747D1E996DEA8EB
SHA-512:	162BF69B1AD5122C6154C111816E4B87A8222E6994A72743ED5382D571D293E1467A2ED2FC6CC27789B644943CF617A56DA530B6A6142680C5B2497579A632B5
Malicious:	false
Preview:	.PNG........IHDR..............>a....=IDATx..]}...U..;...O.Q..QH.I(....v..E....GUb..R[.4@%..hK..B..(.B..". ....&)U#.%...jZ...JC.8.....{.cfvgf.3;.....}ow.....{...P.B...T.P.B...*Tx...=.Q..wv.w.....\|.e.1.$.P.?..l_\.n.}...~.g.....Q...A.f....m.....{,...C2 %..X.......FE.1.N..f...Q..D.K87.....:g..Q.{............3@$.8.....{.....q....G.. .....5..y......)XK..F...D.......... ."8...J#.eM.i....H.E.....a.RIP.`......)..T.....! .[p`X.`..L.a....e. .T..2.....H..p$..02...j....\..........s{...Ymm~.a........f.$./.[.{..C.2:.0..6..]....`....NW.....0..o.T..$;k.2......_...k..{,.+........{..6...L..... .dw...l$..}...K...EV....0......P...e....k....+Go....qw.9.1...X2\..qfw0v.....N...{...l.."....f.A..I..+#.v....'..~E.N-k.........{...l.$..ga..1...$......x$X=}.N..S..B$p..`..`.ZG:c..RA.(.0......Gg.A.I..>...3u.u........_..KO.m.........C...,..c.......0...@_..m...-..7.......4LZ......j@.......\..'....u. QJ.:G..I`.w'B0..w.H..'b.0- ......\|..}./.....e..,.K.1........W.u.v. ...\.o

C:\Users\user\AppData\Local\Temp\scoped_dir5672_2050194923\CRX_INSTALL\_locales\af\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	908
Entropy (8bit):	4.512512697156616
Encrypted:	false
SSDEEP:	12:1HASvgMTCBxNB+kCIww3v+BBJ/wjsV8lCBxeBeRiGTCSU8biHULaBg/4srCBhUJJ:1HAkkJ+kCIwEg/wwbw0PXa22QLWmSDg
MD5:	12403EBCCE3AE8287A9E823C0256D205
SHA1:	C82D43C501FAE24BFE05DB8B8F95ED1C9AC54037
SHA-256:	B40BDE5B612CFFF936370B32FB0C58CC205FC89937729504C6C0B527B60E2CBA
SHA-512:	153401ECDB13086D2F65F9B9F20ACB3CEFE5E2AEFF1C31BA021BE35BF08AB0634812C33D1D34DA270E5693A8048FC5E2085E30974F6A703F75EA1622A0CA0FFD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKEP NUWE".. },.. "explanationofflinedisabled": {.. "message": "Jy is vanlyn. As jy Google Dokumente sonder 'n internetverbinding wil gebruik, moet jy die volgende keer as jy aan die internet gekoppel is na instellings op die Google Dokumente-tuisblad gaan en vanlynsinkronisering aanskakel.".. },.. "explanationofflineenabled": {.. "message": "Jy is vanlyn, maar jy kan nog steeds beskikbare l.ers redigeer of nuwes skep.".. },.. "extdesc": {.. "message": "Skep, wysig en bekyk jou dokumente, sigblaaie en aanbiedings . alles sonder toegang tot die internet.".. },.. "extname": {.. "message": "Google Vanlyn Dokumente".. },.. "learnmore": {.. "message": "Kom meer te wete".. },.. "popuphelptext": {.. "message": "Skryf, redigeer en werk saam, waar jy ook al is, met of sonder 'n internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5672_2050194923\CRX_INSTALL\_locales\am\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1285
Entropy (8bit):	4.702209356847184
Encrypted:	false
SSDEEP:	24:1HAn6bfEpxtmqMI91ivWjm/6GcCIoToCZzlgkX/Mj:W6bMt3MITFjm/Pcd4oCZhg6k
MD5:	9721EBCE89EC51EB2BAEB4159E2E4D8C
SHA1:	58979859B28513608626B563138097DC19236F1F
SHA-256:	3D0361A85ADFCD35D0DE74135723A75B646965E775188F7DCDD35E3E42DB788E
SHA-512:	FA3689E8663565D3C1C923C81A620B006EA69C99FB1EB15D07F8F45192ED9175A6A92315FA424159C1163382A3707B25B5FC23E590300C62CBE2DACE79D84871
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ...".. },.. "explanationofflinedisabled": {.. "message": "..... .. .... Google ..... ........ ..... ..... .Google .... ... .. .. .. ..... .... ....... .. ....... ... .. .. ..... .. ..... ....".. },.. "explanationofflineenabled": {.. "message": "..... .. .... ... .. .... .... ..... .... ... ..... .... .....".. },.. "extdesc": {.. "message": "...... ..... .... ... .. ..... ...... ..... .... .. ..... . .... .. ...... .....".. },.. "extname": {.. "message": "..... .. Goog

C:\Users\user\AppData\Local\Temp\scoped_dir5672_2050194923\CRX_INSTALL\_locales\ar\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1244
Entropy (8bit):	4.5533961615623735
Encrypted:	false
SSDEEP:	12:1HASvgPCBxNhieFTr9ogjIxurIyJCCBxeh6wAZKn7uCSUhStuysUm+WCBhSueW1Y:1HAgJzoaC6VEn7Css8yoXzzd
MD5:	3EC93EA8F8422FDA079F8E5B3F386A73
SHA1:	24640131CCFB21D9BC3373C0661DA02D50350C15
SHA-256:	ABD0919121956AB535E6A235DE67764F46CFC944071FCF2302148F5FB0E8C65A
SHA-512:	F40E879F85BC9B8120A9B7357ED44C22C075BF065F45BEA42BD5316AF929CBD035D5D6C35734E454AEF5B79D378E51A77A71FA23F9EBD0B3754159718FCEB95C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....".. },.. "explanationofflinedisabled": {.. "message": "... ... ...... ........ ....... Google ... ..... .......... ..... ... ......... .. ...... ........ ........ Google ..... ........ ... ..... .. ..... ....... .... .... .... ..........".. },.. "explanationofflineenabled": {.. "message": "... ... ...... .... .. .... ....... ..... ....... ....... .. ..... ..... ......".. },.. "extdesc": {.. "message": "..... ......... ...... ........ ....... ......... ........ ....... .. ... ... ..... .........".. },.. "extname": {.. "message": "....... Google ... ......".. },.. "learnmore": {.. "messa

C:\Users\user\AppData\Local\Temp\scoped_dir5672_2050194923\CRX_INSTALL\_locales\az\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.867640976960053
Encrypted:	false
SSDEEP:	24:1HAWNjbwlmyuAoW32Md+80cVLdUSERHtRo3SjX:J3wlzs42m+8TV+S4H0CjX
MD5:	9A798FD298008074E59ECC253E2F2933
SHA1:	1E93DA985E880F3D3350FC94F5CCC498EFC8C813
SHA-256:	628145F4281FA825D75F1E332998904466ABD050E8B0DC8BB9B6A20488D78A66
SHA-512:	9094480379F5AB711B3C32C55FD162290CB0031644EA09A145E2EF315DA12F2E55369D824AF218C3A7C37DD9A276AEEC127D8B3627D3AB45A14B0191ED2BBE70
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN.S.N. YARADIN".. },.. "explanationofflinedisabled": {.. "message": "Oflayns.n.z. Google S.n.di internet ba.lant.s. olmadan istifad. etm.k ist.yirsinizs., Google S.n.din .sas s.hif.sind. ayarlara gedin v. n.vb.ti d.f. internet. qo.ulanda oflayn sinxronizasiyan. aktiv edin.".. },.. "explanationofflineenabled": {.. "message": "Oflayns.n.z, amma m.vcud fayllar. redakt. ed. v. yenil.rini yarada bil.rsiniz.".. },.. "extdesc": {.. "message": "S.n.d, c.dv.l v. t.qdimatlar.n ham.s.n. internet olmadan redakt. edin, yarad.n v. bax.n.".. },.. "extname": {.. "message": "Google S.n.d Oflayn".. },.. "learnmore": {.. "message": ".trafl. M.lumat".. },.. "popuphelptext": {.. "message": "Harda olma..n.zdan v. internet. qo.ulu olub-olmad...n.zdan as.l. olmayaraq, yaz.n, redakt. edin v. .m.kda.l.q edin.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5672_2050194923\CRX_INSTALL\_locales\be\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3107
Entropy (8bit):	3.535189746470889
Encrypted:	false
SSDEEP:	48:YOWdTQ0QRk+QyJQAy6Qg4QWSe+QECTQLHQlQIfyQ0fnWQjQDrTQik+QvkZTQ+89b:GdTbyRvwgbCTEHQhyVues9oOT3rOCkV
MD5:	68884DFDA320B85F9FC5244C2DD00568
SHA1:	FD9C01E03320560CBBB91DC3D1917C96D792A549
SHA-256:	DDF16859A15F3EB3334D6241975CA3988AC3EAFC3D96452AC3A4AFD3644C8550
SHA-512:	7FF0FBD555B1F9A9A4E36B745CBFCAD47B33024664F0D99E8C080BE541420D1955D35D04B5E973C07725573E592CD0DD84FDBB867C63482BAFF6929ADA27CCDE
Malicious:	false
Preview:	{"createnew":{"message":"\u0421\u0422\u0412\u0410\u0420\u042b\u0426\u042c \u041d\u041e\u0412\u042b"},"explanationofflinedisabled":{"message":"\u0412\u044b \u045e \u043f\u0430\u0437\u0430\u0441\u0435\u0442\u043a\u0430\u0432\u044b\u043c \u0440\u044d\u0436\u044b\u043c\u0435. \u041a\u0430\u0431 \u043a\u0430\u0440\u044b\u0441\u0442\u0430\u0446\u0446\u0430 \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u043c\u0456 Google \u0431\u0435\u0437 \u043f\u0430\u0434\u043a\u043b\u044e\u0447\u044d\u043d\u043d\u044f \u0434\u0430 \u0456\u043d\u0442\u044d\u0440\u043d\u044d\u0442\u0443, \u043f\u0435\u0440\u0430\u0439\u0434\u0437\u0456\u0446\u0435 \u0434\u0430 \u043d\u0430\u043b\u0430\u0434 \u043d\u0430 \u0433\u0430\u043b\u043e\u045e\u043d\u0430\u0439 \u0441\u0442\u0430\u0440\u043e\u043d\u0446\u044b \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u045e Google \u0456 \u045e\u043a\u043b\u044e\u0447\u044b\u0446\u0435 \u0441\u0456\u043d\u0445\u0440\u0430\u043d\u0456\u0437\u0430\u0446\u044b\u044e

C:\Users\user\AppData\Local\Temp\scoped_dir5672_2050194923\CRX_INSTALL\_locales\bg\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1389
Entropy (8bit):	4.561317517930672
Encrypted:	false
SSDEEP:	24:1HAp1DQqUfZ+Yann08VOeadclUZbyMzZzsYvwUNn7nOyRK8/nn08V7:g1UTfZ+Ya08Uey3tflCRE08h
MD5:	2E6423F38E148AC5A5A041B1D5989CC0
SHA1:	88966FFE39510C06CD9F710DFAC8545672FFDCEB
SHA-256:	AC4A8B5B7C0B0DD1C07910F30DCFBDF1BCB701CFCFD182B6153FD3911D566C0E
SHA-512:	891FCDC6F07337970518322C69C6026896DD3588F41F1E6C8A1D91204412CAE01808F87F9F2DEA1754458D70F51C3CEF5F12A9E3FC011165A42B0844C75EC683
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. .. .......... Google ......... ... ........ ......, ........ ........... . ......... ........ .. Google ......... . ........ ...... .............. ......... ..., ...... ..... ...... . .........".. },.. "explanationofflineenabled": {.. "message": "...... ..., .. ... ...... .. ........... ......... ....... ... .. ......... .....".. },.. "extdesc": {.. "message": "............, .......... . ............ ...... ........., .......... ....... . ........... . ...... .... ... ...... .. .........".. },..

C:\Users\user\AppData\Local\Temp\scoped_dir5672_2050194923\CRX_INSTALL\_locales\bn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1763
Entropy (8bit):	4.25392954144533
Encrypted:	false
SSDEEP:	24:1HABGtNOtIyHmVd+q+3X2AFl2DhrR7FAWS9+SMzI8QVAEq8yB0XtfOyvU7D:oshmm/+H2Ml2DrFPS9+S99EzBd7D
MD5:	651375C6AF22E2BCD228347A45E3C2C9
SHA1:	109AC3A912326171D77869854D7300385F6E628C
SHA-256:	1DBF38E425C5C7FC39E8077A837DF0443692463BA1FBE94E288AB5A93242C46E
SHA-512:	958AA7CF645FAB991F2ECA0937BA734861B373FB1C8BCC001599BE57C65E0917F7833A971D93A7A6423C5F54A4839D3A4D5F100C26EFA0D2A068516953989F9D
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ....".. },.. "explanationofflinedisabled": {.. "message": ".... ....... ....... .... ......... ..... ..... Google ........ ....... ...., Google .......... ........ ....... ... ... .... ... .... ... ........... .... ....... .... ... ...... ..... .... .....".. },.. "explanationofflineenabled": {.. "message": ".... ....... ......, ...... .... .... ...... .......... ........ .... .. .... .... .... .... .......".. },.. "extdesc":

C:\Users\user\AppData\Local\Temp\scoped_dir5672_2050194923\CRX_INSTALL\_locales\ca\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	930
Entropy (8bit):	4.569672473374877
Encrypted:	false
SSDEEP:	12:1HASvggoSCBxNFT0sXuqgEHQ2fTq9blUJYUJaw9CBxejZFPLOjCSUuE44pMiiDat:1HAtqs+BEHGpURxSp1iUPWCAXtRKe
MD5:	D177261FFE5F8AB4B3796D26835F8331
SHA1:	4BE708E2FFE0F018AC183003B74353AD646C1657
SHA-256:	D6E65238187A430FF29D4C10CF1C46B3F0FA4B91A5900A17C5DFD16E67FFC9BD
SHA-512:	E7D730304AED78C0F4A78DADBF835A22B3D8114FB41D67B2B26F4FE938B572763D3E127B7C1C81EBE7D538DA976A7A1E7ADC40F918F88AFADEA2201AE8AB47D0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA'N UN DE NOU".. },.. "explanationofflinedisabled": {.. "message": "No tens connexi.. Per utilitzar Documents de Google sense connexi. a Internet, ves a la configuraci. de la p.gina d'inici d'aquest servei i activa l'opci. per sincronitzar-se sense connexi. la propera vegada que estiguis connectat a la xarxa.".. },.. "explanationofflineenabled": {.. "message": "Tot i que no tens connexi., pots editar o crear fitxers.".. },.. "extdesc": {.. "message": "Edita, crea i consulta documents, fulls de c.lcul i presentacions, tot sense acc.s a Internet.".. },.. "extname": {.. "message": "Documents de Google sense connexi.".. },.. "learnmore": {.. "message": "M.s informaci.".. },.. "popuphelptext": {.. "message": "Escriu text, edita fitxers i col.labora-hi siguis on siguis, amb o sense connexi. a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5672_2050194923\CRX_INSTALL\_locales\cs\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	913
Entropy (8bit):	4.947221919047
Encrypted:	false
SSDEEP:	12:1HASvgdsbCBxNBmobXP15Dxoo60n40h6qCBxeBeGG/9jZCSUKFPDLZ2B2hCBhPLm:1HApJmoZ5e50nzQhwAd7dvYB2kDSGGKs
MD5:	CCB00C63E4814F7C46B06E4A142F2DE9
SHA1:	860936B2A500CE09498B07A457E0CCA6B69C5C23
SHA-256:	21AE66CE537095408D21670585AD12599B0F575FF2CB3EE34E3A48F8CC71CFAB
SHA-512:	35839DAC6C985A6CA11C1BFF5B8B5E59DB501FCB91298E2C41CB0816B6101BF322445B249EAEA0CEF38F76D73A4E198F2B6E25EEA8D8A94EA6007D386D4F1055
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVO.IT".. },.. "explanationofflinedisabled": {.. "message": "Jste offline. Pokud chcete Dokumenty Google pou..vat bez p.ipojen. k.internetu, a. budete p...t. online, p.ejd.te do nastaven. na domovsk. str.nce Dokument. Google a.zapn.te offline synchronizaci.".. },.. "explanationofflineenabled": {.. "message": "Jste offline, ale st.le m..ete upravovat dostupn. soubory nebo vytv..et nov..".. },.. "extdesc": {.. "message": "Upravujte, vytv..ejte a.zobrazujte sv. dokumenty, tabulky a.prezentace . v.e bez p..stupu k.internetu.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Dal.. informace".. },.. "popuphelptext": {.. "message": "Pi.te, upravujte a.spolupracujte kdekoli, s.p.ipojen.m k.internetu i.bez n.j.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5672_2050194923\CRX_INSTALL\_locales\cy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	806
Entropy (8bit):	4.815663786215102
Encrypted:	false
SSDEEP:	12:YGo35xMxy6gLr4Dn1eBVa1xzxyn1VFQB6FDVgdAJex9QH7uy+XJEjENK32J21j:Y735+yoeeRG54uDmdXx9Q7u3r83Xj
MD5:	A86407C6F20818972B80B9384ACFBBED
SHA1:	D1531CD0701371E95D2A6BB5EDCB79B949D65E7C
SHA-256:	A482663292A913B02A9CDE4635C7C92270BF3C8726FD274475DC2C490019A7C9
SHA-512:	D9FBF675514A890E9656F83572208830C6D977E34D5744C298A012515BC7EB5A17726ADD0D9078501393BABD65387C4F4D3AC0CC0F7C60C72E09F336DCA88DE7
Malicious:	false
Preview:	{"createnew":{"message":"CREU NEWYDD"},"explanationofflinedisabled":{"message":"Rydych chi all-lein. I ddefnyddio Dogfennau Google heb gysylltiad \u00e2'r rhyngrwyd, ewch i'r gosodiadau ar dudalen hafan Dogfennau Google a throi 'offine sync' ymlaen y tro nesaf y byddwch wedi'ch cysylltu \u00e2'r rhyngrwyd."},"explanationofflineenabled":{"message":"Rydych chi all-lein, ond gallwch barhau i olygu'r ffeiliau sydd ar gael neu greu rhai newydd."},"extdesc":{"message":"Gallwch olygu, creu a gweld eich dogfennau, taenlenni a chyflwyniadau \u2013 i gyd heb fynediad i'r rhyngrwyd."},"extname":{"message":"Dogfennau Google All-lein"},"learnmore":{"message":"DYSGU MWY"},"popuphelptext":{"message":"Ysgrifennwch, golygwch a chydweithiwch lle bynnag yr ydych, gyda chysylltiad \u00e2'r rhyngrwyd neu hebddo."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir5672_2050194923\CRX_INSTALL\_locales\da\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	883
Entropy (8bit):	4.5096240460083905
Encrypted:	false
SSDEEP:	24:1HA4EFkQdUULMnf1yo+9qgpukAXW9bGJTvDyqdr:zEFkegfw9qwAXWNs/yu
MD5:	B922F7FD0E8CCAC31B411FC26542C5BA
SHA1:	2D25E153983E311E44A3A348B7D97AF9AAD21A30
SHA-256:	48847D57C75AF51A44CBF8F7EF1A4496C2007E58ED56D340724FDA1604FF9195
SHA-512:	AD0954DEEB17AF04858DD5EC3D3B3DA12DFF7A666AF4061DEB6FD492992D95DB3BAF751AB6A59BEC7AB22117103A93496E07632C2FC724623BB3ACF2CA6093F3
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPRET NYT".. },.. "explanationofflinedisabled": {.. "message": "Du er offline. Hvis du vil bruge Google Docs uden en internetforbindelse, kan du g. til indstillinger p. startsiden for Google Docs og aktivere offlinesynkronisering, n.ste gang du har internetforbindelse.".. },.. "explanationofflineenabled": {.. "message": "Du er offline, men du kan stadig redigere tilg.ngelige filer eller oprette nye.".. },.. "extdesc": {.. "message": "Rediger, opret og se dine dokumenter, regneark og pr.sentationer helt uden internetadgang.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "F. flere oplysninger".. },.. "popuphelptext": {.. "message": "Skriv, rediger og samarbejd, uanset hvor du er, og uanset om du har internetforbindelse.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5672_2050194923\CRX_INSTALL\_locales\de\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1031
Entropy (8bit):	4.621865814402898
Encrypted:	false
SSDEEP:	24:1HA6sZnqWd77ykJzCkhRhoe1HMNaAJPwG/p98HKpy2kX/R:WZqWxykJzthRhoQma+tpyHX2O/R
MD5:	D116453277CC860D196887CEC6432FFE
SHA1:	0AE00288FDE696795CC62FD36EABC507AB6F4EA4
SHA-256:	36AC525FA6E28F18572D71D75293970E0E1EAD68F358C20DA4FDC643EEA2C1C5
SHA-512:	C788C3202A27EC220E3232AE25E3C855F3FDB8F124848F46A3D89510C564641A2DFEA86D5014CEA20D3D2D3C1405C96DBEB7CCAD910D65C55A32FDCA8A33FDD4
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NEU ERSTELLEN".. },.. "explanationofflinedisabled": {.. "message": "Sie sind offline. Um Google Docs ohne Internetverbindung zu verwenden, gehen Sie auf der Google Docs-Startseite auf \"Einstellungen\" und schalten die Offlinesynchronisierung ein, wenn Sie das n.chste Mal mit dem Internet verbunden sind.".. },.. "explanationofflineenabled": {.. "message": "Sie sind offline, aber k.nnen weiterhin verf.gbare Dateien bearbeiten oder neue Dateien erstellen.".. },.. "extdesc": {.. "message": "Mit der Erweiterung k.nnen Sie Dokumente, Tabellen und Pr.sentationen bearbeiten, erstellen und aufrufen.. ganz ohne Internetverbindung.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Weitere Informationen".. },.. "popuphelptext": {.. "message": "Mit oder ohne Internetverbindung: Sie k.nnen von .berall Dokumente erstellen, .ndern und zusammen mit anderen

C:\Users\user\AppData\Local\Temp\scoped_dir5672_2050194923\CRX_INSTALL\_locales\el\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1613
Entropy (8bit):	4.618182455684241
Encrypted:	false
SSDEEP:	24:1HAJKan4EITDZGoziRAc2Z8eEfkTJfLhGX7b0UBNoAcGpVyhxefSmuq:SKzTD0IK85JlwsGOUyaSk
MD5:	9ABA4337C670C6349BA38FDDC27C2106
SHA1:	1FC33BE9AB4AD99216629BC89FBB30E7AA42B812
SHA-256:	37CA6AB271D6E7C9B00B846FDB969811C9CE7864A85B5714027050795EA24F00
SHA-512:	8564F93AD8485C06034A89421CE74A4E719BBAC865E33A7ED0B87BAA80B7F7E54B240266F2EDB595DF4E6816144428DB8BE18A4252CBDCC1E37B9ECC9F9D7897
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......... ....".. },.. "explanationofflinedisabled": {.. "message": "..... ..... ......... ... .. ............... .. ....... Google ..... ....... ... ........., ......... .... ......... .... ...... ...... ... ........ Google ... ............. ... ........... ..... ........ ... ....... .... ... .. ..... ............ ... ..........".. },.. "explanationofflineenabled": {.. "message": "..... ..... ........ .... ........ .. .............. .. ......... ...... . .. ............. ... .......".. },.. "extdesc": {.. "message": ".............., ............ ... ..... .. ......., .

C:\Users\user\AppData\Local\Temp\scoped_dir5672_2050194923\CRX_INSTALL\_locales\en\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5672_2050194923\CRX_INSTALL\_locales\en_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5672_2050194923\CRX_INSTALL\_locales\en_GB\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	848
Entropy (8bit):	4.494568170878587
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3vRyc1NzXW6iFrSCBxesJGceKCSUuvlvOgwCBhUufz1tnaXrQ:1HA3djfR3NzXviFrJj4sJXJ+bA6RM
MD5:	3734D498FB377CF5E4E2508B8131C0FA
SHA1:	AA23E39BFE526B5E3379DE04E00EACBA89C55ADE
SHA-256:	AB5CDA04013DCE0195E80AF714FBF3A67675283768FFD062CF3CF16EDB49F5D4
SHA-512:	56D9C792954214B0DE56558983F7EB7805AC330AF00E944E734340BE41C68E5DD03EDDB17A63BC2AB99BDD9BE1F2E2DA5BE8BA7C43D938A67151082A9041C7BA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an Internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the Internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create and view your documents, spreadsheets and presentations . all without Internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn more".. },.. "popuphelptext": {.. "message": "Write, edit and collaborate wherever you are, with or without an Internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5672_2050194923\CRX_INSTALL\_locales\en_US\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1425
Entropy (8bit):	4.461560329690825
Encrypted:	false
SSDEEP:	24:1HA6Krbbds5Kna/BNzXviFrpsCxKU4irpNQ0+qWK5yOJAaCB7MAa6:BKrbBs5Kna/BNzXvi3sCxKZirA0jWK5m
MD5:	578215FBB8C12CB7E6CD73FBD16EC994
SHA1:	9471D71FA6D82CE1863B74E24237AD4FD9477187
SHA-256:	102B586B197EA7D6EDFEB874B97F95B05D229EA6A92780EA8544C4FF1E6BC5B1
SHA-512:	E698B1A6A6ED6963182F7D25AC12C6DE06C45D14499DDC91E81BDB35474E7EC9071CFEBD869B7D129CB2CD127BC1442C75E408E21EB8E5E6906A607A3982B212
Malicious:	false
Preview:	{.. "createNew": {.. "description": "Text shown in the extension pop up for creating a new document",.. "message": "CREATE NEW".. },.. "explanationOfflineDisabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is disabled.",.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationOfflineEnabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is enabled.",.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extDesc": {.. "description": "Extension description",.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extName": {.. "description": "Extension name",..

C:\Users\user\AppData\Local\Temp\scoped_dir5672_2050194923\CRX_INSTALL\_locales\es\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	961
Entropy (8bit):	4.537633413451255
Encrypted:	false
SSDEEP:	12:1HASvggeCBxNFxcw2CVcfamedatqWCCBxeFxCF/m+rWAaFQbCSUuExqIQdO06stp:1HAqn0gcfa9dc/5mCpmIWck02USfWmk
MD5:	F61916A206AC0E971CDCB63B29E580E3
SHA1:	994B8C985DC1E161655D6E553146FB84D0030619
SHA-256:	2008F4FAAB71AB8C76A5D8811AD40102C380B6B929CE0BCE9C378A7CADFC05EB
SHA-512:	D9C63B2F99015355ACA04D74A27FD6B81170750C4B4BE7293390DC81EF4CD920EE9184B05C61DC8979B6C2783528949A4AE7180DBF460A2620DBB0D3FD7A05CF
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a Configuraci.n en la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que te conectes a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n. Aun as., puedes crear archivos o editar los que est.n disponibles.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones; todo ello, sin acceso a Internet.".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe o edita contenido y colabora con otras personas desde cualquier lugar, con o sin conexi.n a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5672_2050194923\CRX_INSTALL\_locales\es_419\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	959
Entropy (8bit):	4.570019855018913
Encrypted:	false
SSDEEP:	24:1HARn05cfa9dcDmQOTtSprj0zaGUSjSGZ:+n0CfMcDmQOTQprj4qpC
MD5:	535331F8FB98894877811B14994FEA9D
SHA1:	42475E6AFB6A8AE41E2FC2B9949189EF9BBE09FB
SHA-256:	90A560FF82605DB7EDA26C90331650FF9E42C0B596CEDB79B23598DEC1B4988F
SHA-512:	2CE9C69E901AB5F766E6CFC1E592E1AF5A07AA78D154CCBB7898519A12E6B42A21C5052A86783ABE3E7A05043D4BD41B28960FEDDB30169FF7F7FE7208C8CFE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NUEVO".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a la configuraci.n de la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que est.s conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n, pero a.n puedes modificar los archivos disponibles o crear otros nuevos.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones aunque no tengas acceso a Internet".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, modifica y colabora dondequiera que est.s, con conexi.n a Internet o sin ella.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5672_2050194923\CRX_INSTALL\_locales\et\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	968
Entropy (8bit):	4.633956349931516
Encrypted:	false
SSDEEP:	24:1HA5WG6t306+9sihHvMfdJLjUk4NJPNczGr:mWGY0cOUdJODPmzs
MD5:	64204786E7A7C1ED9C241F1C59B81007
SHA1:	586528E87CD670249A44FB9C54B1796E40CDB794
SHA-256:	CC31B877238DA6C1D51D9A6155FDE565727A1956572F466C387B7E41C4923A29
SHA-512:	44FCF93F3FB10A3DB68D74F9453995995AB2D16863EC89779DB451A4D90F19743B8F51095EEC3ECEF5BD0C5C60D1BF3DFB0D64DF288DCCFBE70C129AE350B2C6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LOO UUS".. },.. "explanationofflinedisabled": {.. "message": "Teil ei ole v.rgu.hendust. Teenuse Google.i dokumendid kasutamiseks ilma Interneti-.henduseta avage j.rgmine kord, kui olete Internetiga .hendatud, teenuse Google.i dokumendid avalehel seaded ja l.litage sisse v.rgu.henduseta s.nkroonimine.".. },.. "explanationofflineenabled": {.. "message": "Teil ei ole v.rgu.hendust, kuid saate endiselt saadaolevaid faile muuta v.i uusi luua.".. },.. "extdesc": {.. "message": "Saate luua, muuta ja vaadata oma dokumente, arvustustabeleid ning esitlusi ilma Interneti-.henduseta.".. },.. "extname": {.. "message": "V.rgu.henduseta Google.i dokumendid".. },.. "learnmore": {.. "message": "Lisateave".. },.. "popuphelptext": {.. "message": "Kirjutage, muutke ja tehke koost..d .ksk.ik kus olenemata sellest, kas teil on Interneti-.hendus.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5672_2050194923\CRX_INSTALL\_locales\eu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	838
Entropy (8bit):	4.4975520913636595
Encrypted:	false
SSDEEP:	24:YnmjggqTWngosqYQqE1kjO39m7OddC0vjWQMmWgqwgQ8KLcxOb:Ynmsgqyngosq9qxTOs0vjWQMbgqchb
MD5:	29A1DA4ACB4C9D04F080BB101E204E93
SHA1:	2D0E4587DDD4BAC1C90E79A88AF3BD2C140B53B1
SHA-256:	A41670D52423BA69C7A65E7E153E7B9994E8DD0370C584BDA0714BD61C49C578
SHA-512:	B7B7A5A0AA8F6724B0FA15D65F25286D9C66873F03080CBABA037BDEEA6AADC678AC4F083BC52C2DB01BEB1B41A755ED67BBDDB9C0FE4E35A004537A3F7FC458
Malicious:	false
Preview:	{"createnew":{"message":"SORTU"},"explanationofflinedisabled":{"message":"Ez zaude konektatuta Internetera. Google Dokumentuak konexiorik gabe erabiltzeko, joan Google Dokumentuak zerbitzuaren orri nagusiko ezarpenetara eta aktibatu konexiorik gabeko sinkronizazioa Internetera konektatzen zaren hurrengoan."},"explanationofflineenabled":{"message":"Ez zaude konektatuta Internetera, baina erabilgarri dauden fitxategiak edita ditzakezu, baita beste batzuk sortu ere."},"extdesc":{"message":"Editatu, sortu eta ikusi dokumentuak, kalkulu-orriak eta aurkezpenak Interneteko konexiorik gabe."},"extname":{"message":"Google Dokumentuak konexiorik gabe"},"learnmore":{"message":"Lortu informazio gehiago"},"popuphelptext":{"message":"Edonon zaudela ere, ez duzu zertan konektatuta egon idatzi, editatu eta lankidetzan jardun ahal izateko."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir5672_2050194923\CRX_INSTALL\_locales\fa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1305
Entropy (8bit):	4.673517697192589
Encrypted:	false
SSDEEP:	24:1HAX9yM7oiI99Rwx4xyQakJbfAEJhmq/RlBu92P7FbNcgYVJ0:JM7ovex4xyQaKjAEyq/p7taX0
MD5:	097F3BA8DE41A0AAF436C783DCFE7EF3
SHA1:	986B8CABD794E08C7AD41F0F35C93E4824AC84DF
SHA-256:	7C4C09D19AC4DA30CC0F7F521825F44C4DFBC19482A127FBFB2B74B3468F48F1
SHA-512:	8114EA7422E3B20AE3F08A3A64A6FFE1517A7579A3243919B8F789EB52C68D6F5A591F7B4D16CEE4BD337FF4DAF4057D81695732E5F7D9E761D04F859359FADB
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ... ....".. },.. "explanationofflinedisabled": {.. "message": "...... ...... .... ....... .. ....... Google .... ..... ........ .... ... .. .. ....... ... ..... .. ....... .. .... .... ....... Google ..... . .......... ...... .. .... .....".. },.. "explanationofflineenabled": {.. "message": "...... ..... ... ...... ......... ......... .. .. .. ..... ..... ...... .... .. ........ ..... ..... .....".. },.. "extdesc": {.. "message": "...... ............ . ........ .. ....... ..... . ...... .... . ... ... ..... .... ...... .. ........".. },.. "extname": {.. "message": "....... Google .

C:\Users\user\AppData\Local\Temp\scoped_dir5672_2050194923\CRX_INSTALL\_locales\fi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	911
Entropy (8bit):	4.6294343834070935
Encrypted:	false
SSDEEP:	12:1HASvguCBxNMME2BESA7gPQk36xCBxeMMcXYBt+CSU1pfazCBhUunV1tLaX5GI2N:1HAVioESAsPf36O3Xst/p3J8JeEY
MD5:	B38CBD6C2C5BFAA6EE252D573A0B12A1
SHA1:	2E490D5A4942D2455C3E751F96BD9960F93C4B60
SHA-256:	2D752A5DBE80E34EA9A18C958B4C754F3BC10D63279484E4DF5880B8FD1894D2
SHA-512:	6E65207F4D8212736059CC802C6A7104E71A9CC0935E07BD13D17EC46EA26D10BC87AD923CD84D78781E4F93231A11CB9ED8D3558877B6B0D52C07CB005F1C0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LUO UUSI".. },.. "explanationofflinedisabled": {.. "message": "Olet offline-tilassa. Jos haluat k.ytt.. Google Docsia ilman internetyhteytt., siirry Google Docsin etusivulle ja ota asetuksissa k.ytt..n offline-synkronointi, kun seuraavan kerran olet yhteydess. internetiin.".. },.. "explanationofflineenabled": {.. "message": "Olet offline-tilassa. Voit kuitenkin muokata k.ytett.viss. olevia tiedostoja tai luoda uusia.".. },.. "extdesc": {.. "message": "Muokkaa, luo ja katso dokumentteja, laskentataulukoita ja esityksi. ilman internetyhteytt..".. },.. "extname": {.. "message": "Google Docsin offline-tila".. },.. "learnmore": {.. "message": "Lis.tietoja".. },.. "popuphelptext": {.. "message": "Kirjoita, muokkaa ja tee yhteisty.t. paikasta riippumatta, my.s ilman internetyhteytt..".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5672_2050194923\CRX_INSTALL\_locales\fil\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	939
Entropy (8bit):	4.451724169062555
Encrypted:	false
SSDEEP:	24:1HAXbH2eZXn6sjLITdRSJpGL/gWFJ3sqixO:ubHfZqsHIT/FLL3qO
MD5:	FCEA43D62605860FFF41BE26BAD80169
SHA1:	F25C2CE893D65666CC46EA267E3D1AA080A25F5B
SHA-256:	F51EEB7AAF5F2103C1043D520E5A4DE0FA75E4DC375E23A2C2C4AFD4D9293A72
SHA-512:	F66F113A26E5BCF54B9AAFA69DAE3C02C9C59BD5B9A05F829C92AF208C06DC8CCC7A1875CBB7B7CE425899E4BA27BFE8CE2CDAF43A00A1B9F95149E855989EE0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "GUMAWA NG BAGO".. },.. "explanationofflinedisabled": {.. "message": "Naka-offline ka. Upang magamit ang Google Docs nang walang koneksyon sa internet, pumunta sa mga setting sa homepage ng Google Docs at i-on ang offline na pag-sync sa susunod na nakakonekta ka sa internet.".. },.. "explanationofflineenabled": {.. "message": "Naka-offline ka, ngunit maaari mo pa ring i-edit ang mga available na file o gumawa ng mga bago.".. },.. "extdesc": {.. "message": "I-edit, gawin, at tingnan ang iyong mga dokumento, spreadsheet, at presentation . lahat ng ito nang walang access sa internet.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Matuto Pa".. },.. "popuphelptext": {.. "message": "Magsulat, mag-edit at makipag-collaborate nasaan ka man, nang mayroon o walang koneksyon sa internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5672_2050194923\CRX_INSTALL\_locales\fr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.622066056638277
Encrypted:	false
SSDEEP:	24:1HAdy42ArMdsH50Jd6Z1PCBolXAJ+GgNHp0X16M1J1:EyfArMS2Jd6Z1PCBolX2+vNmX16Y1
MD5:	A58C0EEBD5DC6BB5D91DAF923BD3A2AA
SHA1:	F169870EEED333363950D0BCD5A46D712231E2AE
SHA-256:	0518287950A8B010FFC8D52554EB82E5D93B6C3571823B7CECA898906C11ABCC
SHA-512:	B04AFD61DE490BC838354E8DC6C22BE5C7AC6E55386FFF78489031ACBE2DBF1EAA2652366F7A1E62CE87CFCCB75576DA3B2645FEA1645B0ECEB38B1FA3A409E8
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour pouvoir utiliser Google.Docs sans connexion Internet, acc.dez aux param.tres de la page d'accueil de Google.Docs et activez la synchronisation hors connexion lors de votre prochaine connexion . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez quand m.me modifier les fichiers disponibles ou cr.er des fichiers.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez des documents, feuilles de calcul et pr.sentations, sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Docs hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": "R.digez des documents, modifiez-les et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5672_2050194923\CRX_INSTALL\_locales\fr_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	972
Entropy (8bit):	4.621319511196614
Encrypted:	false
SSDEEP:	24:1HAdyg2pwbv1V8Cd61PC/vT2fg3YHDyM1J1:EyHpwbpd61C/72Y3YOY1
MD5:	6CAC04BDCC09034981B4AB567B00C296
SHA1:	84F4D0E89E30ED7B7ACD7644E4867FFDB346D2A5
SHA-256:	4CAA46656ECC46A420AA98D3307731E84F5AC1A89111D2E808A228C436D83834
SHA-512:	160590B6EC3DCF48F3EA7A5BAA11A8F6FA4131059469623E00AD273606B468B3A6E56D199E97DAA0ECB6C526260EBAE008570223F2822811F441D1C900DC33D6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour utiliser Google.Documents sans connexion Internet, acc.dez aux param.tres sur la page d'accueil Google.Documents et activez la synchronisation hors ligne la prochaine fois que vous .tes connect. . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez toujours modifier les fichiers disponibles ou en cr.er.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez vos documents, vos feuilles de calcul et vos pr.sentations, le tout sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Documents hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": ".crivez, modifiez et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5672_2050194923\CRX_INSTALL\_locales\gl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	990
Entropy (8bit):	4.497202347098541
Encrypted:	false
SSDEEP:	12:1HASvggECBxNbWVqMjlMgaPLqXPhTth0CBxebWbMRCSUCjAKFCSIj0tR7tCBhP1l:1HACzWsMlajIhJhHKWbFKFC0tR8oNK5
MD5:	6BAAFEE2F718BEFBC7CD58A04CCC6C92
SHA1:	CE0BDDDA2FA1F0AD222B604C13FF116CBB6D02CF
SHA-256:	0CF098DFE5BBB46FC0132B3CF0C54B06B4D2C8390D847EE2A65D20F9B7480F4C
SHA-512:	3DA23E74CD6CF9C0E2A0C4DBA60301281D362FB0A2A908F39A55ABDCA4CC69AD55638C63CC3BEFD44DC032F9CBB9E2FDC1B4C4ABE292917DF8272BA25B82AF20
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est.s sen conexi.n. Para utilizar Documentos de Google sen conexi.n a Internet, accede .s opci.ns de configuraci.n na p.xina de inicio de Documentos de Google e activa a sincronizaci.n sen conexi.n a pr.xima vez que esteas conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "Est.s sen conexi.n. A.nda podes editar os ficheiros dispo.ibles ou crear outros novos.".. },.. "extdesc": {.. "message": "Modifica, crea e consulta os teus documentos, follas de c.lculo e presentaci.ns sen necesidade de acceder a Internet.".. },.. "extname": {.. "message": "Documentos de Google sen conexi.n".. },.. "learnmore": {.. "message": "M.is informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, edita e colabora esteas onde esteas, tanto se tes conexi.n a Internet como se non a tes.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5672_2050194923\CRX_INSTALL\_locales\gu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1658
Entropy (8bit):	4.294833932445159
Encrypted:	false
SSDEEP:	24:1HA3k3FzEVeXWuvLujNzAK11RiqRC2sA0O3cEiZ7dPRFFOPtZdK0A41yG3BczKT3:Q4pE4rCjNjw6/0y+5j8ZHA4PBSKr
MD5:	BC7E1D09028B085B74CB4E04D8A90814
SHA1:	E28B2919F000B41B41209E56B7BF3A4448456CFE
SHA-256:	FE8218DF25DB54E633927C4A1640B1A41B8E6CB3360FA386B5382F833B0B237C
SHA-512:	040A8267D67DB05BBAA52F1FAC3460F58D35C5B73AA76BBF17FA78ACC6D3BFB796A870DD44638F9AC3967E35217578A20D6F0B975CEEEEDBADFC9F65BE7E72C9
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .....".. },.. "explanationofflinedisabled": {.. "message": "... ...... ... ........ ....... ... Google .......... ..... .... ...., ... .... .... ...... ........ .... ...... ... ...... Google ........ ...... .. ........ .. ... ... ...... ....... .... ....".. },.. "explanationofflineenabled": {.. "message": "... ...... .., ..... ... ... .. ...... ..... ....... ... ... .. .... ... ..... ... ...".. },.. "extdesc": {.. "message": "..... ........., ..

C:\Users\user\AppData\Local\Temp\scoped_dir5672_2050194923\CRX_INSTALL\_locales\hi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1672
Entropy (8bit):	4.314484457325167
Encrypted:	false
SSDEEP:	48:46G2+ymELbLNzGVx/hXdDtxSRhqv7Qm6/7Lm:4GbxzGVzXdDtx+qzU/7C
MD5:	98A7FC3E2E05AFFFC1CFE4A029F47476
SHA1:	A17E077D6E6BA1D8A90C1F3FAF25D37B0FF5A6AD
SHA-256:	D2D1AFA224CDA388FF1DC8FAC24CDA228D7CE09DE5D375947D7207FA4A6C4F8D
SHA-512:	457E295C760ABFD29FC6BBBB7FC7D4959287BCA7FB0E3E99EB834087D17EED331DEF18138838D35C48C6DDC8A0134AFFFF1A5A24033F9B5607B355D3D48FDF88
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... .....".. },.. "explanationofflinedisabled": {.. "message": ".. ...... .... ....... ....... .. .... Google ........ .. ..... .... .. ..., .... ... ....... .. ...... .... .. Google ........ .. ........ .. ...... ... .... .. ...... ....... .... .....".. },.. "explanationofflineenabled": {.. "message": ".. ...... ..., ..... .. .. .. ...... ...... ..... .. .... ... .. .. ...... ... .... ....".. },.. "extdesc": {.. "message": ".... .... ....... ...... ..

C:\Users\user\AppData\Local\Temp\scoped_dir5672_2050194923\CRX_INSTALL\_locales\hr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	935
Entropy (8bit):	4.6369398601609735
Encrypted:	false
SSDEEP:	24:1HA7sR5k/I+UX/hrcySxG1fIZ3tp/S/d6Gpb+D:YsE/I+UX/hVSxQ03f/Sj+D
MD5:	25CDFF9D60C5FC4740A48EF9804BF5C7
SHA1:	4FADECC52FB43AEC084DF9FF86D2D465FBEBCDC0
SHA-256:	73E6E246CEEAB9875625CD4889FBF931F93B7B9DEAA11288AE1A0F8A6E311E76
SHA-512:	EF00B08496427FEB5A6B9FB3FE2E5404525BE7C329D9DD2A417480637FD91885837D134A26980DCF9F61E463E6CB68F09A24402805807E656AF16B116A75E02C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZRADI NOVI".. },.. "explanationofflinedisabled": {.. "message": "Vi ste izvan mre.e. Da biste koristili Google dokumente bez internetske veze, idite na postavke na po.etnoj stranici Google dokumenata i uklju.ite izvanmre.nu sinkronizaciju sljede.i put kada se pove.ete s internetom.".. },.. "explanationofflineenabled": {.. "message": "Vi ste izvan mre.e, no i dalje mo.ete ure.ivati dostupne datoteke i izra.ivati nove.".. },.. "extdesc": {.. "message": "Uredite, izradite i pregledajte dokumente, prora.unske tablice i prezentacije . sve bez pristupa internetu.".. },.. "extname": {.. "message": "Google dokumenti izvanmre.no".. },.. "learnmore": {.. "message": "Saznajte vi.e".. },.. "popuphelptext": {.. "message": "Pi.ite, ure.ujte i sura.ujte gdje god se nalazili, povezani s internetom ili izvanmre.no.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5672_2050194923\CRX_INSTALL\_locales\hu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1065
Entropy (8bit):	4.816501737523951
Encrypted:	false
SSDEEP:	24:1HA6J54gEYwFFMxv4gvyB9FzmxlsN147g/zJcYwJgrus4QY2jom:NJ54gEYwUmgKHFzmsG7izJcYOgKgYjm
MD5:	8930A51E3ACE3DD897C9E61A2AEA1D02
SHA1:	4108506500C68C054BA03310C49FA5B8EE246EA4
SHA-256:	958C0F664FCA20855FA84293566B2DDB7F297185619143457D6479E6AC81D240
SHA-512:	126B80CD3428C0BC459EEAAFCBE4B9FDE2541A57F19F3EC7346BAF449F36DC073A9CF015594A57203255941551B25F6FAA6D2C73C57C44725F563883FF902606
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".J L.TREHOZ.SA".. },.. "explanationofflinedisabled": {.. "message": "Jelenleg offline .llapotban van. Ha a Google Dokumentumokat internetkapcsolat n.lk.l szeretn. haszn.lni, a legk.zelebbi internethaszn.lata sor.n nyissa meg a Google Dokumentumok kezd.oldal.n tal.lhat. be.ll.t.sokat, .s tiltsa le az offline szinkroniz.l.s be.ll.t.st.".. },.. "explanationofflineenabled": {.. "message": "Offline .llapotban van, de az el.rhet. f.jlokat .gy is szerkesztheti, valamint l.trehozhat .jakat.".. },.. "extdesc": {.. "message": "Szerkesszen, hozzon l.tre .s tekintsen meg dokumentumokat, t.bl.zatokat .s prezent.ci.kat . ak.r internetkapcsolat n.lk.l is.".. },.. "extname": {.. "message": "Google Dokumentumok Offline".. },.. "learnmore": {.. "message": "Tov.bbi inform.ci.".. },.. "popuphelptext": {.. "message": ".rjon, szerkesszen .s dolgozzon egy.tt m.sokkal

C:\Users\user\AppData\Local\Temp\scoped_dir5672_2050194923\CRX_INSTALL\_locales\hy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2771
Entropy (8bit):	3.7629875118570055
Encrypted:	false
SSDEEP:	48:Y0Fx+eiYZBZ7K1ZZ/5QQxTuDLoFZaIZSK7lq0iC0mlMO6M3ih1oAgC:lF2BTz6N/
MD5:	55DE859AD778E0AA9D950EF505B29DA9
SHA1:	4479BE637A50C9EE8A2F7690AD362A6A8FFC59B2
SHA-256:	0B16E3F8BD904A767284345AE86A0A9927C47AFE89E05EA2B13AD80009BDF9E4
SHA-512:	EDAB2FCC14CABB6D116E9C2907B42CFBC34F1D9035F43E454F1F4D1F3774C100CBADF6B4C81B025810ED90FA91C22F1AEFE83056E4543D92527E4FE81C7889A8
Malicious:	false
Preview:	{"createnew":{"message":"\u054d\u054f\u0535\u0542\u053e\u0535\u053c \u0546\u0548\u0550"},"explanationofflinedisabled":{"message":"Google \u0553\u0561\u057d\u057f\u0561\u0569\u0572\u0569\u0565\u0580\u0568 \u0576\u0561\u0587 \u0561\u0576\u0581\u0561\u0576\u0581 \u057c\u0565\u056a\u056b\u0574\u0578\u0582\u0574 \u0585\u0563\u057f\u0561\u0563\u0578\u0580\u056e\u0565\u056c\u0578\u0582 \u0570\u0561\u0574\u0561\u0580 \u0574\u056b\u0561\u0581\u0565\u0584 \u0570\u0561\u0574\u0561\u0581\u0561\u0576\u0581\u056b\u0576, \u0562\u0561\u0581\u0565\u0584 \u056e\u0561\u057c\u0561\u0575\u0578\u0582\u0569\u0575\u0561\u0576 \u0563\u056c\u056d\u0561\u057e\u0578\u0580 \u0567\u057b\u0568, \u0561\u0576\u0581\u0565\u0584 \u056f\u0561\u0580\u0563\u0561\u057e\u0578\u0580\u0578\u0582\u0574\u0576\u0565\u0580 \u0587 \u0574\u056b\u0561\u0581\u0580\u0565\u0584 \u0561\u0576\u0581\u0561\u0576\u0581 \u0570\u0561\u0574\u0561\u056a\u0561\u0574\u0561\u0581\u0578\u0582\u0574\u0568:"},"explanationofflineenabled":{"message":"\u

C:\Users\user\AppData\Local\Temp\scoped_dir5672_2050194923\CRX_INSTALL\_locales\id\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	858
Entropy (8bit):	4.474411340525479
Encrypted:	false
SSDEEP:	12:1HASvgJX4CBxNpXemNOAJRFqjRpCBxedIdjTi92OvbCSUuoi01uRwCBhUuvz1thK:1HARXzhXemNOQWGcEoeH1eXJNvT2
MD5:	34D6EE258AF9429465AE6A078C2FB1F5
SHA1:	612CAE151984449A4346A66C0A0DF4235D64D932
SHA-256:	E3C86DDD2EFEBE88EED8484765A9868202546149753E03A61EB7C28FD62CFCA1
SHA-512:	20427807B64A0F79A6349F8A923152D9647DA95C05DE19AD3A4BF7DB817E25227F3B99307C8745DD323A6591B515221BD2F1E92B6F1A1783BDFA7142E84601B1
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BARU".. },.. "explanationofflinedisabled": {.. "message": "Anda sedang offline. Untuk menggunakan Google Dokumen tanpa koneksi internet, buka setelan di beranda Google Dokumen dan aktifkan sinkronisasi offline saat terhubung ke internet.".. },.. "explanationofflineenabled": {.. "message": "Anda sedang offline, namun Anda masih dapat mengedit file yang tersedia atau membuat file baru.".. },.. "extdesc": {.. "message": "Edit, buat, dan lihat dokumen, spreadsheet, dan presentasi . tanpa perlu akses internet.".. },.. "extname": {.. "message": "Google Dokumen Offline".. },.. "learnmore": {.. "message": "Pelajari Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit, dan gabungkan di mana saja, dengan atau tanpa koneksi internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5672_2050194923\CRX_INSTALL\_locales\is\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	954
Entropy (8bit):	4.631887382471946
Encrypted:	false
SSDEEP:	12:YGXU2rOcxGe+J97f9TP2DBX9tMfxqbTMvOfWWgdraqlifVpm0Ekf95MwP9KkJ+je:YwBrD2J2DBLMfFuWvdpY94vioO+uh
MD5:	1F565FB1C549B18AF8BBFED8DECD5D94
SHA1:	B57F4BDAE06FF3DFC1EB3E56B6F2F204D6F63638
SHA-256:	E16325D1A641EF7421F2BAFCD6433D53543C89D498DD96419B03CBA60B9C7D60
SHA-512:	A60B8E042A9BCDCC136B87948E9924A0B24D67C6CA9803904B876F162A0AD82B9619F1316BE9FF107DD143B44F7E6F5DF604ABFE00818DEB40A7D62917CDA69F
Malicious:	false
Preview:	{"createnew":{"message":"B\u00daA TIL N\u00ddTT"},"explanationofflinedisabled":{"message":"\u00de\u00fa ert \u00e1n nettengingar. Til a\u00f0 nota Google skj\u00f6l \u00e1n nettengingar skaltu opna stillingarnar \u00e1 heimas\u00ed\u00f0u Google skjala og virkja samstillingu \u00e1n nettengingar n\u00e6st \u00feegar \u00fe\u00fa tengist netinu."},"explanationofflineenabled":{"message":"Engin nettenging. \u00de\u00fa getur samt sem \u00e1\u00f0ur breytt tilt\u00e6kum skr\u00e1m e\u00f0a b\u00fai\u00f0 til n\u00fdjar."},"extdesc":{"message":"Breyttu, b\u00fa\u00f0u til og sko\u00f0a\u00f0u skj\u00f6lin \u00fe\u00edn, t\u00f6flureikna og kynningar \u2014 allt \u00e1n nettengingar."},"extname":{"message":"Google skj\u00f6l \u00e1n nettengingar"},"learnmore":{"message":"Frekari uppl\u00fdsingar"},"popuphelptext":{"message":"Skrifa\u00f0u, breyttu og starfa\u00f0u me\u00f0 \u00f6\u00f0rum hvort sem nettenging er til sta\u00f0ar e\u00f0a ekki."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir5672_2050194923\CRX_INSTALL\_locales\it\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	899
Entropy (8bit):	4.474743599345443
Encrypted:	false
SSDEEP:	12:1HASvggrCBxNp8WJOJJrJ3WytVCBxep3bjP5CSUCjV8AgJJm2CBhr+z1tWgjqEOW:1HANXJOTBFtKa8Agju4NB3j
MD5:	0D82B734EF045D5FE7AA680B6A12E711
SHA1:	BD04F181E4EE09F02CD53161DCABCEF902423092
SHA-256:	F41862665B13C0B4C4F562EF1743684CCE29D4BCF7FE3EA494208DF253E33885
SHA-512:	01F305A280112482884485085494E871C66D40C0B03DE710B4E5F49C6A478D541C2C1FDA2CEAF4307900485946DEE9D905851E98A2EB237642C80D464D1B3ADA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA NUOVO".. },.. "explanationofflinedisabled": {.. "message": "Sei offline. Per utilizzare Documenti Google senza una connessione Internet, apri le impostazioni nella home page di Documenti Google e attiva la sincronizzazione offline la prossima volta che ti colleghi a Internet.".. },.. "explanationofflineenabled": {.. "message": "Sei offline, ma puoi comunque modificare i file disponibili o crearne di nuovi.".. },.. "extdesc": {.. "message": "Modifica, crea e visualizza documenti, fogli di lavoro e presentazioni, senza accesso a Internet.".. },.. "extname": {.. "message": "Documenti Google offline".. },.. "learnmore": {.. "message": "Ulteriori informazioni".. },.. "popuphelptext": {.. "message": "Scrivi, modifica e collabora ovunque ti trovi, con o senza una connessione Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5672_2050194923\CRX_INSTALL\_locales\iw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2230
Entropy (8bit):	3.8239097369647634
Encrypted:	false
SSDEEP:	24:YIiTVLrLD1MEzMEH82LBLjO5YaQEqLytLLBm3dnA5LcqLWAU75yxFLcx+UxWRJLI:YfTFf589rZNgNA12Qzt4/zRz2vc
MD5:	26B1533C0852EE4661EC1A27BD87D6BF
SHA1:	18234E3ABAF702DF9330552780C2F33B83A1188A
SHA-256:	BBB81C32F482BA3216C9B1189C70CEF39CA8C2181AF3538FFA07B4C6AD52F06A
SHA-512:	450BFAF0E8159A4FAE309737EA69CA8DD91CAAFD27EF662087C4E7716B2DCAD3172555898E75814D6F11487F4F254DE8625EF0CFEA8DF0133FC49E18EC7FD5D2
Malicious:	false
Preview:	{"createnew":{"message":"\u05d9\u05e6\u05d9\u05e8\u05ea \u05d7\u05d3\u05e9"},"explanationofflinedisabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8. \u05db\u05d3\u05d9 \u05dc\u05d4\u05e9\u05ea\u05de\u05e9 \u05d1-Google Docs \u05dc\u05dc\u05d0 \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d1\u05d4\u05ea\u05d7\u05d1\u05e8\u05d5\u05ea \u05d4\u05d1\u05d0\u05d4 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d9\u05e9 \u05dc\u05e2\u05d1\u05d5\u05e8 \u05dc\u05e7\u05d8\u05e2 \u05d4\u05d4\u05d2\u05d3\u05e8\u05d5\u05ea \u05d1\u05d3\u05e3 \u05d4\u05d1\u05d9\u05ea \u05e9\u05dc Google Docs \u05d5\u05dc\u05d4\u05e4\u05e2\u05d9\u05dc \u05e1\u05e0\u05db\u05e8\u05d5\u05df \u05d1\u05de\u05e6\u05d1 \u05d0\u05d5\u05e4\u05dc\u05d9\u05d9\u05df."},"explanationofflineenabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e

C:\Users\user\AppData\Local\Temp\scoped_dir5672_2050194923\CRX_INSTALL\_locales\ja\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1160
Entropy (8bit):	5.292894989863142
Encrypted:	false
SSDEEP:	24:1HAoc3IiRF1viQ1RF3CMP3rnicCCAFrr1Oo0Y5ReXCCQkb:Dc3zF7F3CMTnOCAFVLHXCFb
MD5:	15EC1963FC113D4AD6E7E59AE5DE7C0A
SHA1:	4017FC6D8B302335469091B91D063B07C9E12109
SHA-256:	34AC08F3C4F2D42962A3395508818B48CA323D22F498738CC9F09E78CB197D73
SHA-512:	427251F471FA3B759CA1555E9600C10F755BC023701D058FF661BEC605B6AB94CFB3456C1FEA68D12B4D815FFBAFABCEB6C12311DD1199FC783ED6863AF97C0F
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ............................... Google .............. [..] .......[.......] ...........".. },.. "explanationofflineenabled": {.. "message": ".............................................".. },.. "extdesc": {.. "message": ".........................................................".. },.. "extname": {.. "message": "Google ..... ......".. },.. "learnmore": {.. "message": "..".. },.. "popuphelp

C:\Users\user\AppData\Local\Temp\scoped_dir5672_2050194923\CRX_INSTALL\_locales\ka\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3264
Entropy (8bit):	3.586016059431306
Encrypted:	false
SSDEEP:	48:YGFbhVhVn0nM/XGbQTvxnItVJW/476CFdqaxWNlR:HFbhV/n0MfGbw875FkaANlR
MD5:	83F81D30913DC4344573D7A58BD20D85
SHA1:	5AD0E91EA18045232A8F9DF1627007FE506A70E0
SHA-256:	30898BBF51BDD58DB397FF780F061E33431A38EF5CFC288B5177ECF76B399F26
SHA-512:	85F97F12AD4482B5D9A6166BB2AE3C4458A582CF575190C71C1D8E0FB87C58482F8C0EFEAD56E3A70EDD42BED945816DB5E07732AD27B8FFC93F4093710DD58F
Malicious:	false
Preview:	{"createnew":{"message":"\u10d0\u10ee\u10da\u10d8\u10e1 \u10e8\u10d4\u10e5\u10db\u10dc\u10d0"},"explanationofflinedisabled":{"message":"\u10d7\u10e5\u10d5\u10d4\u10dc \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10ee\u10d0\u10e0\u10d7. Google Docs-\u10d8\u10e1 \u10d8\u10dc\u10e2\u10d4\u10e0\u10dc\u10d4\u10e2\u10d7\u10d0\u10dc \u10d9\u10d0\u10d5\u10e8\u10d8\u10e0\u10d8\u10e1 \u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10d2\u10d0\u10db\u10dd\u10e1\u10d0\u10e7\u10d4\u10dc\u10d4\u10d1\u10da\u10d0\u10d3 \u10d2\u10d0\u10d3\u10d0\u10d3\u10d8\u10d7 \u10de\u10d0\u10e0\u10d0\u10db\u10d4\u10e2\u10e0\u10d4\u10d1\u10d6\u10d4 Google Docs-\u10d8\u10e1 \u10db\u10d7\u10d0\u10d5\u10d0\u10e0 \u10d2\u10d5\u10d4\u10e0\u10d3\u10d6\u10d4 \u10d3\u10d0 \u10e9\u10d0\u10e0\u10d7\u10d4\u10d7 \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10e1\u10d8\u10dc\u10e5\u10e0\u10dd\u10dc\u10d8\u10d6\u10d0\u10ea\u10d8\u10d0, \u10e0\u10dd\u10d3\u10d4\u10e1\u10d0\u10ea \u10e8\u10d4\u10db\u10d3\u10d2\u10dd\u10

C:\Users\user\AppData\Local\Temp\scoped_dir5672_2050194923\CRX_INSTALL\_locales\kk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3235
Entropy (8bit):	3.6081439490236464
Encrypted:	false
SSDEEP:	96:H3E+6rOEAbeHTln2EQ77Uayg45RjhCSj+OyRdM7AE9qdV:HXcR/nQXUayYV
MD5:	2D94A58795F7B1E6E43C9656A147AD3C
SHA1:	E377DB505C6924B6BFC9D73DC7C02610062F674E
SHA-256:	548DC6C96E31A16CE355DC55C64833B08EF3FBA8BF33149031B4A685959E3AF4
SHA-512:	F51CC857E4CF2D4545C76A2DCE7D837381CE59016E250319BF8D39718BE79F9F6EE74EA5A56DE0E8759E4E586D93430D51651FC902376D8A5698628E54A0F2D8
Malicious:	false
Preview:	{"createnew":{"message":"\u0416\u0410\u04a2\u0410\u0421\u042b\u041d \u0416\u0410\u0421\u0410\u0423"},"explanationofflinedisabled":{"message":"\u0421\u0456\u0437 \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u043d\u0434\u0435\u0441\u0456\u0437. Google Docs \u049b\u043e\u043b\u0434\u0430\u043d\u0431\u0430\u0441\u044b\u043d \u0436\u0435\u043b\u0456 \u0431\u0430\u0439\u043b\u0430\u043d\u044b\u0441\u044b\u043d\u0441\u044b\u0437 \u049b\u043e\u043b\u0434\u0430\u043d\u0443 \u04af\u0448\u0456\u043d, \u043a\u0435\u043b\u0435\u0441\u0456 \u0436\u043e\u043b\u044b \u0436\u0435\u043b\u0456\u0433\u0435 \u049b\u043e\u0441\u044b\u043b\u0493\u0430\u043d\u0434\u0430, Google Docs \u043d\u0435\u0433\u0456\u0437\u0433\u0456 \u0431\u0435\u0442\u0456\u043d\u0435\u043d \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u043b\u0435\u0440 \u0431\u04e9\u043b\u0456\u043c\u0456\u043d \u043a\u0456\u0440\u0456\u043f, \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u

C:\Users\user\AppData\Local\Temp\scoped_dir5672_2050194923\CRX_INSTALL\_locales\km\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3122
Entropy (8bit):	3.891443295908904
Encrypted:	false
SSDEEP:	96:/OOrssRU6Bg7VSdL+zsCfoZiWssriWqo2gx7RRCos2sEeBkS7Zesg:H5GRZlXsGdo
MD5:	B3699C20A94776A5C2F90AEF6EB0DAD9
SHA1:	1F9B968B0679A20FA097624C9ABFA2B96C8C0BEA
SHA-256:	A6118F0A0DE329E07C01F53CD6FB4FED43E54C5F53DB4CD1C7F5B2B4D9FB10E6
SHA-512:	1E8D15B8BFF1D289434A244172F9ED42B4BB6BCB6372C1F300B01ACEA5A88167E97FEDABA0A7AE3BEB5E24763D1B09046AE8E30745B80E2E2FE785C94DF362F6
Malicious:	false
Preview:	{"createnew":{"message":"\u1794\u1784\u17d2\u1780\u17be\u178f\u200b\u1790\u17d2\u1798\u17b8"},"explanationofflinedisabled":{"message":"\u17a2\u17d2\u1793\u1780\u200b\u1782\u17d2\u1798\u17b6\u1793\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f\u17d4 \u178a\u17be\u1798\u17d2\u1794\u17b8\u200b\u1794\u17d2\u179a\u17be Google \u17af\u1780\u179f\u17b6\u179a\u200b\u1794\u17b6\u1793\u200b\u200b\u178a\u17c4\u1799\u200b\u200b\u1798\u17b7\u1793\u1798\u17b6\u1793\u200b\u200b\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f \u179f\u17bc\u1798\u200b\u200b\u1791\u17c5\u200b\u1780\u17b6\u1793\u17cb\u200b\u1780\u17b6\u179a\u200b\u1780\u17c6\u178e\u178f\u17cb\u200b\u1793\u17c5\u200b\u179b\u17be\u200b\u1782\u17c1\u17a0\u1791\u17c6\u1796\u17d0\u179a Google \u17af\u1780\u179f\u17b6\u179a \u1793\u17b7\u1784\u200b\u1794\u17be\u1780\u200b\u1780\u17b6\u179a\u1792\u17d2\u179c\u17be\u200b\u179f\u1798\u1780\u17b6\u179b\u1780\u1798\u17d2\u1798\u200b\u200b\u200b\u1782\u17d2\u1798\u17b6\u1793

C:\Users\user\AppData\Local\Temp\scoped_dir5672_2050194923\CRX_INSTALL\_locales\kn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1895
Entropy (8bit):	4.28990403715536
Encrypted:	false
SSDEEP:	48:SHYGuEETiuF6OX5tCYFZt5GurMRRevsY4tVZIGnZRxlKT6/U0WG:yYG8iuF6yTCYFH5GjLPtVZVZRxOZ0J
MD5:	38BE0974108FC1CC30F13D8230EE5C40
SHA1:	ACF44889DD07DB97D26D534AD5AFA1BC1A827BAD
SHA-256:	30078EF35A76E02A400F03B3698708A0145D9B57241CC4009E010696895CF3A1
SHA-512:	7BDB2BADE4680801FC3B33E82C8AA4FAC648F45C795B4BACE4669D6E907A578FF181C093464884C0E00C9762E8DB75586A253D55CD10A7777D281B4BFFAFE302
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........ .....".. },.. "explanationofflinedisabled": {.. "message": ".... ..................... ......... ............. Google ...... ....., Google ...... ............ ............... .... ..... ...... .... .... ............ ............. ........ ..... ... .....".. },.. "explanationofflineenabled": {.. "message": ".... ...................., .... .... .... ......... ........... ............ .... ........ .........."..

C:\Users\user\AppData\Local\Temp\scoped_dir5672_2050194923\CRX_INSTALL\_locales\ko\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1042
Entropy (8bit):	5.3945675025513955
Encrypted:	false
SSDEEP:	24:1HAWYsF4dqNfBQH49Hk8YfIhYzTJ+6WJBtl/u4s+6:ZF4wNfvm87mX4LF6
MD5:	F3E59EEEB007144EA26306C20E04C292
SHA1:	83E7BDFA1F18F4C7534208493C3FF6B1F2F57D90
SHA-256:	C52D9B955D229373725A6E713334BBB31EA72EFA9B5CF4FBD76A566417B12CAC
SHA-512:	7808CB5FF041B002CBD78171EC5A0B4DBA3E017E21F7E8039084C2790F395B839BEE04AD6C942EED47CCB53E90F6DE818A725D1450BF81BA2990154AFD3763AF
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".. ...".. },.. "explanationofflinedisabled": {.. "message": ".... ...... ... .. .. Google Docs. ..... Google Docs .... .... .... .... .... ..... . .... .... ..... ......".. },.. "explanationofflineenabled": {.. "message": ".... ...... ... .. ... ... ..... ... ... .. . .....".. },.. "extdesc": {.. "message": ".... .... ... .., ...... . ....... .., .., ......".. },.. "extname": {.. "message": "Google Docs ....".. },.. "learnmore": {.. "message": "... ....".. },.. "popuphelptext": {.. "message": "... .. ... .... ..... .... .... .....

C:\Users\user\AppData\Local\Temp\scoped_dir5672_2050194923\CRX_INSTALL\_locales\lo\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2535
Entropy (8bit):	3.8479764584971368
Encrypted:	false
SSDEEP:	48:YRcHe/4raK1EIlZt1wg62FIOg+xGaF8guI5EP9I2yC:+cs4raK1xlZtOgviOfGaF8RI5EP95b
MD5:	E20D6C27840B406555E2F5091B118FC5
SHA1:	0DCECC1A58CEB4936E255A64A2830956BFA6EC14
SHA-256:	89082FB05229826BC222F5D22C158235F025F0E6DF67FF135A18BD899E13BB8F
SHA-512:	AD53FC0B153005F47F9F4344DF6C4804049FAC94932D895FD02EEBE75222CFE77EEDD9CD3FDC4C88376D18C5972055B00190507AA896488499D64E884F84F093
Malicious:	false
Preview:	{"createnew":{"message":"\u0eaa\u0ec9\u0eb2\u0e87\u0ec3\u0edd\u0ec8"},"explanationofflinedisabled":{"message":"\u0e97\u0ec8\u0eb2\u0e99\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ea2\u0eb9\u0ec8. \u0ec0\u0e9e\u0eb7\u0ec8\u0ead\u0ec3\u0e8a\u0ec9 Google Docs \u0ec2\u0e94\u0e8d\u0e9a\u0ecd\u0ec8\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94, \u0ec3\u0eab\u0ec9\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e81\u0eb2\u0e99\u0e95\u0eb1\u0ec9\u0e87\u0e84\u0ec8\u0eb2\u0ec3\u0e99\u0edc\u0ec9\u0eb2 Google Docs \u0ec1\u0ea5\u0ec9\u0ea7\u0ec0\u0e9b\u0eb5\u0e94\u0ec3\u0e8a\u0ec9\u0e81\u0eb2\u0e99\u0e8a\u0eb4\u0ec9\u0e87\u0ec1\u0e9a\u0e9a\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ec3\u0e99\u0ec0\u0e97\u0eb7\u0ec8\u0ead\u0e95\u0ecd\u0ec8\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e97\u0ec8\u0eb2\u0e99\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94."},"explanationofflineenabled":{"message":"\u0e97\u0ec

C:\Users\user\AppData\Local\Temp\scoped_dir5672_2050194923\CRX_INSTALL\_locales\lt\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1028
Entropy (8bit):	4.797571191712988
Encrypted:	false
SSDEEP:	24:1HAivZZaJ3Rje394+k7IKgpAJjUpSkiQjuRBMd:fZZahBeu7IKgqeMg
MD5:	970544AB4622701FFDF66DC556847652
SHA1:	14BEE2B77EE74C5E38EBD1DB09E8D8104CF75317
SHA-256:	5DFCBD4DFEAEC3ABE973A78277D3BD02CD77AE635D5C8CD1F816446C61808F59
SHA-512:	CC12D00C10B970189E90D47390EEB142359A8D6F3A9174C2EF3AE0118F09C88AB9B689D9773028834839A7DFAF3AAC6747BC1DCB23794A9F067281E20B8DC6EA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SUKURTI NAUJ.".. },.. "explanationofflinedisabled": {.. "message": "Esate neprisijung.. Jei norite naudoti .Google. dokumentus be interneto ry.io, pagrindiniame .Google. dokument. puslapyje eikite . nustatym. skilt. ir .junkite sinchronizavim. neprisijungus, kai kit. kart. b.site prisijung. prie interneto.".. },.. "explanationofflineenabled": {.. "message": "Esate neprisijung., bet vis tiek galite redaguoti pasiekiamus failus arba sukurti nauj..".. },.. "extdesc": {.. "message": "Redaguokite, kurkite ir per.i.r.kite savo dokumentus, skai.iuokles ir pristatymus . visk. darykite be prieigos prie interneto.".. },.. "extname": {.. "message": ".Google. dokumentai neprisijungus".. },.. "learnmore": {.. "message": "Su.inoti daugiau".. },.. "popuphelptext": {.. "message": "Ra.ykite, redaguokite ir bendradarbiaukite bet kurioje vietoje naudodami interneto ry.. arba

C:\Users\user\AppData\Local\Temp\scoped_dir5672_2050194923\CRX_INSTALL\_locales\lv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	994
Entropy (8bit):	4.700308832360794
Encrypted:	false
SSDEEP:	24:1HAaJ7a/uNpoB/Y4vPnswSPkDzLKFQHpp//BpPDB:7J7a/uzQ/Y4vvswhDzDr/LDB
MD5:	A568A58817375590007D1B8ABCAEBF82
SHA1:	B0F51FE6927BB4975FC6EDA7D8A631BF0C1AB597
SHA-256:	0621DE9161748F45D53052ED8A430962139D7F19074C7FFE7223ECB06B0B87DB
SHA-512:	FCFBADEC9F73975301AB404DB6B09D31457FAC7CCAD2FA5BE348E1CAD6800F87CB5B56DE50880C55BBADB3C40423351A6B5C2D03F6A327D898E35F517B1C628C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZVEIDOT JAUNU".. },.. "explanationofflinedisabled": {.. "message": "J.s esat bezsaist.. Lai lietotu pakalpojumu Google dokumenti bez interneta savienojuma, n.kamaj. reiz., kad ir izveidots savienojums ar internetu, atveriet Google dokumentu s.kumlapas iestat.jumu izv.lni un iesl.dziet sinhroniz.ciju bezsaist..".. },.. "explanationofflineenabled": {.. "message": "J.s esat bezsaist., ta.u varat redi..t pieejamos failus un izveidot jaunus.".. },.. "extdesc": {.. "message": "Redi..jiet, veidojiet un skatiet savus dokumentus, izkl.jlapas un prezent.cijas, neizmantojot savienojumu ar internetu.".. },.. "extname": {.. "message": "Google dokumenti bezsaist.".. },.. "learnmore": {.. "message": "Uzziniet vair.k".. },.. "popuphelptext": {.. "message": "Rakstiet, redi..jiet un sadarbojieties ar interneta savienojumu vai bez t. neatkar.gi no t., kur atrodaties.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5672_2050194923\CRX_INSTALL\_locales\ml\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2091
Entropy (8bit):	4.358252286391144
Encrypted:	false
SSDEEP:	24:1HAnHdGc4LtGxVY6IuVzJkeNL5kP13a67wNcYP8j5PIaSTIjPU4ELFPCWJjMupV/:idGcyYPVtkAUl7wqziBsg9DbpN6XoN/
MD5:	4717EFE4651F94EFF6ACB6653E868D1A
SHA1:	B8A7703152767FBE1819808876D09D9CC1C44450
SHA-256:	22CA9415E294D9C3EC3384B9D08CDAF5164AF73B4E4C251559E09E529C843EA6
SHA-512:	487EAB4938F6BC47B1D77DD47A5E2A389B94E01D29849E38E96C95CABC7BD98679451F0E22D3FEA25C045558CD69FDDB6C4FEF7C581141F1C53C4AA17578D7F7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ............".. },.. "explanationofflinedisabled": {.. "message": "...... ........... ........... ............. ..... Google ....... ..........., Google ....... .......... ............. .... ...... ...... ... ............... .................... '.......... ................' .........".. },.. "explanationofflineenabled": {.. "message": "................., .......... ......... ....... ...... ..............

C:\Users\user\AppData\Local\Temp\scoped_dir5672_2050194923\CRX_INSTALL\_locales\mn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2778
Entropy (8bit):	3.595196082412897
Encrypted:	false
SSDEEP:	48:Y943BFU1LQ4HwQLQ4LQhlmVQL3QUm6H6ZgFIcwn6Rs2ShpQ3IwjGLQSJ/PYoEQj8:I43BCymz8XNcfuQDXYN2sum
MD5:	83E7A14B7FC60D4C66BF313C8A2BEF0B
SHA1:	1CCF1D79CDED5D65439266DB58480089CC110B18
SHA-256:	613D8751F6CC9D3FA319F4B7EA8B2BD3BED37FD077482CA825929DD7C12A69A8
SHA-512:	3742E24FFC4B5283E6EE496813C1BDC6835630D006E8647D427C3DE8B8E7BF814201ADF9A27BFAB3ABD130B6FEC64EBB102AC0EB8DEDFE7B63D82D3E1233305D
Malicious:	false
Preview:	{"createnew":{"message":"\u0428\u0418\u041d\u0418\u0419\u0413 \u04ae\u04ae\u0421\u0413\u042d\u0425"},"explanationofflinedisabled":{"message":"\u0422\u0430 \u043e\u0444\u043b\u0430\u0439\u043d \u0431\u0430\u0439\u043d\u0430. Google \u0414\u043e\u043a\u044b\u0433 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u0433\u04af\u0439\u0433\u044d\u044d\u0440 \u0430\u0448\u0438\u0433\u043b\u0430\u0445\u044b\u043d \u0442\u0443\u043b\u0434 \u0434\u0430\u0440\u0430\u0430\u0433\u0438\u0439\u043d \u0443\u0434\u0430\u0430 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u044d\u0434 \u0445\u043e\u043b\u0431\u043e\u0433\u0434\u043e\u0445\u0434\u043e\u043e Google \u0414\u043e\u043a\u044b\u043d \u043d\u04af\u04af\u0440 \u0445\u0443\u0443\u0434\u0430\u0441\u043d\u0430\u0430\u0441 \u0442\u043e\u0445\u0438\u0440\u0433\u043e\u043e \u0434\u043e\u0442\u043e\u0440\u0445 \u043e\u0444\u043b\u0430\u0439\u043d \u0441\u0438\u043d\u043a\u0438\u0439\u0433 \u0438\u0434\u044d\u0432\u0445\u0436\u04af\u04af\u043b\u043d\u0

C:\Users\user\AppData\Local\Temp\scoped_dir5672_2050194923\CRX_INSTALL\_locales\mr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1719
Entropy (8bit):	4.287702203591075
Encrypted:	false
SSDEEP:	48:65/5EKaDMw6pEf4I5+jSksOTJqQyrFO8C:65/5EKaAw6pEf4I5+vsOVqQyFO8C
MD5:	3B98C4ED8874A160C3789FEAD5553CFA
SHA1:	5550D0EC548335293D962AAA96B6443DD8ABB9F6
SHA-256:	ADEB082A9C754DFD5A9D47340A3DDCC19BF9C7EFA6E629A2F1796305F1C9A66F
SHA-512:	5139B6C6DF9459C7B5CDC08A98348891499408CD75B46519BA3AC29E99AAAFCC5911A1DEE6C3A57E3413DBD0FAE72D7CBC676027248DCE6364377982B5CE4151
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ...".. },.. "explanationofflinedisabled": {.. "message": "...... ...... ..... ......... ....... ....... ..... Google ....... ............, Google ....... .............. .......... .. ... ..... .... ...... ......... ...... ...... ...... .... .... ....".. },.. "explanationofflineenabled": {.. "message": "...... ...... ...., ..... ...... ...... ...... .... ....... ... ..... .... .... ... .....".. },.. "extdesc": {.. "message": "..... ..

C:\Users\user\AppData\Local\Temp\scoped_dir5672_2050194923\CRX_INSTALL\_locales\ms\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	936
Entropy (8bit):	4.457879437756106
Encrypted:	false
SSDEEP:	24:1HARXIqhmemNKsE27rhdfNLChtyo2JJ/YgTgin:iIqFC7lrDfNLCIBRzn
MD5:	7D273824B1E22426C033FF5D8D7162B7
SHA1:	EADBE9DBE5519BD60458B3551BDFC36A10049DD1
SHA-256:	2824CF97513DC3ECC261F378BFD595AE95A5997E9D1C63F5731A58B1F8CD54F9
SHA-512:	E5B611BBFAB24C9924D1D5E1774925433C65C322769E1F3B116254B1E9C69B6DF1BE7828141EEBBF7524DD179875D40C1D8F29C4FB86D663B8A365C6C60421A7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BAHARU".. },.. "explanationofflinedisabled": {.. "message": "Anda berada di luar talian. Untuk menggunakan Google Docs tanpa sambungan Internet, pergi ke tetapan di halaman utama Google Docs dan hidupkan penyegerakan luar talian apabila anda disambungkan ke Internet selepas ini.".. },.. "explanationofflineenabled": {.. "message": "Anda berada di luar talian, tetapi anda masih boleh mengedit fail yang tersedia atau buat fail baharu.".. },.. "extdesc": {.. "message": "Edit, buat dan lihat dokumen, hamparan dan pembentangan anda . kesemuanya tanpa akses Internet.".. },.. "extname": {.. "message": "Google Docs Luar Talian".. },.. "learnmore": {.. "message": "Ketahui Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit dan bekerjasama di mana-mana sahaja anda berada, dengan atau tanpa sambungan Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5672_2050194923\CRX_INSTALL\_locales\my\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3830
Entropy (8bit):	3.5483353063347587
Encrypted:	false
SSDEEP:	48:Ya+Ivxy6ur1+j3P7Xgr5ELkpeCgygyOxONHO3pj6H57ODyOXOVp6:8Uspsj3P3ty2a66xl09
MD5:	342335A22F1886B8BC92008597326B24
SHA1:	2CB04F892E430DCD7705C02BF0A8619354515513
SHA-256:	243BEFBD6B67A21433DCC97DC1A728896D3A070DC20055EB04D644E1BB955FE7
SHA-512:	CD344D060E30242E5A4705547E807CE3CE2231EE983BB9A8AD22B3E7598A7EC87399094B04A80245AD51D039370F09D74FE54C0B0738583884A73F0C7E888AD8
Malicious:	false
Preview:	{"createnew":{"message":"\u1021\u101e\u1005\u103a \u1015\u103c\u102f\u101c\u102f\u1015\u103a\u101b\u1014\u103a"},"explanationofflinedisabled":{"message":"\u101e\u1004\u103a \u1021\u1031\u102c\u1037\u1016\u103a\u101c\u102d\u102f\u1004\u103a\u1038\u1016\u103c\u1005\u103a\u1014\u1031\u1015\u102b\u101e\u100a\u103a\u104b \u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u1019\u103e\u102f \u1019\u101b\u103e\u102d\u1018\u1032 Google Docs \u1000\u102d\u102f \u1021\u101e\u102f\u1036\u1038\u1015\u103c\u102f\u101b\u1014\u103a \u1014\u1031\u102c\u1000\u103a\u1010\u1005\u103a\u1000\u103c\u102d\u1019\u103a \u101e\u1004\u103a\u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u101e\u100a\u1037\u103a\u1021\u1001\u102b Google Docs \u1015\u1004\u103a\u1019\u1005\u102c\u1019\u103b\u1000\u103a\u1014\u103e\u102c\u101b\u103e\u102d \u1006\u1000\u103a\u1010\u1004\u103a\u1019\u103b\u102c\u1038\u101e\u102d\u102f\u1037\u1

C:\Users\user\AppData\Local\Temp\scoped_dir5672_2050194923\CRX_INSTALL\_locales\ne\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1898
Entropy (8bit):	4.187050294267571
Encrypted:	false
SSDEEP:	24:1HAmQ6ZSWfAx6fLMr48tE/cAbJtUZJScSIQoAfboFMiQ9pdvz48YgqG:TQ6W6MbkcAltUJxQdfbqQ9pp0gqG
MD5:	B1083DA5EC718D1F2F093BD3D1FB4F37
SHA1:	74B6F050D918448396642765DEF1AD5390AB5282
SHA-256:	E6ED0A023EF31705CCCBAF1E07F2B4B2279059296B5CA973D2070417BA16F790
SHA-512:	7102B90ABBE2C811E8EE2F1886A73B1298D4F3D5D05F0FFDB57CF78B9A49A25023A290B255BAA4895BB150B388BAFD9F8432650B8C70A1A9A75083FFFCD74F1A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... ....... .........".. },.. "explanationofflinedisabled": {.. "message": "..... ...... .......... .... ........ .... .... Google ........ ...... .... ..... ..... ... .......... ....... .... Google ........ .......... ..... .......... .. ...... ..... .... ..... ......... .. ..........".. },.. "explanationofflineenabled": {.. "message": "..... ...... ........., .. ..... ... ... ...... ....... ....... .. .... ....... ....

C:\Users\user\AppData\Local\Temp\scoped_dir5672_2050194923\CRX_INSTALL\_locales\nl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.513485418448461
Encrypted:	false
SSDEEP:	12:1HASvgFARCBxNBv52/fXjOXl6W6ICBxeBvMzU1CSUJAO6SFAIVIbCBhZHdb1tvz+:1HABJx4X6QDwEzlm2uGvYzKU
MD5:	32DF72F14BE59A9BC9777113A8B21DE6
SHA1:	2A8D9B9A998453144307DD0B700A76E783062AD0
SHA-256:	F3FE1FFCB182183B76E1B46C4463168C746A38E461FD25CA91FF2A40846F1D61
SHA-512:	E0966F5CCA5A8A6D91C58D716E662E892D1C3441DAA5D632E5E843839BB989F620D8AC33ED3EDBAFE18D7306B40CD0C4639E5A4E04DA2C598331DACEC2112AAD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NIEUW MAKEN".. },.. "explanationofflinedisabled": {.. "message": "Je bent offline. Wil je Google Documenten zonder internetverbinding gebruiken, ga dan de volgende keer dat je verbinding met internet hebt naar 'Instellingen' op de homepage van Google Documenten en zet 'Offline synchronisatie' aan.".. },.. "explanationofflineenabled": {.. "message": "Je bent offline, maar je kunt nog wel beschikbare bestanden bewerken of nieuwe bestanden maken.".. },.. "extdesc": {.. "message": "Bewerk, maak en bekijk je documenten, spreadsheets en presentaties. Allemaal zonder internettoegang.".. },.. "extname": {.. "message": "Offline Documenten".. },.. "learnmore": {.. "message": "Meer informatie".. },.. "popuphelptext": {.. "message": "Overal schrijven, bewerken en samenwerken, met of zonder internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5672_2050194923\CRX_INSTALL\_locales\no\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	878
Entropy (8bit):	4.4541485835627475
Encrypted:	false
SSDEEP:	24:1HAqwwrJ6wky68uk+NILxRGJwBvDyrj9V:nwwQwky6W+NwswVyT
MD5:	A1744B0F53CCF889955B95108367F9C8
SHA1:	6A5A6771DFF13DCB4FD425ED839BA100B7123DE0
SHA-256:	21CEFF02B45A4BFD60D144879DFA9F427949A027DD49A3EB0E9E345BD0B7C9A8
SHA-512:	F55E43F14514EECB89F6727A0D3C234149609020A516B193542B5964D2536D192F40CC12D377E70C683C269A1BDCDE1C6A0E634AA84A164775CFFE776536A961
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPPRETT NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du er uten nett. For . bruke Google Dokumenter uten internettilkobling, g. til innstillingene p. Google Dokumenter-nettsiden og sl. p. synkronisering uten nett neste gang du er koblet til Internett.".. },.. "explanationofflineenabled": {.. "message": "Du er uten nett, men du kan likevel endre tilgjengelige filer eller opprette nye.".. },.. "extdesc": {.. "message": "Rediger, opprett og se dokumentene, regnearkene og presentasjonene dine . uten nettilgang.".. },.. "extname": {.. "message": "Google Dokumenter uten nett".. },.. "learnmore": {.. "message": "Finn ut mer".. },.. "popuphelptext": {.. "message": "Skriv, rediger eller samarbeid uansett hvor du er, med eller uten internettilkobling.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5672_2050194923\CRX_INSTALL\_locales\pa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2766
Entropy (8bit):	3.839730779948262
Encrypted:	false
SSDEEP:	48:YEH6/o0iZbNCbDMUcipdkNtQjsGKIhO9aBjj/nxt9o5nDAj3:p6wbZbEbvJ8jQkIhO9aBjb/90Ab
MD5:	97F769F51B83D35C260D1F8CFD7990AF
SHA1:	0D59A76564B0AEE31D0A074305905472F740CECA
SHA-256:	BBD37D41B7DE6F93948FA2437A7699D4C30A3C39E736179702F212CB36A3133C
SHA-512:	D91F5E2D22FC2D7F73C1F1C4AF79DB98FCFD1C7804069AE9B2348CBC729A6D2DFF7FB6F44D152B0BDABA6E0D05DFF54987E8472C081C4D39315CEC2CBC593816
Malicious:	false
Preview:	{"createnew":{"message":"\u0a28\u0a35\u0a3e\u0a02 \u0a2c\u0a23\u0a3e\u0a13"},"explanationofflinedisabled":{"message":"\u0a24\u0a41\u0a38\u0a40\u0a02 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a39\u0a4b\u0964 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a15\u0a28\u0a48\u0a15\u0a36\u0a28 \u0a26\u0a47 \u0a2c\u0a3f\u0a28\u0a3e\u0a02 Google Docs \u0a28\u0a42\u0a70 \u0a35\u0a30\u0a24\u0a23 \u0a32\u0a08, \u0a05\u0a17\u0a32\u0a40 \u0a35\u0a3e\u0a30 \u0a1c\u0a26\u0a4b\u0a02 \u0a24\u0a41\u0a38\u0a40\u0a02 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a26\u0a47 \u0a28\u0a3e\u0a32 \u0a15\u0a28\u0a48\u0a15\u0a1f \u0a39\u0a4b\u0a35\u0a4b \u0a24\u0a3e\u0a02 Google Docs \u0a2e\u0a41\u0a71\u0a16 \u0a2a\u0a70\u0a28\u0a47 '\u0a24\u0a47 \u0a38\u0a48\u0a1f\u0a3f\u0a70\u0a17\u0a3e\u0a02 \u0a35\u0a3f\u0a71\u0a1a \u0a1c\u0a3e\u0a13 \u0a05\u0a24\u0a47 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a38\u0a3f\u0a70\u0a15 \u0a28\u0a42\u0a70 \u0a1a\u0a3e\u0a32\u0a42 \u0a15\u0a30\u0a4b\u0964"},"expla

C:\Users\user\AppData\Local\Temp\scoped_dir5672_2050194923\CRX_INSTALL\_locales\pl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	978
Entropy (8bit):	4.879137540019932
Encrypted:	false
SSDEEP:	24:1HApiJiRelvm3wi8QAYcbm24sK+tFJaSDD:FJMx3whxYcbNp
MD5:	B8D55E4E3B9619784AECA61BA15C9C0F
SHA1:	B4A9C9885FBEB78635957296FDDD12579FEFA033
SHA-256:	E00FF20437599A5C184CA0C79546CB6500171A95E5F24B9B5535E89A89D3EC3D
SHA-512:	266589116EEE223056391C65808255EDAE10EB6DC5C26655D96F8178A41E283B06360AB8E08AC3857D172023C4F616EF073D0BEA770A3B3DD3EE74F5FFB2296B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "UTW.RZ NOWY".. },.. "explanationofflinedisabled": {.. "message": "Jeste. offline. Aby korzysta. z Dokument.w Google bez po..czenia internetowego, otw.rz ustawienia na stronie g..wnej Dokument.w Google i w..cz synchronizacj. offline nast.pnym razem, gdy b.dziesz mie. dost.p do internetu.".. },.. "explanationofflineenabled": {.. "message": "Jeste. offline, ale nadal mo.esz edytowa. dost.pne pliki i tworzy. nowe.".. },.. "extdesc": {.. "message": "Edytuj, tw.rz i wy.wietlaj swoje dokumenty, arkusze kalkulacyjne oraz prezentacje bez konieczno.ci ..czenia si. z internetem.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Wi.cej informacji".. },.. "popuphelptext": {.. "message": "Pisz, edytuj i wsp..pracuj, gdziekolwiek jeste. . niezale.nie od tego, czy masz po..czenie z internetem.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5672_2050194923\CRX_INSTALL\_locales\pt_BR\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	907
Entropy (8bit):	4.599411354657937
Encrypted:	false
SSDEEP:	12:1HASvgU30CBxNd6GwXOK1styCJ02OK9+4KbCBxed6X4LBAt4rXgUCSUuYDHIIQka:1HAcXlyCJ5+Tsz4LY4rXSw/Q+ftkC
MD5:	608551F7026E6BA8C0CF85D9AC11F8E3
SHA1:	87B017B2D4DA17E322AF6384F82B57B807628617
SHA-256:	A73EEA087164620FA2260D3910D3FBE302ED85F454EDB1493A4F287D42FC882F
SHA-512:	82F52F8591DB3C0469CC16D7CBFDBF9116F6D5B5D2AD02A3D8FA39CE1378C64C0EA80AB8509519027F71A89EB8BBF38A8702D9AD26C8E6E0F499BF7DA18BF747
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Voc. est. off-line. Para usar o Documentos Google sem conex.o com a Internet, na pr.xima vez que se conectar, acesse as configura..es na p.gina inicial do Documentos Google e ative a sincroniza..o off-line.".. },.. "explanationofflineenabled": {.. "message": "Voc. est. off-line, mas mesmo assim pode editar os arquivos dispon.veis ou criar novos arquivos.".. },.. "extdesc": {.. "message": "Edite, crie e veja seus documentos, planilhas e apresenta..es sem precisar de acesso . Internet.".. },.. "extname": {.. "message": "Documentos Google off-line".. },.. "learnmore": {.. "message": "Saiba mais".. },.. "popuphelptext": {.. "message": "Escreva, edite e colabore onde voc. estiver, com ou sem conex.o com a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5672_2050194923\CRX_INSTALL\_locales\pt_PT\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.604761241355716
Encrypted:	false
SSDEEP:	24:1HAcXzw8M+N0STDIjxX+qxCjKw5BKriEQFMJXkETs:zXzw0pKXbxqKw5BKri3aNY
MD5:	0963F2F3641A62A78B02825F6FA3941C
SHA1:	7E6972BEAB3D18E49857079A24FB9336BC4D2D48
SHA-256:	E93B8E7FB86D2F7DFAE57416BB1FB6EE0EEA25629B972A5922940F0023C85F90
SHA-512:	22DD42D967124DA5A2209DD05FB6AD3F5D0D2687EA956A22BA1E31C56EC09DEB53F0711CD5B24D672405358502E9D1C502659BB36CED66CAF83923B021CA0286
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est. offline. Para utilizar o Google Docs sem uma liga..o . Internet, aceda .s defini..es na p.gina inicial do Google Docs e ative a sincroniza..o offline da pr.xima vez que estiver ligado . Internet.".. },.. "explanationofflineenabled": {.. "message": "Est. offline, mas continua a poder editar os ficheiros dispon.veis ou criar novos ficheiros.".. },.. "extdesc": {.. "message": "Edite, crie e veja os documentos, as folhas de c.lculo e as apresenta..es, tudo sem precisar de aceder . Internet.".. },.. "extname": {.. "message": "Google Docs offline".. },.. "learnmore": {.. "message": "Saber mais".. },.. "popuphelptext": {.. "message": "Escreva edite e colabore onde quer que esteja, com ou sem uma liga..o . Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5672_2050194923\CRX_INSTALL\_locales\ro\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	937
Entropy (8bit):	4.686555713975264
Encrypted:	false
SSDEEP:	24:1HA8dC6e6w+uFPHf2TFMMlecFpweWV4RE:pC6KvHf4plVweCx
MD5:	BED8332AB788098D276B448EC2B33351
SHA1:	6084124A2B32F386967DA980CBE79DD86742859E
SHA-256:	085787999D78FADFF9600C9DC5E3FF4FB4EB9BE06D6BB19DF2EEF8C284BE7B20
SHA-512:	22596584D10707CC1C8179ED3ABE46EF2C314CF9C3D0685921475944B8855AAB660590F8FA1CFDCE7976B4BB3BD9ABBBF053F61F1249A325FD0094E1C95692ED
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREEAZ. UN DOCUMENT".. },.. "explanationofflinedisabled": {.. "message": "E.ti offline. Pentru a utiliza Documente Google f.r. conexiune la internet, intr. .n set.rile din pagina principal. Documente Google .i activeaz. sincronizarea offline data viitoare c.nd e.ti conectat(.) la internet.".. },.. "explanationofflineenabled": {.. "message": "E.ti offline, dar po.i .nc. s. editezi fi.ierele disponibile sau s. creezi altele.".. },.. "extdesc": {.. "message": "Editeaz., creeaz. .i acceseaz. documente, foi de calcul .i prezent.ri - totul f.r. acces la internet.".. },.. "extname": {.. "message": "Documente Google Offline".. },.. "learnmore": {.. "message": "Afl. mai multe".. },.. "popuphelptext": {.. "message": "Scrie, editeaz. .i colaboreaz. oriunde ai fi, cu sau f.r. conexiune la internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5672_2050194923\CRX_INSTALL\_locales\ru\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1337
Entropy (8bit):	4.69531415794894
Encrypted:	false
SSDEEP:	24:1HABEapHTEmxUomjsfDVs8THjqBK8/hHUg41v+Lph5eFTHQ:I/VdxUomjsre8Kh4Riph5eFU
MD5:	51D34FE303D0C90EE409A2397FCA437D
SHA1:	B4B9A7B19C62D0AA95D1F10640A5FBA628CCCA12
SHA-256:	BE733625ACD03158103D62BC0EEF272CA3F265AC30C87A6A03467481A177DAE3
SHA-512:	E8670DED44DC6EE30E5F41C8B2040CF8A463CD9A60FC31FA70EB1D4C9AC1A3558369792B5B86FA761A21F5266D5A35E5C2C39297F367DAA84159585C19EC492A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......".. },.. "explanationofflinedisabled": {.. "message": "..... ............ Google ......... ... ........., ............ . .... . ......... ............. . ......-...... . .......... .. ......... .........".. },.. "explanationofflineenabled": {.. "message": "... ........... . .......... .. ...... ......... ..... ..... . ............. .., . ....... ........ ......-.......".. },.. "extdesc": {.. "message": ".........., .............. . ............ ........., ....... . ........... ... ....... . ..........".. },.. "extname": {.. "message": "Google.......... ......".. },.. "learnmore": {.

C:\Users\user\AppData\Local\Temp\scoped_dir5672_2050194923\CRX_INSTALL\_locales\si\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2846
Entropy (8bit):	3.7416822879702547
Encrypted:	false
SSDEEP:	48:YWi+htQTKEQb3aXQYJLSWy7sTQThQTnQtQTrEmQ6kiLsegQSJFwsQGaiPn779I+S:zhiTK5b3tUGVjTGTnQiTryOLpyaxYf/S
MD5:	B8A4FD612534A171A9A03C1984BB4BDD
SHA1:	F513F7300827FE352E8ECB5BD4BB1729F3A0E22A
SHA-256:	54241EBE651A8344235CC47AFD274C080ABAEBC8C3A25AFB95D8373B6A5670A2
SHA-512:	C03E35BFDE546AEB3245024EF721E7E606327581EFE9EAF8C5B11989D9033BDB58437041A5CB6D567BAA05466B6AAF054C47F976FD940EEEDF69FDF80D79095B
Malicious:	false
Preview:	{"createnew":{"message":"\u0db1\u0dc0 \u0dbd\u0dda\u0d9b\u0db1\u0dba\u0d9a\u0dca \u0dc3\u0dcf\u0daf\u0db1\u0dca\u0db1"},"explanationofflinedisabled":{"message":"\u0d94\u0db6 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2\u0dba. \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd \u0dc3\u0db8\u0dca\u0db6\u0db1\u0dca\u0db0\u0dad\u0dcf\u0dc0\u0d9a\u0dca \u0db1\u0ddc\u0db8\u0dd0\u0dad\u0dd2\u0dc0 Google Docs \u0db7\u0dcf\u0dc0\u0dd2\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8\u0da7, Google Docs \u0db8\u0dd4\u0dbd\u0dca \u0db4\u0dd2\u0da7\u0dd4\u0dc0 \u0db8\u0dad \u0dc3\u0dd0\u0d9a\u0dc3\u0dd3\u0db8\u0dca \u0dc0\u0dd9\u0dad \u0d9c\u0ddc\u0dc3\u0dca \u0d94\u0db6 \u0d8a\u0dc5\u0d9f \u0d85\u0dc0\u0dc3\u0dca\u0dae\u0dcf\u0dc0\u0dda \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd\u0dba\u0da7 \u0dc3\u0db6\u0dd0\u0db3\u0dd2 \u0dc0\u0dd2\u0da7 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2 \u0dc3\u0db8\u0db8\u0dd4\u0dc4\u0dd4\u0dbb\u0dca\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8 \u0d9a\u0dca\u200d\u0dbb\u0dd2\u0dba\u0dc

C:\Users\user\AppData\Local\Temp\scoped_dir5672_2050194923\CRX_INSTALL\_locales\sk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	934
Entropy (8bit):	4.882122893545996
Encrypted:	false
SSDEEP:	24:1HAF8pMv1RS4LXL22IUjdh8uJwpPqLDEtxKLhSS:hyv1RS4LXx38u36QsS
MD5:	8E55817BF7A87052F11FE554A61C52D5
SHA1:	9ABDC0725FE27967F6F6BE0DF5D6C46E2957F455
SHA-256:	903060EC9E76040B46DEB47BBB041D0B28A6816CB9B892D7342FC7DC6782F87C
SHA-512:	EFF9EC7E72B272DDE5F29123653BC056A4BC2C3C662AE3C448F8CB6A4D1865A0679B7E74C1B3189F3E262109ED6BC8F8D2BDE14AEFC8E87E0F785AE4837D01C7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVORI. NOV.".. },.. "explanationofflinedisabled": {.. "message": "Ste offline. Ak chcete pou.i. Dokumenty Google bez pripojenia na internet, po najbli..om pripojen. na internet prejdite do nastaven. na domovskej str.nke Dokumentov Google a.zapnite offline synchroniz.ciu.".. },.. "explanationofflineenabled": {.. "message": "Ste offline, no st.le m..ete upravova. dostupn. s.bory a.vytv.ra. nov..".. },.. "extdesc": {.. "message": ".prava, tvorba a.zobrazenie dokumentov, tabuliek a.prezent.ci.. To v.etko bez pr.stupu na internet.".. },.. "extname": {.. "message": "Dokumenty Google v re.ime offline".. },.. "learnmore": {.. "message": ".al.ie inform.cie".. },.. "popuphelptext": {.. "message": "P..te, upravujte a.spolupracuje, kdeko.vek ste, a.to s.pripojen.m na internet aj bez neho.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5672_2050194923\CRX_INSTALL\_locales\sl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	963
Entropy (8bit):	4.6041913416245
Encrypted:	false
SSDEEP:	12:1HASvgfECBxNFCEuKXowwJrpvPwNgEcPJJJEfWOCBxeFCJuGuU4KYXCSUXKDxX4A:1HAXMKYw8VYNLcaeDmKYLdX2zJBG5
MD5:	BFAEFEFF32813DF91C56B71B79EC2AF4
SHA1:	F8EDA2B632610972B581724D6B2F9782AC37377B
SHA-256:	AAB9CF9098294A46DC0F2FA468AFFF7CA7C323A1A0EFA70C9DB1E3A4DA05D1D4
SHA-512:	971F2BBF5E9C84DE3D31E5F2A4D1A00D891A2504F8AF6D3F75FC19056BFD059A270C4C9836AF35258ABA586A1888133FB22B484F260C1CBC2D1D17BC3B4451AA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "USTVARI NOVO".. },.. "explanationofflinedisabled": {.. "message": "Nimate vzpostavljene povezave. .e .elite uporabljati Google Dokumente brez internetne povezave, odprite nastavitve na doma.i strani Google Dokumentov in vklopite sinhronizacijo brez povezave, ko naslednji. vzpostavite internetno povezavo.".. },.. "explanationofflineenabled": {.. "message": "Nimate vzpostavljene povezave, vendar lahko .e vedno urejate razpolo.ljive datoteke ali ustvarjate nove.".. },.. "extdesc": {.. "message": "Urejajte, ustvarjajte in si ogledujte dokumente, preglednice in predstavitve . vse to brez internetnega dostopa.".. },.. "extname": {.. "message": "Google Dokumenti brez povezave".. },.. "learnmore": {.. "message": "Ve. o tem".. },.. "popuphelptext": {.. "message": "Pi.ite, urejajte in sodelujte, kjer koli ste, z internetno povezavo ali brez nje.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5672_2050194923\CRX_INSTALL\_locales\sr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1320
Entropy (8bit):	4.569671329405572
Encrypted:	false
SSDEEP:	24:1HArg/fjQg2JwrfZtUWTrw1P4epMnRGi5TBmuPDRxZQ/XtiCw/Rwh/Q9EVz:ogUg2JwDZe6rwKI8VTP9xK1CwhI94
MD5:	7F5F8933D2D078618496C67526A2B066
SHA1:	B7050E3EFA4D39548577CF47CB119FA0E246B7A4
SHA-256:	4E8B69E864F57CDDD4DC4E4FAF2C28D496874D06016BC22E8D39E0CB69552769
SHA-512:	0FBAB56629368EEF87DEEF2977CA51831BEB7DEAE98E02504E564218425C751853C4FDEAA40F51ECFE75C633128B56AE105A6EB308FD5B4A2E983013197F5DBA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ....".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. ..... ......... Google ......... ... ........ ...., ..... . .......... .. ........ ........ Google .......... . ........ ...... .............. ... ....... ... ...... ........ .. ...........".. },.. "explanationofflineenabled": {.. "message": "...... ..., ... . .... ...... .. ....... ...... . ........ ........ ... .. ....... .....".. },.. "extdesc": {.. "message": "....... . ........... ........., ...... . ............ . ....... ...... . ... . ... .. ... ........ .........".. },.. "extname": {.. "message

C:\Users\user\AppData\Local\Temp\scoped_dir5672_2050194923\CRX_INSTALL\_locales\sv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	884
Entropy (8bit):	4.627108704340797
Encrypted:	false
SSDEEP:	24:1HA0NOYT/6McbnX/yzklyOIPRQrJlvDymvBd:vNOcyHnX/yg0P4Bymn
MD5:	90D8FB448CE9C0B9BA3D07FB8DE6D7EE
SHA1:	D8688CAC0245FD7B886D0DEB51394F5DF8AE7E84
SHA-256:	64B1E422B346AB77C5D1C77142685B3FF7661D498767D104B0C24CB36D0EB859
SHA-512:	6D58F49EE3EF0D3186EA036B868B2203FE936CE30DC8E246C32E90B58D9B18C624825419346B62AF8F7D61767DBE9721957280AA3C524D3A5DFB1A3A76C00742
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKAPA NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du .r offline. Om du vill anv.nda Google Dokument utan internetuppkoppling, .ppna inst.llningarna p. Google Dokuments startsida och aktivera offlinesynkronisering n.sta g.ng du .r ansluten till internet.".. },.. "explanationofflineenabled": {.. "message": "Du .r offline, men det g.r fortfarande att redigera tillg.ngliga filer eller skapa nya.".. },.. "extdesc": {.. "message": "Redigera, skapa och visa dina dokument, kalkylark och presentationer . helt utan internet.tkomst.".. },.. "extname": {.. "message": "Google Dokument Offline".. },.. "learnmore": {.. "message": "L.s mer".. },.. "popuphelptext": {.. "message": "Skriv, redigera och samarbeta .verallt, med eller utan internetanslutning.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5672_2050194923\CRX_INSTALL\_locales\sw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	980
Entropy (8bit):	4.50673686618174
Encrypted:	false
SSDEEP:	12:1HASvgNHCBxNx1HMHyMhybK7QGU78oCuafIvfCBxex6EYPE5E1pOCSUJqONtCBh8:1HAGDQ3y0Q/Kjp/zhDoKMkeAT6dBaX
MD5:	D0579209686889E079D87C23817EDDD5
SHA1:	C4F99E66A5891973315D7F2BC9C1DAA524CB30DC
SHA-256:	0D20680B74AF10EF8C754FCDE259124A438DCE3848305B0CAF994D98E787D263
SHA-512:	D59911F91ED6C8FF78FD158389B4D326DAF4C031B940C399569FE210F6985E23897E7F404B7014FC7B0ACEC086C01CC5F76354F7E5D3A1E0DEDEF788C23C2978
Malicious:	false
Preview:	{.. "createnew": {.. "message": "FUNGUA MPYA".. },.. "explanationofflinedisabled": {.. "message": "Haupo mtandaoni. Ili uweze kutumia Hati za Google bila muunganisho wa intaneti, wakati utakuwa umeunganishwa kwenye intaneti, nenda kwenye sehemu ya mipangilio kwenye ukurasa wa kwanza wa Hati za Google kisha uwashe kipengele cha usawazishaji nje ya mtandao.".. },.. "explanationofflineenabled": {.. "message": "Haupo mtandaoni, lakini bado unaweza kubadilisha faili zilizopo au uunde mpya.".. },.. "extdesc": {.. "message": "Badilisha, unda na uangalie hati, malahajedwali na mawasilisho yako . yote bila kutumia muunganisho wa intaneti.".. },.. "extname": {.. "message": "Hati za Google Nje ya Mtandao".. },.. "learnmore": {.. "message": "Pata Maelezo Zaidi".. },.. "popuphelptext": {.. "message": "Andika hati, zibadilishe na ushirikiane na wengine popote ulipo, iwe una muunganisho wa intaneti au huna.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5672_2050194923\CRX_INSTALL\_locales\ta\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1941
Entropy (8bit):	4.132139619026436
Encrypted:	false
SSDEEP:	24:1HAoTZwEj3YfVLiANpx96zjlXTwB4uNJDZwq3CP1B2xIZiIH1CYFIZ03SoFyxrph:JCEjWiAD0ZXkyYFyPND1L/I
MD5:	DCC0D1725AEAEAAF1690EF8053529601
SHA1:	BB9D31859469760AC93E84B70B57909DCC02EA65
SHA-256:	6282BF9DF12AD453858B0B531C8999D5FD6251EB855234546A1B30858462231A
SHA-512:	6243982D764026D342B3C47C706D822BB2B0CAFFA51F0591D8C878F981EEF2A7FC68B76D012630B1C1EB394AF90EB782E2B49329EB6538DD5608A7F0791FDCF5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....... .........".. },.. "explanationofflinedisabled": {.. "message": ".......... ........... .... ....... ..... Google ......... .........., ...... .... ........... ......... ...., Google ... ................... ................ ......, ........ ......... ..........".. },.. "explanationofflineenabled": {.. "message": ".......... ..........., .......... .......... .......... ......... ........... ...... .....

C:\Users\user\AppData\Local\Temp\scoped_dir5672_2050194923\CRX_INSTALL\_locales\te\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1969
Entropy (8bit):	4.327258153043599
Encrypted:	false
SSDEEP:	48:R7jQrEONienBcFNBNieCyOBw0/kCcj+sEf24l+Q+u1LU4ljCj55ONipR41ssrNix:RjQJN1nBcFNBNlCyGcj+RXl+Q+u1LU4s
MD5:	385E65EF723F1C4018EEE6E4E56BC03F
SHA1:	0CEA195638A403FD99BAEF88A360BD746C21DF42
SHA-256:	026C164BAE27DBB36A564888A796AA3F188AAD9E0C37176D48910395CF772CEA
SHA-512:	E55167CB5638E04DF3543D57C8027B86B9483BFCAFA8E7C148EDED66454AEBF554B4C1CF3C33E93EC63D73E43800D6A6E7B9B1A1B0798B6BDB2F699D3989B052
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ...... ........ ......".. },.. "explanationofflinedisabled": {.. "message": ".... ........... ........ ......... ........ ....... Google Docs... .............., .... ............ ....... ..... ...... .... Google Docs .... ...... ............. ......, ........ ........ ... .......".. },.. "explanationofflineenabled": {.. "message": ".... ........... ......., .... .... ........ .......... .... ....... ..... ....... .... ..

C:\Users\user\AppData\Local\Temp\scoped_dir5672_2050194923\CRX_INSTALL\_locales\th\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1674
Entropy (8bit):	4.343724179386811
Encrypted:	false
SSDEEP:	48:fcGjnU3UnGKD1GeU3pktOggV1tL2ggG7Q:f3jnDG1eUk0g6RLE
MD5:	64077E3D186E585A8BEA86FF415AA19D
SHA1:	73A861AC810DABB4CE63AD052E6E1834F8CA0E65
SHA-256:	D147631B2334A25B8AA4519E4A30FB3A1A85B6A0396BC688C68DC124EC387D58
SHA-512:	56DD389EB9DD335A6214E206B3BF5D63562584394D1DE1928B67D369E548477004146E6CB2AD19D291CB06564676E2B2AC078162356F6BC9278B04D29825EF0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": ".............. ............. Google .................................... ............................... Google ...... .................................................................".. },.. "explanationofflineenabled": {.. "message": "................................................................".. },.. "extdesc": {.. "message": "..... ..... ........

C:\Users\user\AppData\Local\Temp\scoped_dir5672_2050194923\CRX_INSTALL\_locales\tr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1063
Entropy (8bit):	4.853399816115876
Encrypted:	false
SSDEEP:	24:1HAowYuBPgoMC4AGehrgGm7tJ3ckwFrXnRs5m:GYsPgrCtGehkGc3cvXr
MD5:	76B59AAACC7B469792694CF3855D3F4C
SHA1:	7C04A2C1C808FA57057A4CCEEE66855251A3C231
SHA-256:	B9066A162BEE00FD50DC48C71B32B69DFFA362A01F84B45698B017A624F46824
SHA-512:	2E507CA6874DE8028DC769F3D9DFD9E5494C268432BA41B51568D56F7426F8A5F2E5B111DDD04259EB8D9A036BB4E3333863A8FC65AAB793BCEF39EDFE41403B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN. OLU.TUR".. },.. "explanationofflinedisabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Google Dok.manlar'. .nternet ba.lant.s. olmadan kullanmak i.in, .nternet'e ba.lanabildi.inizde Google Dok.manlar ana sayfas.nda Ayarlar'a gidin ve .evrimd... senkronizasyonu etkinle.tirin.".. },.. "explanationofflineenabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Ancak, yine de mevcut dosyalar. d.zenleyebilir veya yeni dosyalar olu.turabilirsiniz.".. },.. "extdesc": {.. "message": "Dok.man, e-tablo ve sunu olu.turun, bunlar. d.zenleyin ve g.r.nt.leyin. T.m bu i.lemleri internet eri.imi olmadan yapabilirsiniz.".. },.. "extname": {.. "message": "Google Dok.manlar .evrimd...".. },.. "learnmore": {.. "message": "Daha Fazla Bilgi".. },.. "popuphelptext": {.. "message": ".nternet ba.lant.n.z olsun veya olmas.n, nerede olursan.z olun yaz.n, d.zenl

C:\Users\user\AppData\Local\Temp\scoped_dir5672_2050194923\CRX_INSTALL\_locales\uk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1333
Entropy (8bit):	4.686760246306605
Encrypted:	false
SSDEEP:	24:1HAk9oxkm6H4KyGGB9GeGoxPEYMQhpARezTtHUN97zlwpEH7:VKU1GB9GeBc/OARETt+9/WCb
MD5:	970963C25C2CEF16BB6F60952E103105
SHA1:	BBDDACFEEE60E22FB1C130E1EE8EFDA75EA600AA
SHA-256:	9FA26FF09F6ACDE2457ED366C0C4124B6CAC1435D0C4FD8A870A0C090417DA19
SHA-512:	1BED9FE4D4ADEED3D0BC8258D9F2FD72C6A177C713C3B03FC6F5452B6D6C2CB2236C54EA972ECE7DBFD756733805EB2352CAE44BAB93AA8EA73BB80460349504
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........".. },.. "explanationofflinedisabled": {.. "message": ".. . ...... ....... ... ............. Google ........... ... ......... . .........., ......... . ............ .. ........ ........ Google .......... . ......... ......-............., .... ...... . .......".. },.. "explanationofflineenabled": {.. "message": ".. . ...... ......, ..... ... .... ...... .......... ........ ..... ... .......... .....".. },.. "extdesc": {.. "message": "........., ......... . ............ ........., .......... ....... .. ........... ... ....... .. ..........".. },.. "extname": {.. "message": "Goo

C:\Users\user\AppData\Local\Temp\scoped_dir5672_2050194923\CRX_INSTALL\_locales\ur\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1263
Entropy (8bit):	4.861856182762435
Encrypted:	false
SSDEEP:	24:1HAl3zNEUhN3mNjkSIkmdNpInuUVsqNtOJDhY8Dvp/IkLzx:e3uUhQKvkmd+s11Lp1F
MD5:	8B4DF6A9281333341C939C244DDB7648
SHA1:	382C80CAD29BCF8AAF52D9A24CA5A6ECF1941C6B
SHA-256:	5DA836224D0F3A96F1C5EB5063061AAD837CA9FC6FED15D19C66DA25CF56F8AC
SHA-512:	FA1C015D4EA349F73468C78FDB798D462EEF0F73C1A762298798E19F825E968383B0A133E0A2CE3B3DF95F24C71992235BFC872C69DC98166B44D3183BF8A9E5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ......".. },.. "explanationofflinedisabled": {.. "message": ".. .. .... .... Google Docs .. .... ....... ..... ....... .... ..... .... ... .. .. ....... .. ..... ... .. Google Docs ... ... .. ....... .. ..... ... .. .... ...... ..... .. .. .....".. },.. "explanationofflineenabled": {.. "message": ".. .. .... ... .... .. ... ... ...... ..... ... ..... .. .... ... .. ... ..... ... .... ....".. },.. "extdesc": {.. "message": ".......... .......... ... ....... . .... ... ....... .. ..... .. .... ...... ..... .... ... ..... .......".. },.. "extname": {.. "message": "Google Docs .. ....".. },.. "learnmore": {..

C:\Users\user\AppData\Local\Temp\scoped_dir5672_2050194923\CRX_INSTALL\_locales\vi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1074
Entropy (8bit):	5.062722522759407
Encrypted:	false
SSDEEP:	24:1HAhBBLEBOVUSUfE+eDFmj4BLErQ7e2CIer32KIxqJ/HtNiE5nIGeU+KCVT:qHCDheDFmjDQgX32/S/hI9jh
MD5:	773A3B9E708D052D6CBAA6D55C8A5438
SHA1:	5617235844595D5C73961A2C0A4AC66D8EA5F90F
SHA-256:	597C5F32BC999746BC5C2ED1E5115C523B7EB1D33F81B042203E1C1DF4BBCAFE
SHA-512:	E5F906729E38B23F64D7F146FA48F3ABF6BAED9AAFC0E5F6FA59F369DC47829DBB4BFA94448580BD61A34E844241F590B8D7AEC7091861105D8EBB2590A3BEE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "T.O M.I".. },.. "explanationofflinedisabled": {.. "message": "B.n .ang ngo.i tuy.n. .. s. d.ng Google T.i li.u m. kh.ng c.n k.t n.i Internet, .i ..n c.i ..t tr.n trang ch. c.a Google T.i li.u v. b.t ..ng b. h.a ngo.i tuy.n v.o l.n ti.p theo b.n ...c k.t n.i v.i m.ng Internet.".. },.. "explanationofflineenabled": {.. "message": "B.n .ang ngo.i tuy.n, tuy nhi.n b.n v.n c. th. ch.nh s.a c.c t.p c. s.n ho.c t.o c.c t.p m.i.".. },.. "extdesc": {.. "message": "Ch.nh s.a, t.o v. xem t.i li.u, b.ng t.nh v. b.n tr.nh b.y . t.t c. m. kh.ng c.n truy c.p Internet.".. },.. "extname": {.. "message": "Google T.i li.u ngo.i tuy.n".. },.. "learnmore": {.. "message": "Ti.m hi..u th.m".. },.. "popuphelptext": {.. "message": "Vi.t, ch.nh s.a v. c.ng t.c

C:\Users\user\AppData\Local\Temp\scoped_dir5672_2050194923\CRX_INSTALL\_locales\zh_CN\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	879
Entropy (8bit):	5.7905809868505544
Encrypted:	false
SSDEEP:	12:1HASvgteHCBxNtSBXuetOrgIkA2OrWjMOCBxetSBXK01fg/SOiCSUEQ27e1CBhUj:1HAFsHtrIkA2jqldI/727eggcLk9pf
MD5:	3E76788E17E62FB49FB5ED5F4E7A3DCE
SHA1:	6904FFA0D13D45496F126E58C886C35366EFCC11
SHA-256:	E72D0BB08CC3005556E95A498BD737E7783BB0E56DCC202E7D27A536616F5EE0
SHA-512:	F431E570AB5973C54275C9EEF05E49E6FE2D6C17000F98D672DD31F9A1FAD98E0D50B5B0B9CF85D5BBD3B655B93FD69768C194C8C1688CB962AA75FF1AF9BDB6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ................ Google ....................".. },.. "explanationofflineenabled": {.. "message": ".............................".. },.. "extdesc": {.. "message": "...................... - ........".. },.. "extname": {.. "message": "Google .......".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "...............................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5672_2050194923\CRX_INSTALL\_locales\zh_HK\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1205
Entropy (8bit):	4.50367724745418
Encrypted:	false
SSDEEP:	24:YWvqB0f7Cr591AhI9Ah8U1F4rw4wtB9G976d6BY9scKUrPoAhNehIrI/uIXS1:YWvl7Cr5JHrw7k7u6BY9trW+rHR
MD5:	524E1B2A370D0E71342D05DDE3D3E774
SHA1:	60D1F59714F9E8F90EF34138D33FBFF6DD39E85A
SHA-256:	30F44CFAD052D73D86D12FA20CFC111563A3B2E4523B43F7D66D934BA8DACE91
SHA-512:	D2225CF2FA94B01A7B0F70A933E1FDCF69CDF92F76C424CE4F9FCC86510C481C9A87A7B71F907C836CBB1CA41A8BEBBD08F68DBC90710984CA738D293F905272
Malicious:	false
Preview:	{"createnew":{"message":"\u5efa\u7acb\u65b0\u9805\u76ee"},"explanationofflinedisabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\u3002\u5982\u8981\u5728\u6c92\u6709\u4e92\u806f\u7db2\u9023\u7dda\u7684\u60c5\u6cc1\u4e0b\u4f7f\u7528\u300cGoogle \u6587\u4ef6\u300d\uff0c\u8acb\u524d\u5f80\u300cGoogle \u6587\u4ef6\u300d\u9996\u9801\u7684\u8a2d\u5b9a\uff0c\u4e26\u5728\u4e0b\u6b21\u9023\u63a5\u4e92\u806f\u7db2\u6642\u958b\u555f\u96e2\u7dda\u540c\u6b65\u529f\u80fd\u3002"},"explanationofflineenabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\uff0c\u4f46\u60a8\u4ecd\u53ef\u4ee5\u7de8\u8f2f\u53ef\u7528\u6a94\u6848\u6216\u5efa\u7acb\u65b0\u6a94\u6848\u3002"},"extdesc":{"message":"\u7de8\u8f2f\u3001\u5efa\u7acb\u53ca\u67e5\u770b\u60a8\u7684\u6587\u4ef6\u3001\u8a66\u7b97\u8868\u548c\u7c21\u5831\uff0c\u5b8c\u5168\u4e0d\u9700\u4f7f\u7528\u4e92\u806f\u7db2\u3002"},"extname":{"message":"\u300cGoogle \u6587\u4ef6\u300d\u96e2\u7dda\u7248"},"learnmore":{"message":"\u77ad\u89e3\u8a

C:\Users\user\AppData\Local\Temp\scoped_dir5672_2050194923\CRX_INSTALL\_locales\zh_TW\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	843
Entropy (8bit):	5.76581227215314
Encrypted:	false
SSDEEP:	12:1HASvgmaCBxNtBtA24ZOuAeOEHGOCBxetBtMHQIJECSUnLRNocPNy6CBhU5OGg1O:1HAEfQkekYyLvRmcPGgzcL2kx5U
MD5:	0E60627ACFD18F44D4DF469D8DCE6D30
SHA1:	2BFCB0C3CA6B50D69AD5745FA692BAF0708DB4B5
SHA-256:	F94C6DDEDF067642A1AF18D629778EC65E02B6097A8532B7E794502747AEB008
SHA-512:	6FF517EED4381A61075AC7C8E80C73FAFAE7C0583BA4FA7F4951DD7DBE183C253702DEE44B3276EFC566F295DAC1592271BE5E0AC0C7D2C9F6062054418C7C27
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".....".. },.. "explanationofflinedisabled": {.. "message": ".................. Google ................ Google .................".. },.. "explanationofflineenabled": {.. "message": ".........................".. },.. "extdesc": {.. "message": ".............................".. },.. "extname": {.. "message": "Google .....".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "................................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5672_2050194923\CRX_INSTALL\_locales\zu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	912
Entropy (8bit):	4.65963951143349
Encrypted:	false
SSDEEP:	24:YlMBKqLnI7EgBLWFQbTQIF+j4h3OadMJzLWnCieqgwLeOvKrCRPE:YlMBKqjI7EQOQb0Pj4heOWqeyaBrMPE
MD5:	71F916A64F98B6D1B5D1F62D297FDEC1
SHA1:	9386E8F723C3F42DA5B3F7E0B9970D2664EA0BAA
SHA-256:	EC78DDD4CCF32B5D76EC701A20167C3FBD146D79A505E4FB0421FC1E5CF4AA63
SHA-512:	30FA4E02120AF1BE6E7CC7DBB15FAE5D50825BD6B3CF28EF21D2F2E217B14AF5B76CFCC165685C3EDC1D09536BFCB10CA07E1E2CC0DA891CEC05E19394AD7144
Malicious:	false
Preview:	{"createnew":{"message":"DALA ENTSHA"},"explanationofflinedisabled":{"message":"Awuxhunyiwe ku-inthanethi. Ukuze usebenzise i-Google Amadokhumenti ngaphandle koxhumano lwe-inthanethi, iya kokuthi izilungiselelo ekhasini lasekhaya le-Google Amadokhumenti bese uvula ukuvumelanisa okungaxhunyiwe ku-inthanethi ngesikhathi esilandelayo lapho uxhunywe ku-inthanethi."},"explanationofflineenabled":{"message":"Awuxhunyiwe ku-inthanethi, kodwa usangakwazi ukuhlela amafayela atholakalayo noma udale amasha."},"extdesc":{"message":"Hlela, dala, futhi ubuke amadokhumenti akho, amaspredishithi, namaphrezentheshini \u2014 konke ngaphandle kokufinyelela kwe-inthanethi."},"extname":{"message":"I-Google Amadokhumenti engaxhumekile ku-intanethi"},"learnmore":{"message":"Funda kabanzi"},"popuphelptext":{"message":"Bhala, hlela, futhi hlanganyela noma yikuphi lapho okhona, unalo noma ungenalo uxhumano lwe-inthanethi."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir5672_2050194923\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	11402
Entropy (8bit):	5.754031796037769
Encrypted:	false
SSDEEP:	192:RBG1G1UPkUj/86Op//Ier/2nsN9Jtwg+K8HNnswuHEIIMuuqd7CKqvqU3VjI632k:m8IGI4u8R8GjI02nk
MD5:	283E0D02D60305C279F0FAA25F1C1ADC
SHA1:	19FF63D91DCBC6CDA77B3413D43307D6659EFEA7
SHA-256:	871E76B0592FBE810FF3BD644021C69298D90C1062D7CD609D2315F470FFC1A0
SHA-512:	8278F88C2E6CB6328E6FE2D57C27039F1B278221F1A6B13E75B5AEE5A590C2A40E4EFC01EA892414EF551D20E5B7ECBD0CCD45DC2E225918702772F35C67C41B
Malicious:	false
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiIxMjgucG5nIiwicm9vdF9oYXNoIjoiZ2NWZy0xWWgySktRNVFtUmtjZGNmamU1dzVIc1JNN1ZCTmJyaHJ4eGZ5ZyJ9LHsicGF0aCI6Il9sb2NhbGVzL2FmL21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJxaElnV3hDSFVNLWZvSmVFWWFiWWlCNU9nTm9ncUViWUpOcEFhZG5KR0VjIn0seyJwYXRoIjoiX2xvY2FsZXMvYW0vbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IlpPQWJ3cEs2THFGcGxYYjh4RVUyY0VkU0R1aVY0cERNN2lEQ1RKTTIyTzgifSx7InBhdGgiOiJfbG9jYWxlcy9hci9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiUjJVaEZjdTVFcEJfUUZtU19QeGstWWRrSVZqd3l6WEoxdURVZEMyRE9BSSJ9LHsicGF0aCI6Il9sb2NhbGVzL2F6L21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJZVVJ3Mmp4UU5Lem1TZkY0YS1xcTBzbFBSSFc4eUlXRGtMY2g4Ry0zdjJRIn0seyJwYXRoIjoiX2xvY2FsZXMvYmUvbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IjNmRm9XYUZmUHJNelRXSkJsMXlqbUlyRDZ2dzlsa1VxdzZTdjAyUk1oVkEifSx7InBhdGgiOiJfbG9jYWxlcy9iZy9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiSXJ3M3RIem9xREx6bHdGa0hjTllOWFoyNmI0WWVwT2t4ZFN

C:\Users\user\AppData\Local\Temp\scoped_dir5672_2050194923\CRX_INSTALL\dasherSettingSchema.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	854
Entropy (8bit):	4.284628987131403
Encrypted:	false
SSDEEP:	12:ont+QByTwnnGNcMbyWM+Q9TZldnnnGGxlF/S0WOtUL0M0r:vOrGe4dDCVGOjWJ0nr
MD5:	4EC1DF2DA46182103D2FFC3B92D20CA5
SHA1:	FB9D1BA3710CF31A87165317C6EDC110E98994CE
SHA-256:	6C69CE0FE6FAB14F1990A320D704FEE362C175C00EB6C9224AA6F41108918CA6
SHA-512:	939D81E6A82B10FF73A35C931052D8D53D42D915E526665079EEB4820DF4D70F1C6AEBAB70B59519A0014A48514833FEFD687D5A3ED1B06482223A168292105D
Malicious:	false
Preview:	{. "type": "object",. "properties": {. "allowedDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Allow users to enable Docs offline for the specified managed domains.",. "description": "Users on managed devices will be able to enable docs offline if they are part of the specified managed domains.". },. "autoEnabledDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Auto enable Docs offline for the specified managed domains in certain eligible situations.",. "description": "Users on managed devices, in certain eligible situations, will be able to automatically access and edit recent files offline for the managed domains set in this property. They can still disable it from Drive settings.". }. }.}.

C:\Users\user\AppData\Local\Temp\scoped_dir5672_2050194923\CRX_INSTALL\extension_bundle.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3713)
Category:	dropped
Size (bytes):	110129
Entropy (8bit):	5.378595775383924
Encrypted:	false
SSDEEP:	1536:X4bTAbT6O3JFdq2zX7gBoqjbIEJtYOmT8VSvIJraS8SeByADx19sMdPqaKO:R6EDXUm/pT8VSoeSIy4HbKO
MD5:	14E8A18EEB4F0617881F53A4C7C14FB1
SHA1:	3220D4163848DA8408684D1AA07665521CC1B6C0
SHA-256:	42E5E8C66C4FDABB72F70FF9E0E3511BF28F46213F10935DE95E45631D849885
SHA-512:	11958863121EBE9CFBA4B92D05EEC8E592616FB88388F2A433C3C6876A5245BB651B31FB4F8DC13C16E1BBC7B3F93B9A648F999090883234D654FBAA160B3D3F
Malicious:	false
Preview:	'use strict';function aa(){return function(){}}function ba(a){return function(b){this[a]=b}}function k(a){return function(){return this[a]}}var n;function ca(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var da=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function ea(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=ea(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&da(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new TypeError("Symbol is not a constructor");re

C:\Users\user\AppData\Local\Temp\scoped_dir5672_2050194923\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2525
Entropy (8bit):	5.418261053353792
Encrypted:	false
SSDEEP:	24:1HEZ4WPoolELb/KxktGw3VwELb/4iL2QDkUpvdz1xxy/Atj1QB9yiVvQe:WdP5aLTKQGwlTLT4oRvvxs/APugiVb
MD5:	106E65B08B98C42BF83F0C90D633317B
SHA1:	B02822376AFB632FF58617BFE69A1118360DBB4E
SHA-256:	E2C65A48F9B8EBB0A50746106947017402770EA769F4E56A5EDCB9826DA394CD
SHA-512:	28414B73DBC1BD585033D41F8C4FF86A87F35AD21563D0411A25424B76F3231CE6D8E2872DD132B0CD98BE28201D834D7E0833D0C60B89BCECC96451B038FAA5
Malicious:	false
Preview:	{.. "author": {.. "email": "docs-hosted-app-own@google.com".. },.. "background": {.. "service_worker": "service_worker_bin_prod.js".. },.. "content_capabilities": {.. "matches": [ "https://docs.google.com/", "https://drive.google.com/", "https://drive-autopush.corp.google.com/", "https://drive-daily-0.corp.google.com/", "https://drive-daily-1.corp.google.com/", "https://drive-daily-2.corp.google.com/", "https://drive-daily-3.corp.google.com/", "https://drive-daily-4.corp.google.com/", "https://drive-daily-5.corp.google.com/", "https://drive-daily-6.corp.google.com/", "https://drive-preprod.corp.google.com/", "https://drive-staging.corp.google.com/" ],.. "permissions": [ "clipboardRead", "clipboardWrite", "unlimitedStorage" ].. },.. "content_security_policy": {.. "extension_pages": "script-src 'self'; object-src 'self'".. },.. "default_locale": "en_US",.. "description": "__MSG_extDesc__",.. "externally_connectable": {.. "ma

C:\Users\user\AppData\Local\Temp\scoped_dir5672_2050194923\CRX_INSTALL\offscreendocument.html

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	146
Entropy (8bit):	4.844571735146319
Encrypted:	false
SSDEEP:	3:PouV7uJL5XL/oGLvcRO0bZNGXIL/oGLvLAAJR3HK7+ZNGXIL0Hac4NGb:hxuJL5XsOvcY0bZNVsOv0E1K6NV4HX4O
MD5:	42C066BF545B5559862C95FD4AB5278C
SHA1:	752303215C6A94161F832F27D2AD6A255AD4EE0C
SHA-256:	2D1574646C3461A56031F869D6439592A27A1FB75DB6691437F1D173DCEF0E9A
SHA-512:	F4A7E02C42BC82E67CDFEB898F799EE0504235C0DD78456645DBAB6B689922A50F9E402C84890E01A488E0710DD5882478785121046F3BA0FD54B11B7661164D
Malicious:	false
Preview:	<!DOCTYPE html>.<html>.<body>. <script src="extension_bundle.js"></script>. <script src="offscreendocumentmain_bin.js"></script>.</body>.</html>

C:\Users\user\AppData\Local\Temp\scoped_dir5672_2050194923\CRX_INSTALL\offscreendocumentmain_bin.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	64
Entropy (8bit):	4.377367633875558
Encrypted:	false
SSDEEP:	3:agW9WqhMLFTuLeLvqDKuhKGQIeZ:Q9Wte4qrQIo
MD5:	379D8F77651F377229DB9792D7D80D43
SHA1:	24FF1ECB278BDB58738D260A43DC23CDEDF405D7
SHA-256:	564DA54E4437A125CD6B4974FFC465227EA4390A6060417CB2F2AA7E9B0FBC8F
SHA-512:	5C3BE38C3FFE13CB81C4FEE35EB1565E56AE69A716E4BC3D3EA15A82087CFBAB0B0F56BD30C9E0C7E043F1688F811A3543AD159285F2437DEEF1ED816F2153C2
Malicious:	false
Preview:	'use strict';docsOfflineExtensionOSD.createOffScreenDocument();.

C:\Users\user\AppData\Local\Temp\scoped_dir5672_2050194923\CRX_INSTALL\page_embed_script.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	4.65176400421739
Encrypted:	false
SSDEEP:	6:2LGX86tj66rU8j6D3bWq2un/XBtzHrH9Mnj63LK603:2Q8KVqb2u/Rt3Onj1
MD5:	3AB0CD0F493B1B185B42AD38AE2DD572
SHA1:	079B79C2ED6F67B5A5BD9BC8C85801F96B1B0F4B
SHA-256:	73E3888CCBC8E0425C3D2F8D1E6A7211F7910800EEDE7B1E23AD43D3B21173F7
SHA-512:	32F9DB54654F29F39D49F7A24A1FC800DBC0D4A8A1BAB2369C6F9799BC6ADE54962EFF6010EF6D6419AE51D5B53EC4B26B6E2CDD98DEF7CC0D2ADC3A865F37D3
Malicious:	false
Preview:	(function(){window._docs_chrome_extension_exists=!0;window._docs_chrome_extension_features_version=2;window._docs_chrome_extension_permissions="alarms clipboardRead clipboardWrite storage unlimitedStorage offscreen".split(" ");window._docs_chrome_extension_manifest_version=3;}).call(this);.

C:\Users\user\AppData\Local\Temp\scoped_dir5672_2050194923\CRX_INSTALL\service_worker_bin_prod.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (434)
Category:	dropped
Size (bytes):	1494
Entropy (8bit):	5.268711040463682
Encrypted:	false
SSDEEP:	24:nGwT2bljebGb/BMABM6VZX1iiIDvnOtV7OaEioAkm2OpYA7Ov5QGbFJZCCBGqQ6P:3mBwGb/jrIiuaEioAk+1GbnZCit3
MD5:	A292EFBFA0B1A72A9739326FBA9DB814
SHA1:	3B37402F4FA57621ABAF43D0DE1EE93581D6D44D
SHA-256:	651F6C04E1298F377EF297B0730B74EE57C62D9986A6648642EF6FDBF4615176
SHA-512:	9E37FF9BEDC7F612E5199F6D421B1AEE5ED4FBF2776932B07156F1CFDD89444F4D08E89205D543279C0AD307B2BF8316DDD8FDEFA3C0C7322C3CC2B6B836C6E8
Malicious:	false
Preview:	'use strict';function e(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}function f(a){return a.raw=a}function g(a){if(!(a instanceof Array)){var b=typeof Symbol!="undefined"&&Symbol.iterator&&a[Symbol.iterator];if(b)a=b.call(a);else if(typeof a.length=="number")a={next:e(a)};else throw Error(String(a)+" is not an iterable or ArrayLike");for(var c=[];!(b=a.next()).done;)c.push(b.value);a=c}return a}.function h(){for(var a=Number(this),b=[],c=a;c<arguments.length;c++)b[c-a]=arguments[c];return b};/.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0./.var k=this\|\|self;function l(a){return a};var m;function n(a){this.g=a}n.prototype.toString=function(){return this.g+""};var p={};function q(a){if(m===void 0){var b=null;var c=k.trustedTypes;if(c&&c.createPolicy){try{b=c.createPolicy("goog#html",{createHTML:l,createScript:l,createScriptURL:l})}catch(d){k.console&&k.console.error(d.message)}m=b}else m=b}a=(b=m)?b.createScriptURL(a):

C:\Users\user\AppData\Local\Temp\scoped_dir5672_2050194923\a3b1ef25-dbe9-4025-8d9d-3d469c2dea8f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	105751
Entropy (8bit):	7.719305738470107
Encrypted:	false
SSDEEP:	1536:E+v9bp/IOfeGw7RcWD+64Evk7R1jK5TXHqorAtDwh0dNlTFkfFWG+D85KK:LvLIOm/F9X4EM7LKlKat0nlTqfgRAsK
MD5:	040B397C77DA6B98111443AA677BF619
SHA1:	DF90E14E654EB59AF6A341C8DB17D69195C0D810
SHA-256:	E52D2E8C626E3D3AEC16AB502E53137B3C434326FBE4B178C25967F3B6C4CE7B
SHA-512:	0472F7FD9F94172CDC1D78155DA69ABE9FE218237E6A9E8C6940C5986B02E8A374D55F16D9F163981D3827D41B3D244A59A34139419CF23A4176CF4C4A3ECCD0
Malicious:	false
Preview:	Cr24....8.........0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[........s..'.67.o7..'.....9.G....u....ZP.Y...n.#..^._...t.y.=......@.<.l.8..HC........=B....=..#^y."hnZ!.v......x\b..\|.... Y..ioO.P.......7.iO[....S....+rVB..C..Z.m..Y.c.T'R?ui1..N..'.......O...M..^Xu...$.a.$.....q.$F....O....Zn...@`...H.^..w@.a..lW......[0Y0....H.=....*.H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...G0E. <P......9!.N..7#;.;h'zI.x2HW.....!.. ........g+...:x.@....)...W".&............o..:....~}[...T.].`..........0U.lBUH....>......-m){'.........K....<..K.....n.k..C....gU..._..G_..K?.......5..u).y.....v-.]+.....U=.O..s=}...^..I..'..q..~...E..C{9..7qK...ku.Y\|>..C.52.8..)n?nU..?...[..%......F\<...G..18R=."@.....

C:\Users\user\AppData\Local\Temp\scoped_dir5672_248555519\6769954d-eb62-49c5-bc62-915b227bdef1.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\scoped_dir5672_248555519\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1753
Entropy (8bit):	5.8889033066924155
Encrypted:	false
SSDEEP:	48:Pxpr7Xka2NXDpfsBJODI19Kg1JqcJW9O//JE3ZBDcpu/x:L3XgNSz9/4kIO3u3Xgpq
MD5:	738E757B92939B24CDBBD0EFC2601315
SHA1:	77058CBAFA625AAFBEA867052136C11AD3332143
SHA-256:	D23B2BA94BA22BBB681E6362AE5870ACD8A3280FA9E7241B86A9E12982968947
SHA-512:	DCA3E12DD5A9F1802DB6D11B009FCE2B787E79B9F730094367C9F26D1D87AF1EA072FF5B10888648FB1231DD83475CF45594BB0C9915B655EE363A3127A5FFC2
Malicious:	false
Preview:	[.. {.. "description": "treehash per file",.. "signed_content": {.. "payload": "eyJpdGVtX2lkIjoiam1qZmxnanBjcGVwZWFmbW1nZHBma29na2doY3BpaGEiLCJpdGVtX3ZlcnNpb24iOiIxLjIuMSIsInByb3RvY29sX3ZlcnNpb24iOjEsImNvbnRlbnRfaGFzaGVzIjpbeyJmb3JtYXQiOiJ0cmVlaGFzaCIsImRpZ2VzdCI6InNoYTI1NiIsImJsb2NrX3NpemUiOjQwOTYsImhhc2hfYmxvY2tfc2l6ZSI6NDA5NiwiZmlsZXMiOlt7InBhdGgiOiJjb250ZW50LmpzIiwicm9vdF9oYXNoIjoiQS13R1JtV0VpM1lybmxQNktneUdrVWJ5Q0FoTG9JZnRRZGtHUnBEcnp1QSJ9LHsicGF0aCI6ImNvbnRlbnRfbmV3LmpzIiwicm9vdF9oYXNoIjoiVU00WVRBMHc5NFlqSHVzVVJaVTFlU2FBSjFXVENKcHhHQUtXMGxhcDIzUSJ9LHsicGF0aCI6Im1hbmlmZXN0Lmpzb24iLCJyb290X2hhc2giOiJKNXYwVTkwRmN0ejBveWJMZmZuNm5TbHFLU0h2bHF2YkdWYW9FeWFOZU1zIn1dfV19",.. "signatures": [.. {.. "header": {.. "kid": "publisher".. },.. "protected": "eyJhbGciOiJSUzI1NiJ9",.. "signature": "UglEEilkOml5P1W0X6wc-_dB87PQB73uMir11923av57zPKujb4IUe_lbGpn7cRZsy6x-8i9eEKxAW7L2TSmYqrcp4XtiON6ppcf27FWACXOUJDax9wlMr-EOtyZhykCnB9vR

C:\Users\user\AppData\Local\Temp\scoped_dir5672_248555519\CRX_INSTALL\content.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8031), with no line terminators
Category:	dropped
Size (bytes):	9815
Entropy (8bit):	6.1716321262973315
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
MD5:	3D20584F7F6C8EAC79E17CCA4207FB79
SHA1:	3C16DCC27AE52431C8CDD92FBAAB0341524D3092
SHA-256:	0D40A5153CB66B5BDE64906CA3AE750494098F68AD0B4D091256939EEA243643
SHA-512:	315D1B4CC2E70C72D7EB7D51E0F304F6E64AC13AE301FD2E46D585243A6C936B2AD35A0964745D291AE9B317C316A29760B9B9782C88CC6A68599DB531F87D59
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir5672_248555519\CRX_INSTALL\content_new.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8604), with no line terminators
Category:	dropped
Size (bytes):	10388
Entropy (8bit):	6.174387413738973
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
MD5:	3DE1E7D989C232FC1B58F4E32DE15D64
SHA1:	42B152EA7E7F31A964914F344543B8BF14B5F558
SHA-256:	D4AA4602A1590A4B8A1BCE8B8D670264C9FB532ADC97A72BC10C43343650385A
SHA-512:	177E5BDF3A1149B0229B6297BAF7B122602F7BD753F96AA41CCF2D15B2BCF6AF368A39BB20336CCCE121645EC097F6BEDB94666C74ACB6174EB728FBFC43BC2A
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir5672_248555519\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	962
Entropy (8bit):	5.698567446030411
Encrypted:	false
SSDEEP:	24:1Hg9+D3DRnbuF2+sUrzUu+Y9VwE+Fg41T1O:NBqY+6E+F7JO
MD5:	E805E9E69FD6ECDCA65136957B1FB3BE
SHA1:	2356F60884130C86A45D4B232A26062C7830E622
SHA-256:	5694C91F7D165C6F25DAF0825C18B373B0A81EA122C89DA60438CD487455FD6A
SHA-512:	049662EF470D2B9E030A06006894041AE6F787449E4AB1FBF4959ADCB88C6BB87A957490212697815BB3627763C01B7B243CF4E3C4620173A95795884D998A75
Malicious:	false
Preview:	{.. "content_scripts": [ {.. "js": [ "content.js" ],.. "matches": [ "https://chrome.google.com/webstore/" ].. }, {.. "js": [ "content_new.js" ],.. "matches": [ "https://chromewebstore.google.com/" ].. } ],.. "description": "Edge relevant text changes on select websites to improve user experience and precisely surfaces the action they want to take.",.. "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu06p2Mjoy6yJDUUjCe8Hnqvtmjll73XqcbylxFZZWe+MCEAEK+1D0Nxrp0+IuWJL02CU3jbuR5KrJYoezA36M1oSGY5lIF/9NhXWEx5GrosxcBjxqEsdWv/eDoOOEbIvIO0ziMv7T1SUnmAA07wwq8DXWYuwlkZU/PA0Mxx0aNZ5+QyMfYqRmMpwxkwPG8gyU7kmacxgCY1v7PmmZo1vSIEOBYrxl064w5Q6s/dpalSJM9qeRnvRMLsszGY/J2bjQ1F0O2JfIlBjCOUg/89+U8ZJ1mObOFrKO4um8QnenXtH0WGmsvb5qBNrvbWNPuFgr2+w5JYlpSQ+O8zUCb8QZwIDAQAB",.. "manifest_version": 3,.. "name": "Edge relevant text changes",.. "update_url": "https://edge.microsoft.com/extensionwebstorebase/v1/crx",.. "version": "1.2.1"..}..

C:\Users\user\AppData\Local\Temp\{99f02b5e-0c7c-d542-ad44-27ce9be55c97}\SET9717.tmp

Download File

Process:	C:\Program Files (x86)\letsvpn\driver\tapinstall.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	7632
Entropy (8bit):	5.063558190257152
Encrypted:	false
SSDEEP:	192:wr8tW9yCTi3x4vlQd22bjR+iAUC7bMP+io3DcNSj6jvKFkPs7EQTXvt1Ld4Z:LWlGNdkkzo3DcNSj6jvKFkPs7EQTXvtk
MD5:	26009F092BA352C1A64322268B47E0E3
SHA1:	E1B2220CD8DCAEF6F7411A527705BD90A5922099
SHA-256:	150EF8EB07532146F833DC020C02238161043260B8A565C3CFCB2365BAD980D9
SHA-512:	C18111982CA233A7FC5D1E893F9BD8A3ED739756A47651E0638DEBB0704066AF6B25942C7961CDEEDF953A206EB159FE50E0E10055C40B68EB0D22F6064BB363
Malicious:	false
Preview:	; ***************************************************************************..; Copyright (C) 2002-2014 OpenVPN Technologies, Inc. ..; This program is free software; you can redistribute it and/or modify ..; it under the terms of the GNU General Public License version 2 ..; as published by the Free Software Foundation. ..; *************************************************************************....; SYNTAX CHECKER..; cd \WINDDK\3790\tools\chkinf..; chkinf c:\src\openvpn\tap-win32\i386\oemvista.inf..; OUTPUT -> file:///c:/WINDDK/3790/tools/chkinf/htm/c%23+src+openvpn+tap-win32+i386+__OemWin2k.htm....; INSTALL/REMOVE DRIVER..; tapinstall install OemVista.inf tapoas..; tapinstall update OemVista.inf tapoas..; tapinstall remove tapoas....;*******************************************************..; Note to Developers:..;..; If you are bundling the TAP-Windows driver with your app,..; you should try

C:\Users\user\AppData\Local\Temp\{99f02b5e-0c7c-d542-ad44-27ce9be55c97}\SET9776.tmp

Download File

Process:	C:\Program Files (x86)\letsvpn\driver\tapinstall.exe
File Type:	data
Category:	dropped
Size (bytes):	10739
Entropy (8bit):	7.214364446291792
Encrypted:	false
SSDEEP:	192:JDVLGVDFfap5UEwQl/WGhYCt17vJ4qnaj6jQc:7GCpzlnh3t1x4l2jn
MD5:	F73AC62E8DF97FAF3FC8D83E7F71BF3F
SHA1:	619A6E8F7A9803A4C71F73060649903606BEAF4E
SHA-256:	CC74CDB88C198EB00AEF4CAA20BF1FDA9256917713A916E6B94435CD4DCB7F7B
SHA-512:	F81F5757E0E449AD66A632299BCBE268ED02DF61333A304DCCAFB76B2AD26BAF1A09E7F837762EE4780AFB47D90A09BF07CB5B8B519C6FB231B54FA4FBE17FFE
Malicious:	false
Preview:	0.)....H........).0.)....1.0...`.H.e......0..i..+.....7.....Z0..V0...+.....7.......r?.X.M.....F.A..201008141946Z0...+.....7.....0..T0.... .....S!F.3....#.a.2`..e...#e...1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0<..+.....7...1.0,...F.i.l.e........o.e.m.v.i.s.t.a...i.n.f...0U..+.....7...1G0E0...+.....7.......010...`.H.e....... .....S!F.3....#.a.2`..e...#e...0...."~..m..8C. i$.4.l..1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0:..+.....7...1,0...F.i.l.e........t.a.p.0.9.0.1...s.y.s...0.... ..j(.M<.cR..XrT....F..R.]....?1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0:..+.....7...1,0*...F.i.l.e........t.a.p.0.9.0.1...s.y.s...0]..+.....7...1O0M0...+.....7...0...........010...`.H.e....... ..j(.M<.cR..XrT....F..R.]....?0.....".....A.Rw..... .1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0<..+.....7...1.0,...F.i.l.e........o.e.m.v.i.s.t.a...i.n.f.......0...0....+.

C:\Users\user\AppData\Local\Temp\{99f02b5e-0c7c-d542-ad44-27ce9be55c97}\SET97A6.tmp

Download File

Process:	C:\Program Files (x86)\letsvpn\driver\tapinstall.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	39920
Entropy (8bit):	6.338128217115975
Encrypted:	false
SSDEEP:	768:XtCuL1O/+AphG3F9NlXt5oZhDzbV104mmuiExsFwQvYp33U35:XdCoTxk1lmmjExsFNvYtk
MD5:	C10CCDEC5D7AF458E726A51BB3CDC732
SHA1:	0553AAB8C2106ABB4120353360D747B0A2B4C94F
SHA-256:	589C5667B1602837205DA8EA8E92FE13F8C36048B293DF931C99B39641052253
SHA-512:	7437C12AE5B31E389DE3053A55996E7A0D30689C6E0D10BDE28F1FBF55CEE42E65AA441B7B82448334E725C0899384DEE2645CE5C311F3A3CFC68E42AD046981
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........~..[...[...[....w..Z....w..^...[...m....w.._....w..^.../t..Q.../t..Z.../t..Z...Rich[...........................PE..d......_.........."......Z.....................@....................................=w....`A....................................................<.......X....p..T....x...#...........R..8............................S...............P...............................text..._>.......@.................. ..h.rdata.......P.......D..............@..H.data........`.......P..............@....pdata..T....p.......R..............@..HPAGE.................V.............. ..`INIT.................d.............. ..b.rsrc...X............p..............@..B.reloc...............v..............@..B................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\{99f02b5e-0c7c-d542-ad44-27ce9be55c97}\oemvista.inf (copy)

Download File

Process:	C:\Program Files (x86)\letsvpn\driver\tapinstall.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	7632
Entropy (8bit):	5.063558190257152
Encrypted:	false
SSDEEP:	192:wr8tW9yCTi3x4vlQd22bjR+iAUC7bMP+io3DcNSj6jvKFkPs7EQTXvt1Ld4Z:LWlGNdkkzo3DcNSj6jvKFkPs7EQTXvtk
MD5:	26009F092BA352C1A64322268B47E0E3
SHA1:	E1B2220CD8DCAEF6F7411A527705BD90A5922099
SHA-256:	150EF8EB07532146F833DC020C02238161043260B8A565C3CFCB2365BAD980D9
SHA-512:	C18111982CA233A7FC5D1E893F9BD8A3ED739756A47651E0638DEBB0704066AF6B25942C7961CDEEDF953A206EB159FE50E0E10055C40B68EB0D22F6064BB363
Malicious:	false
Preview:	; ***************************************************************************..; Copyright (C) 2002-2014 OpenVPN Technologies, Inc. ..; This program is free software; you can redistribute it and/or modify ..; it under the terms of the GNU General Public License version 2 ..; as published by the Free Software Foundation. ..; *************************************************************************....; SYNTAX CHECKER..; cd \WINDDK\3790\tools\chkinf..; chkinf c:\src\openvpn\tap-win32\i386\oemvista.inf..; OUTPUT -> file:///c:/WINDDK/3790/tools/chkinf/htm/c%23+src+openvpn+tap-win32+i386+__OemWin2k.htm....; INSTALL/REMOVE DRIVER..; tapinstall install OemVista.inf tapoas..; tapinstall update OemVista.inf tapoas..; tapinstall remove tapoas....;*******************************************************..; Note to Developers:..;..; If you are bundling the TAP-Windows driver with your app,..; you should try

C:\Users\user\AppData\Local\Temp\{99f02b5e-0c7c-d542-ad44-27ce9be55c97}\tap0901.cat (copy)

Download File

Process:	C:\Program Files (x86)\letsvpn\driver\tapinstall.exe
File Type:	data
Category:	dropped
Size (bytes):	10739
Entropy (8bit):	7.214364446291792
Encrypted:	false
SSDEEP:	192:JDVLGVDFfap5UEwQl/WGhYCt17vJ4qnaj6jQc:7GCpzlnh3t1x4l2jn
MD5:	F73AC62E8DF97FAF3FC8D83E7F71BF3F
SHA1:	619A6E8F7A9803A4C71F73060649903606BEAF4E
SHA-256:	CC74CDB88C198EB00AEF4CAA20BF1FDA9256917713A916E6B94435CD4DCB7F7B
SHA-512:	F81F5757E0E449AD66A632299BCBE268ED02DF61333A304DCCAFB76B2AD26BAF1A09E7F837762EE4780AFB47D90A09BF07CB5B8B519C6FB231B54FA4FBE17FFE
Malicious:	false
Preview:	0.)....H........).0.)....1.0...`.H.e......0..i..+.....7.....Z0..V0...+.....7.......r?.X.M.....F.A..201008141946Z0...+.....7.....0..T0.... .....S!F.3....#.a.2`..e...#e...1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0<..+.....7...1.0,...F.i.l.e........o.e.m.v.i.s.t.a...i.n.f...0U..+.....7...1G0E0...+.....7.......010...`.H.e....... .....S!F.3....#.a.2`..e...#e...0...."~..m..8C. i$.4.l..1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0:..+.....7...1,0...F.i.l.e........t.a.p.0.9.0.1...s.y.s...0.... ..j(.M<.cR..XrT....F..R.]....?1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0:..+.....7...1,0*...F.i.l.e........t.a.p.0.9.0.1...s.y.s...0]..+.....7...1O0M0...+.....7...0...........010...`.H.e....... ..j(.M<.cR..XrT....F..R.]....?0.....".....A.Rw..... .1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0<..+.....7...1.0,...F.i.l.e........o.e.m.v.i.s.t.a...i.n.f.......0...0....+.

C:\Users\user\AppData\Local\Temp\{99f02b5e-0c7c-d542-ad44-27ce9be55c97}\tap0901.sys (copy)

Download File

Process:	C:\Program Files (x86)\letsvpn\driver\tapinstall.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	39920
Entropy (8bit):	6.338128217115975
Encrypted:	false
SSDEEP:	768:XtCuL1O/+AphG3F9NlXt5oZhDzbV104mmuiExsFwQvYp33U35:XdCoTxk1lmmjExsFNvYtk
MD5:	C10CCDEC5D7AF458E726A51BB3CDC732
SHA1:	0553AAB8C2106ABB4120353360D747B0A2B4C94F
SHA-256:	589C5667B1602837205DA8EA8E92FE13F8C36048B293DF931C99B39641052253
SHA-512:	7437C12AE5B31E389DE3053A55996E7A0D30689C6E0D10BDE28F1FBF55CEE42E65AA441B7B82448334E725C0899384DEE2645CE5C311F3A3CFC68E42AD046981
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........~..[...[...[....w..Z....w..^...[...m....w.._....w..^.../t..Q.../t..Z.../t..Z...Rich[...........................PE..d......_.........."......Z.....................@....................................=w....`A....................................................<.......X....p..T....x...#...........R..8............................S...............P...............................text..._>.......@.................. ..h.rdata.......P.......D..............@..H.data........`.......P..............@....pdata..T....p.......R..............@..HPAGE.................V.............. ..`INIT.................d.............. ..b.rsrc...X............p..............@..B.reloc...............v..............@..B................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\letsvpn\LetsVPN.lnk

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Archive, ctime=Mon Jun 17 09:47:16 2024, mtime=Thu Jul 18 19:57:20 2024, atime=Mon Jun 17 09:47:16 2024, length=245880, window=hide
Category:	dropped
Size (bytes):	1100
Entropy (8bit):	4.62143374196204
Encrypted:	false
SSDEEP:	24:8msyEg+dOE4TmRkRiAsJ1dyOd/UUMvqyFm:8mslg+dOsR6BsJ1dyOdsUyF
MD5:	F7B8EB7996CD06BA0B51F79E1FAAF43A
SHA1:	A31E47D350E51270205F43CC90572C0B4B614F57
SHA-256:	7736BE0CBC37D3F01A02F995C9487689EEB2FC79A9979F99823D2AC4A07C2FDA
SHA-512:	B6D60E8904108AAE9FC4C48A33365C8D2EBCE8513B9B42D44DCD944374D9D7790580C05C4E9AEBE7CB30EB4DCFCAB64B73603C72CB378BC920CFE4B46EAE960A
Malicious:	false
Preview:	L..................F.... ...........e7..U...........x............................P.O. .:i.....+00.../C:\.....................1......X+...PROGRA~2.........O.I.X+.....................V.........P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....V.1......X+...letsvpn.@.......X+..X+...........................:...l.e.t.s.v.p.n.....b.2.x....X.U .LetsPRO.exe.H.......X.U.X+.....gH........................L.e.t.s.P.R.O...e.x.e.......Y...............-.......X..............k.....C:\Program Files (x86)\letsvpn\LetsPRO.exe..B.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.l.e.t.s.v.p.n.\.L.e.t.s.P.R.O...e.x.e...C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.l.e.t.s.v.p.n.........*................@Z\|...K.J.........`.......X.......210395...........hT..CrF.f4... .r.T..b...,.......hT..CrF.f4... .r.T..b...,..................1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.2.6.5.8.-.3.6.9.3.4.0.5.1.1.7.-.2.4

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\letsvpn\Uninstall.lnk

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	MS Windows shortcut, Item id list present, Has Relative path, Has Working directory, ctime=Sun Dec 31 23:06:32 1600, mtime=Sun Dec 31 23:06:32 1600, atime=Sun Dec 31 23:06:32 1600, length=0, window=hide
Category:	dropped
Size (bytes):	824
Entropy (8bit):	3.3763387811165657
Encrypted:	false
SSDEEP:	12:8wl0Va/ledp8A/LK4YRMbdpYgRtbdpYqQ/CNUvH4t2YZ/elFlSJm:8BdOAW4Y+djXdYOUFqy
MD5:	989BB8C7102AC576BC6B7DF8D2F623EF
SHA1:	24445FA435EDB9A0F27C99424A3B0CC924FAC059
SHA-256:	A428F7311DC973216A0823D6B52B2B093A835D7FA135E07B90F5AD00E5B04D6B
SHA-512:	49184700D845E2E60235AE602B9652783D0F5F955396D14AB368F52E293678BF6D5A78E12EDBF63B895D1E7B795CB42D3A856D750C179E4A247951D381B24AE1
Malicious:	false
Preview:	L..................F........................................................_....P.O. .:i.....+00.../C:\...................z.1...........Program Files (x86).X............................................P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...".V.1...........letsvpn.@............................................l.e.t.s.v.p.n.....`.2...........uninst.exe..F............................................u.n.i.n.s.t...e.x.e.......A.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.l.e.t.s.v.p.n.\.u.n.i.n.s.t...e.x.e...C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.l.e.t.s.v.p.n.........*................@Z\|...K.J.....................1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.2.6.5.8.-.3.6.9.3.4.0.5.1.1.7.-.2.4.7.6.7.5.6.6.3.4.-.1.0.0.2.................

C:\Users\user\AppData\Roaming\Tencent\DeskUpdate\GlobalMgr.db

Download File

Process:	C:\Program Files (x86)\Common Files\wegame.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	190
Entropy (8bit):	4.554753475758955
Encrypted:	false
SSDEEP:	3:LDIdyGK3Mscf/EQA41hBWRDSEwXTjOcwefEY2AA2c/GYxrJQreKvRiQGVXVK8E:3TCp1mx3wXPMAeAA7/vrIpG5gz
MD5:	711A9362008A15BE61507C9E0DFDC28C
SHA1:	F670C87E218062A2B80E8D7B42033E66BFBC9A0B
SHA-256:	3CDF829D27ED5E3EB9AE286551E9F339C59A1C6C363C114406655DD2B608AFB1
SHA-512:	7B4FE6AD70949923E8BD5A02DFF7819435E1EE0E185C1DA67C3F2CFE85C83C7571C1CC1F8A80EF1DAC96E2730F86D98E75C4ABE643EFBE175636BC2D07B9C43E
Malicious:	false
Preview:	[Profile]..config1=4900d2bd3c5a681f57a4fd1bfe264e56..config2=3105537a5f82de19dd9e30f475f73aed..config3=bca3d1adee3b08c9f6b566172def44da..config4=1b3d82ff206f2697db14bb5ee90b3a8d..config5=1..

C:\Users\user\AppData\Roaming\Tencent\WeGame\Flag

Download File

Process:	C:\Program Files (x86)\Common Files\wegame.exe
File Type:	data
Category:	dropped
Size (bytes):	16
Entropy (8bit):	2.9056390622295662
Encrypted:	false
SSDEEP:	3:1BvCe:1Bqe
MD5:	444A2C3AB5E7A896ACBC3AA612B2F5BC
SHA1:	74BB5A61E01D44D4D9EFA739CBFAA311B4446DBF
SHA-256:	2342944CC9FB6DB18B504BC1E5DA43DED3A70A68F96C785CC5EEF2962F11CCAE
SHA-512:	2AFAFB45B30B0D2386707A74BF16F7C30AD69548C8CDAD1C4FC3DCD81B4A4130DF92D6369FD75551A7E9EFAAB20A3317B9512BEDB967A40560AD63610BC23103
Malicious:	false
Preview:	..........9...Q.

C:\Users\user\Desktop\LetsVPN.lnk

Download File

Process:	C:\Program Files (x86)\haxGhXjmBFM.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Archive, ctime=Mon Jun 17 09:47:16 2024, mtime=Thu Jul 18 19:57:24 2024, atime=Mon Jun 17 09:47:16 2024, length=245880, window=hide
Category:	dropped
Size (bytes):	1064
Entropy (8bit):	4.67054668870535
Encrypted:	false
SSDEEP:	24:8m7yEg+dOE4d6kRkRiAsJXdyOd/UUMvqyFm:8m7lg+dOnR6BsJXdyOdsUyF
MD5:	7C63EDC549CFFD26852A115DC1EBB283
SHA1:	03202331ED16549F0F97C2C99C28C7E64EBF62B9
SHA-256:	1B14C78AB3BF95A358E048CD1B7318A93A062587EDA6C449AB5A835D9CA88E56
SHA-512:	E9583357B684F27321A76401F60BDD55036A65EECB28E40A900854826FA94791E23AC92F77928C136DEF43BDCA8FE5963F248916ABDC257905CCB6BE5E0B95C9
Malicious:	false
Preview:	L..................F.... ...........YV..U...........x............................P.O. .:i.....+00.../C:\.....................1......X+...PROGRA~2.........O.I.X+.....................V.........P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....V.1......X-...letsvpn.@.......X+..X-...........................c2..l.e.t.s.v.p.n.....b.2.x....X.U .LetsPRO.exe.H.......X.U.X+.....gH........................L.e.t.s.P.R.O...e.x.e.......Y...............-.......X..............k.....C:\Program Files (x86)\letsvpn\LetsPRO.exe..0.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.l.e.t.s.v.p.n.\.L.e.t.s.P.R.O...e.x.e...C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.l.e.t.s.v.p.n.........*................@Z\|...K.J.........`.......X.......210395...........hT..CrF.f4... .r.T..b...,.......hT..CrF.f4... .r.T..b...,..................1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.2.6.5.8.-.3.6.9.3.4.0.5.1.1.7.-.2.4.7.6.7.5.6.6.3.4.-.1.0.0.2.........9

C:\Windows\INF\oem4.inf

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	7632
Entropy (8bit):	5.063558190257152
Encrypted:	false
SSDEEP:	192:wr8tW9yCTi3x4vlQd22bjR+iAUC7bMP+io3DcNSj6jvKFkPs7EQTXvt1Ld4Z:LWlGNdkkzo3DcNSj6jvKFkPs7EQTXvtk
MD5:	26009F092BA352C1A64322268B47E0E3
SHA1:	E1B2220CD8DCAEF6F7411A527705BD90A5922099
SHA-256:	150EF8EB07532146F833DC020C02238161043260B8A565C3CFCB2365BAD980D9
SHA-512:	C18111982CA233A7FC5D1E893F9BD8A3ED739756A47651E0638DEBB0704066AF6B25942C7961CDEEDF953A206EB159FE50E0E10055C40B68EB0D22F6064BB363
Malicious:	false
Preview:	; ***************************************************************************..; Copyright (C) 2002-2014 OpenVPN Technologies, Inc. ..; This program is free software; you can redistribute it and/or modify ..; it under the terms of the GNU General Public License version 2 ..; as published by the Free Software Foundation. ..; *************************************************************************....; SYNTAX CHECKER..; cd \WINDDK\3790\tools\chkinf..; chkinf c:\src\openvpn\tap-win32\i386\oemvista.inf..; OUTPUT -> file:///c:/WINDDK/3790/tools/chkinf/htm/c%23+src+openvpn+tap-win32+i386+__OemWin2k.htm....; INSTALL/REMOVE DRIVER..; tapinstall install OemVista.inf tapoas..; tapinstall update OemVista.inf tapoas..; tapinstall remove tapoas....;*******************************************************..; Note to Developers:..;..; If you are bundling the TAP-Windows driver with your app,..; you should try

C:\Windows\INF\setupapi.dev.log

Download File

Process:	C:\Program Files (x86)\letsvpn\driver\tapinstall.exe
File Type:	Generic INItialization configuration [BeginLog]
Category:	dropped
Size (bytes):	45365
Entropy (8bit):	5.057435848483168
Encrypted:	false
SSDEEP:	384:OGdni80C/8g0atRf7yr14ujuNY9AZi3Z/oUtwr05hauPse58HciTTtjsa:Own95cdyYloiwQ+k5Gtga
MD5:	4787965381BBD1BAB25FEE3A8D9B5E2D
SHA1:	E14CBAA04FC8042C635AB05DF9B9377F53B5429D
SHA-256:	1567E50117B0CF7585C91705B9E3998F1D9083F082A1174A3ECAA10D1B4CB185
SHA-512:	AF5631CC273279F1653489762C0628AF87DAB9EB20E5D5BB61254AF2D2DD99BAAEA58213E2739D11699F6D9EBA12D5BFA8C0BDA258E45AFE6BE102E6B0862EC8
Malicious:	false
Preview:	[Device Install Log].. OS Version = 10.0.19045.. Service Pack = 0.0.. Suite = 0x0100.. ProductType = 1.. Architecture = amd64....[BeginLog]....[Boot Session: 2023/10/03 09:57:02.288]....>>> [Setup Import Driver Package - C:\Windows\system32\spool\tools\Microsoft Print To PDF\prnms009.Inf]..>>> Section start 2023/10/03 09:57:37.904.. cmd: C:\Windows\System32\spoolsv.exe.. inf: Provider: Microsoft.. inf: Class GUID: {4D36E979-E325-11CE-BFC1-08002BE10318}.. inf: Driver Version: 06/21/2006,10.0.19041.1806.. inf: Catalog File: prnms009.cat.. ump: Import flags: 0x0000000D.. pol: {Driver package policy check} 09:57:37.920.. pol: {Driver package policy check - exit(0x00000000)} 09:57:37.920.. sto: {Stage Driver Package: C:\Windows\system32\spool\tools\Microsoft Print To PDF\prnms009.Inf} 09:57:37.920.. inf: {Query Configurability: C:\Windows\system32\spool\tools\Microsoft Print To PDF\prnms009.Inf} 09:57:37.920.. inf:

C:\Windows\Installer\61335c.msi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Security: 0, Code page: 936, Revision Number: {D5081896-4C2D-4C53-BFE1-6025F1920CD2}, Number of Words: 2, Subject: 1etsvpn, Author: 1etsvpn, Name of Creating Application: 1etsvpn, Template: ;2052, Comments: Installer 1etsvpn , Title: Installation Database, Keywords: Installer, MSI, Database, Create Time/Date: Thu Jul 18 07:56:44 2024, Last Saved Time/Date: Thu Jul 18 07:56:44 2024, Last Printed: Thu Jul 18 07:56:44 2024, Number of Pages: 450
Category:	dropped
Size (bytes):	52425728
Entropy (8bit):	7.992676731270942
Encrypted:	true
SSDEEP:	786432:4xAq3kvG6v0/mooApRkpeGUIhkdoOcATOGqltpIXfiOlMVVqSqGVEA+c:hqUvL8/mQrk0RolAKZi1lyVqwEA+c
MD5:	B0428243A495BC1691D4C4F33B54E0EB
SHA1:	E7B0C8D355FC3CC1158B96B3A0E3420FAC2B3F06
SHA-256:	5683928D134CC328A0AE1460FB0C58DDF97D5BC854758C97A5C4D3C1869B842D
SHA-512:	2E61C7D1E97B8E878B6ED492230BA89DD803410086959CF9CAB71BB407EEB9F3B66BBDB9B48F2344BE6A7F1F6BDDFFAEB60A190C335DF9E53FAAB7BD7B086B29
Malicious:	false
Preview:	......................>................... ...................................=...>...?...@...A...B...C...D...E...............H...I...J...K...L...M.......................................................................................................................................................................................................................................................................................................................................................................................................&...9........................................................................................... ...!..."...#...$...%...2...1...(...)...*...+...,...-......./...0.......7...3...4...5...6...;...8...:...<...................................................G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z...[...\...]...^..._...`...a...b...c...d...e...f...g...h...i...j...k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\Windows\Installer\MSI3D01.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	1328287
Entropy (8bit):	6.533766484627372
Encrypted:	false
SSDEEP:	24576:OHit95CUHit95C7Hit95CkHit95C4Hit95CoHit95Cf:OCt95CUCt95C7Ct95CkCt95C4Ct95CoV
MD5:	3530613471351D2222C315CB61CFD7DD
SHA1:	A8680514CA2E1386DD9366FA76AAE051F11C707A
SHA-256:	F65B993F35F4A24A289BC48307286E2252E43B5FEBB8238411A4F20656000D03
SHA-512:	625CDB37039920199ADF8426B918222A8D080C67619E643C96ECFA2D61D8DC0E5C58C87805508418CFDD6D264FCCDB5C717EE16E680221B2CBFAC354C406C973
Malicious:	false
Preview:	...@IXOS.@.....@$..X.@.....@.....@.....@.....@.....@......&.{5FD627E3-9BD5-491C-92C5-2934CD5F1E11}..1etsvpn..lets-test.msi.@.....@.....@.....@........&.{D5081896-4C2D-4C53-BFE1-6025F1920CD2}.....@.....@.....@.....@.......@.....@.....@.......@......1etsvpn......Rollback..ck(W.V...d\O:...[1]..RollbackCleanup..ck(W Rd..Y.N.e.N...e.N:. .[.1.]....@.......@........ProcessComponents..ck(W.f.e.~.N.l.Q.....@.....@.....@.]....&.{595B7CE7-E971-4D65-AA8A-F0476F19E124}M.01:\Software\1etsvpn\{8A774392-3223-4D55-888E-FB2DCEB19368}\AI_INSTALLPERUSER.@.......@.....@.....@......&.{92C80294-11B4-4FF7-9FC6-3CFF2DDD4C89}&.C:\Program Files (x86)\haxGhXjmBFM.exe.@.......@.....@.....@......&.{CCF87755-7111-436F-BC7B-EF0479ACBAA4}9.C:\Program Files (x86)\Common Files\adapt_for_imports.dll.@.......@.....@.....@......&.{1B0C81AF-0EF7-485A-9CC5-EE499F9FFDE6}2.C:\Program Files (x86)\Common Files\beacon_sdk.dll.@.......@.....@.....@......&.{0DE0322F-6139-4956-87EC-E84A0167D325}..C:\Program Files (x86)\Common Files\

C:\Windows\Installer\MSI3D02.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	220264
Entropy (8bit):	6.529506114174054
Encrypted:	false
SSDEEP:	3072:R5Lor2Lp9Zjxt8Bd9XF6N5RTNL5tludmMiz84Fak4lNAKIpwCHLDd4CHKECNE3QY:XCrUPJ84ilfnCHLDWEIMjq5vR4r7
MD5:	E7E51805794E1A71C5E2BDD45F4EE5C9
SHA1:	D178D4C1DEB28018A180AC3A6182E923660E16F5
SHA-256:	F6216D72F4D9A7D46F3B878650B2F26982E4F05B8B5CE363A60C564159DB781F
SHA-512:	5632CEAE01B6AAD3D806BCDF2BDAF40E487CB3DC48D83597429DC4E9C5867A878A87CA06C3A2E43E8FC532295B5B8EFBB472BD07C33F6B6629E877E3392EB576
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........+..x..x..x...y..x...yi..x...y..x...y..x...y..x...y...x...y..x...y..x..x...x...y..x...y..x..:x..x.Rx..x...y..xRich..x................PE..L.....e.........."!...&.>...........;.......P...............................p......s.....@A........................@...........x....0..x............"..h:...@...!..$...p............................d..@............P......D...@....................text....=.......>.................. ..`.rdata.......P.......B..............@..@.data...............................@....didat..`.... ......................@....rsrc...x....0......................@..@.reloc...!...@..."..................@..B........................................................................................................................................................................................................................................

C:\Windows\Installer\MSI3DDE.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	417896
Entropy (8bit):	6.8043660889312765
Encrypted:	false
SSDEEP:	6144:Yb+2H9tragDe0dMOalADuFx9Ychph0lhSMXlBXBWNvvIFNa1yAIn:t2dMrl7Fph0lhSMXlknI8yAIn
MD5:	0901970C2066AED8A97D75AAF1FD3146
SHA1:	F0C700A4BFCEBAD9843E01A88BAB71B5F38996D8
SHA-256:	41F827E6ADDFC71D68CD4758336EDF602349FB1230256EC135121F95C670D773
SHA-512:	00E12FD2D752A01DFA75550FFAF3A2F337171CEC93CD013083C37137A455E93BEBD72E7D8487EC3E1DE5FE22994F058829A6597765612278C20D601192CBE733
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........^...0T..0T..0T_.3U..0T_.5U+.0T..4U..0T..3U..0T..5U.0T_.4U..0T_.6U..0T_.1U..0T..1T[.0T..9U..0T..0U..0T...T..0T...T..0T..2U..0TRich..0T........PE..L.....e.........."!...&.&...........t.......@...............................`............@A......................................... ..x............&..h:...0...-......p...........................@...@............@...............................text...Z$.......&.................. ..`.rdata.......@.......*..............@..@.data...............................@....rsrc...x.... ......................@..@.reloc...-...0......................@..B........................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI3E0E.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	417896
Entropy (8bit):	6.8043660889312765
Encrypted:	false
SSDEEP:	6144:Yb+2H9tragDe0dMOalADuFx9Ychph0lhSMXlBXBWNvvIFNa1yAIn:t2dMrl7Fph0lhSMXlknI8yAIn
MD5:	0901970C2066AED8A97D75AAF1FD3146
SHA1:	F0C700A4BFCEBAD9843E01A88BAB71B5F38996D8
SHA-256:	41F827E6ADDFC71D68CD4758336EDF602349FB1230256EC135121F95C670D773
SHA-512:	00E12FD2D752A01DFA75550FFAF3A2F337171CEC93CD013083C37137A455E93BEBD72E7D8487EC3E1DE5FE22994F058829A6597765612278C20D601192CBE733
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........^...0T..0T..0T_.3U..0T_.5U+.0T..4U..0T..3U..0T..5U.0T_.4U..0T_.6U..0T_.1U..0T..1T[.0T..9U..0T..0U..0T...T..0T...T..0T..2U..0TRich..0T........PE..L.....e.........."!...&.&...........t.......@...............................`............@A......................................... ..x............&..h:...0...-......p...........................@...@............@...............................text...Z$.......&.................. ..`.rdata.......@.......*..............@..@.data...............................@....rsrc...x.... ......................@..@.reloc...-...0......................@..B........................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI3E8C.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	220264
Entropy (8bit):	6.529506114174054
Encrypted:	false
SSDEEP:	3072:R5Lor2Lp9Zjxt8Bd9XF6N5RTNL5tludmMiz84Fak4lNAKIpwCHLDd4CHKECNE3QY:XCrUPJ84ilfnCHLDWEIMjq5vR4r7
MD5:	E7E51805794E1A71C5E2BDD45F4EE5C9
SHA1:	D178D4C1DEB28018A180AC3A6182E923660E16F5
SHA-256:	F6216D72F4D9A7D46F3B878650B2F26982E4F05B8B5CE363A60C564159DB781F
SHA-512:	5632CEAE01B6AAD3D806BCDF2BDAF40E487CB3DC48D83597429DC4E9C5867A878A87CA06C3A2E43E8FC532295B5B8EFBB472BD07C33F6B6629E877E3392EB576
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........+..x..x..x...y..x...yi..x...y..x...y..x...y..x...y...x...y..x...y..x..x...x...y..x...y..x..:x..x.Rx..x...y..xRich..x................PE..L.....e.........."!...&.>...........;.......P...............................p......s.....@A........................@...........x....0..x............"..h:...@...!..$...p............................d..@............P......D...@....................text....=.......>.................. ..`.rdata.......P.......B..............@..@.data...............................@....didat..`.... ......................@....rsrc...x....0......................@..@.reloc...!...@..."..................@..B........................................................................................................................................................................................................................................

C:\Windows\Installer\MSI3EAC.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	220264
Entropy (8bit):	6.529506114174054
Encrypted:	false
SSDEEP:	3072:R5Lor2Lp9Zjxt8Bd9XF6N5RTNL5tludmMiz84Fak4lNAKIpwCHLDd4CHKECNE3QY:XCrUPJ84ilfnCHLDWEIMjq5vR4r7
MD5:	E7E51805794E1A71C5E2BDD45F4EE5C9
SHA1:	D178D4C1DEB28018A180AC3A6182E923660E16F5
SHA-256:	F6216D72F4D9A7D46F3B878650B2F26982E4F05B8B5CE363A60C564159DB781F
SHA-512:	5632CEAE01B6AAD3D806BCDF2BDAF40E487CB3DC48D83597429DC4E9C5867A878A87CA06C3A2E43E8FC532295B5B8EFBB472BD07C33F6B6629E877E3392EB576
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........+..x..x..x...y..x...yi..x...y..x...y..x...y..x...y...x...y..x...y..x..x...x...y..x...y..x..:x..x.Rx..x...y..xRich..x................PE..L.....e.........."!...&.>...........;.......P...............................p......s.....@A........................@...........x....0..x............"..h:...@...!..$...p............................d..@............P......D...@....................text....=.......>.................. ..`.rdata.......P.......B..............@..@.data...............................@....didat..`.... ......................@....rsrc...x....0......................@..@.reloc...!...@..."..................@..B........................................................................................................................................................................................................................................

C:\Windows\Installer\MSI3EDC.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	220264
Entropy (8bit):	6.529506114174054
Encrypted:	false
SSDEEP:	3072:R5Lor2Lp9Zjxt8Bd9XF6N5RTNL5tludmMiz84Fak4lNAKIpwCHLDd4CHKECNE3QY:XCrUPJ84ilfnCHLDWEIMjq5vR4r7
MD5:	E7E51805794E1A71C5E2BDD45F4EE5C9
SHA1:	D178D4C1DEB28018A180AC3A6182E923660E16F5
SHA-256:	F6216D72F4D9A7D46F3B878650B2F26982E4F05B8B5CE363A60C564159DB781F
SHA-512:	5632CEAE01B6AAD3D806BCDF2BDAF40E487CB3DC48D83597429DC4E9C5867A878A87CA06C3A2E43E8FC532295B5B8EFBB472BD07C33F6B6629E877E3392EB576
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........+..x..x..x...y..x...yi..x...y..x...y..x...y..x...y...x...y..x...y..x..x...x...y..x...y..x..:x..x.Rx..x...y..xRich..x................PE..L.....e.........."!...&.>...........;.......P...............................p......s.....@A........................@...........x....0..x............"..h:...@...!..$...p............................d..@............P......D...@....................text....=.......>.................. ..`.rdata.......P.......B..............@..@.data...............................@....didat..`.... ......................@....rsrc...x....0......................@..@.reloc...!...@..."..................@..B........................................................................................................................................................................................................................................

C:\Windows\Installer\SourceHash{5FD627E3-9BD5-491C-92C5-2934CD5F1E11}

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.1628202712569422
Encrypted:	false
SSDEEP:	12:JSbX72FjJ3liAGiLIlHVRpiBh/7777777777777777777777777vDHFmv9up7l0G:J/4QI5AEvrF
MD5:	47030E85A403E34760812E0B53E5C426
SHA1:	CC62A073DD64E551F408E40EB36D600D2F98E2D2
SHA-256:	A6943874C87C1F768CC98DD7243332F0C63968333C0EA983DDF15203F3DA09F4
SHA-512:	AF1BAA52E2381501F3D78EA3ED01931038EBEE3FA1E5791163B7E22C2E3AC75C1B59BE8B20927662ECE4F5718870AAB871AD399E784984AAB0754309E00E0F77
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\inprogressinstallinfo.ipi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.4743557719535751
Encrypted:	false
SSDEEP:	48:M8PhfuRc06WXJanT5iX+Zd0Skd+AECToGd0SkdET:jhf1RnTC+Y30
MD5:	12444C24C476A8F6965EBCF4A203A2E5
SHA1:	DB9A72CF11133FF4730A63097F43A01245A92F10
SHA-256:	E173E7F850628A416452F71D87926B1D87F6FFA0F1602D5CEC2E3F6DA177595E
SHA-512:	25723AA168FDD458D6FA83DC276D5E0C5371BF261E706FC0813568B5BC63A912370307279EF5173CB9BF1E6F94961E7D786D30A4C9BA2AF8A35646E9DE4CBB9A
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Logs\NetSetup\service.0.etl

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	524288
Entropy (8bit):	0.4232623046121662
Encrypted:	false
SSDEEP:	192:PLZm8DmT1xMS92sICkjd0x5AUko5HOLboAcKYzFlgbmD5eB:PLvM7mjhRoZO/oAPX
MD5:	574D40D1EAF9CBBB42B7CB5952089156
SHA1:	3530F23541DA2D428696D1BF0772D24AD673328B
SHA-256:	1EDD05CD1C67B39441CD901D9D94F07E1B278E8FFFFD457DFEB29AB4C5D74644
SHA-512:	95B1805046F6BF67FF649063AAD7B32063CF877D8262F36A3E1F26B735BC436F9012DC67658EBE92F438C7066DF8890396E3A7C55A50EF93B8610D6EE447F9B6
Malicious:	false
Preview:	....8...8.......................................P...!....................................?......................eJ.......Q.HU...Zb..................................................@.t.z.r.e.s...d.l.l.,.-.2.6.2.......................................................@.t.z.r.e.s...d.l.l.,.-.2.6.1...........................................................@K5..............?..............N.e.t.C.f.g.T.r.a.c.e...C.:.\.W.i.n.d.o.w.s.\.L.o.g.s.\.N.e.t.S.e.t.u.p.\.s.e.r.v.i.c.e...0...e.t.l.........P.P..........?..................................................................8.B..?......19041.1.amd64fre.vb_release.191206-1406.....5.@..?.........gP.......U..l....NetSetupShim.pdb.b......7.@..?.......I.[.8+m.!N8$......NetSetupEngine.pdb......4.@..?.........>*.....Nr8..a....NetSetupApi.pdb.........4.@..?.........E_iC...F........NetSetupSvc.pdb.............................................................................................................................................................

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	432221
Entropy (8bit):	5.375173968701779
Encrypted:	false
SSDEEP:	1536:6qELG7gK+RaOOp3LCCpfmLgYI66xgFF9Sq8K6MAS2OMUHl6Gin327D22A26Kgau0:zTtbmkExhMJCIpErV
MD5:	D41A665AF3251F768403B17E63FCB76C
SHA1:	8E76132ECDC6066D39B949D826AB04FD45520321
SHA-256:	BA37A71B14CA29E95AF4C922C72F5E76104F14D8892F9EA20E4A4A26A74C3006
SHA-512:	EB4CF5BD8CB40EA983E5936D9C9FE83883280E972F46031E4411C1D4CF23191B7C8DF2D64E7B1CAB404CF319AF95CF06AB93E296B87B099E99FD8083D4DEEA65
Malicious:	false
Preview:	.To learn about increasing the verbosity of the NGen log files please see http://go.microsoft.com/fwlink/?linkid=210113..12/07/2019 14:54:22.458 [5488]: Command line: D:\wd\compilerTemp\BMT.200yuild.1bk\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe executeQueuedItems /nologo ..12/07/2019 14:54:22.473 [5488]: Executing command from offline queue: install "System.Runtime.WindowsRuntime.UI.Xaml, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=b77a5c561934e089, processorArchitecture=msil" /NoDependencies /queue:1..12/07/2019 14:54:22.490 [5488]: Executing command from offline queue: install "System.Web.ApplicationServices, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil" /NoDependencies /queue:3..12/07/2019 14:54:22.490 [5488]: Exclusion list entry found for System.Web.ApplicationServices, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil; it will not be installed..12/07/2019 14:54:22.490 [

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

C:\Windows\System32\DriverStore\Temp\{7fc39624-296a-4042-b309-10cc640cfd85}\SET98AE.tmp

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	7632
Entropy (8bit):	5.063558190257152
Encrypted:	false
SSDEEP:	192:wr8tW9yCTi3x4vlQd22bjR+iAUC7bMP+io3DcNSj6jvKFkPs7EQTXvt1Ld4Z:LWlGNdkkzo3DcNSj6jvKFkPs7EQTXvtk
MD5:	26009F092BA352C1A64322268B47E0E3
SHA1:	E1B2220CD8DCAEF6F7411A527705BD90A5922099
SHA-256:	150EF8EB07532146F833DC020C02238161043260B8A565C3CFCB2365BAD980D9
SHA-512:	C18111982CA233A7FC5D1E893F9BD8A3ED739756A47651E0638DEBB0704066AF6B25942C7961CDEEDF953A206EB159FE50E0E10055C40B68EB0D22F6064BB363
Malicious:	false
Preview:	; ***************************************************************************..; Copyright (C) 2002-2014 OpenVPN Technologies, Inc. ..; This program is free software; you can redistribute it and/or modify ..; it under the terms of the GNU General Public License version 2 ..; as published by the Free Software Foundation. ..; *************************************************************************....; SYNTAX CHECKER..; cd \WINDDK\3790\tools\chkinf..; chkinf c:\src\openvpn\tap-win32\i386\oemvista.inf..; OUTPUT -> file:///c:/WINDDK/3790/tools/chkinf/htm/c%23+src+openvpn+tap-win32+i386+__OemWin2k.htm....; INSTALL/REMOVE DRIVER..; tapinstall install OemVista.inf tapoas..; tapinstall update OemVista.inf tapoas..; tapinstall remove tapoas....;*******************************************************..; Note to Developers:..;..; If you are bundling the TAP-Windows driver with your app,..; you should try

C:\Windows\System32\DriverStore\Temp\{7fc39624-296a-4042-b309-10cc640cfd85}\SET98BE.tmp

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	data
Category:	dropped
Size (bytes):	10739
Entropy (8bit):	7.214364446291792
Encrypted:	false
SSDEEP:	192:JDVLGVDFfap5UEwQl/WGhYCt17vJ4qnaj6jQc:7GCpzlnh3t1x4l2jn
MD5:	F73AC62E8DF97FAF3FC8D83E7F71BF3F
SHA1:	619A6E8F7A9803A4C71F73060649903606BEAF4E
SHA-256:	CC74CDB88C198EB00AEF4CAA20BF1FDA9256917713A916E6B94435CD4DCB7F7B
SHA-512:	F81F5757E0E449AD66A632299BCBE268ED02DF61333A304DCCAFB76B2AD26BAF1A09E7F837762EE4780AFB47D90A09BF07CB5B8B519C6FB231B54FA4FBE17FFE
Malicious:	false
Preview:	0.)....H........).0.)....1.0...`.H.e......0..i..+.....7.....Z0..V0...+.....7.......r?.X.M.....F.A..201008141946Z0...+.....7.....0..T0.... .....S!F.3....#.a.2`..e...#e...1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0<..+.....7...1.0,...F.i.l.e........o.e.m.v.i.s.t.a...i.n.f...0U..+.....7...1G0E0...+.....7.......010...`.H.e....... .....S!F.3....#.a.2`..e...#e...0...."~..m..8C. i$.4.l..1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0:..+.....7...1,0...F.i.l.e........t.a.p.0.9.0.1...s.y.s...0.... ..j(.M<.cR..XrT....F..R.]....?1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0:..+.....7...1,0*...F.i.l.e........t.a.p.0.9.0.1...s.y.s...0]..+.....7...1O0M0...+.....7...0...........010...`.H.e....... ..j(.M<.cR..XrT....F..R.]....?0.....".....A.Rw..... .1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0<..+.....7...1.0,...F.i.l.e........o.e.m.v.i.s.t.a...i.n.f.......0...0....+.

C:\Windows\System32\DriverStore\Temp\{7fc39624-296a-4042-b309-10cc640cfd85}\SET98CF.tmp

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	39920
Entropy (8bit):	6.338128217115975
Encrypted:	false
SSDEEP:	768:XtCuL1O/+AphG3F9NlXt5oZhDzbV104mmuiExsFwQvYp33U35:XdCoTxk1lmmjExsFNvYtk
MD5:	C10CCDEC5D7AF458E726A51BB3CDC732
SHA1:	0553AAB8C2106ABB4120353360D747B0A2B4C94F
SHA-256:	589C5667B1602837205DA8EA8E92FE13F8C36048B293DF931C99B39641052253
SHA-512:	7437C12AE5B31E389DE3053A55996E7A0D30689C6E0D10BDE28F1FBF55CEE42E65AA441B7B82448334E725C0899384DEE2645CE5C311F3A3CFC68E42AD046981
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........~..[...[...[....w..Z....w..^...[...m....w.._....w..^.../t..Q.../t..Z.../t..Z...Rich[...........................PE..d......_.........."......Z.....................@....................................=w....`A....................................................<.......X....p..T....x...#...........R..8............................S...............P...............................text..._>.......@.................. ..h.rdata.......P.......D..............@..H.data........`.......P..............@....pdata..T....p.......R..............@..HPAGE.................V.............. ..`INIT.................d.............. ..b.rsrc...X............p..............@..B.reloc...............v..............@..B................................................................................................................................................................................

C:\Windows\System32\DriverStore\Temp\{7fc39624-296a-4042-b309-10cc640cfd85}\oemvista.inf (copy)

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	7632
Entropy (8bit):	5.063558190257152
Encrypted:	false
SSDEEP:	192:wr8tW9yCTi3x4vlQd22bjR+iAUC7bMP+io3DcNSj6jvKFkPs7EQTXvt1Ld4Z:LWlGNdkkzo3DcNSj6jvKFkPs7EQTXvtk
MD5:	26009F092BA352C1A64322268B47E0E3
SHA1:	E1B2220CD8DCAEF6F7411A527705BD90A5922099
SHA-256:	150EF8EB07532146F833DC020C02238161043260B8A565C3CFCB2365BAD980D9
SHA-512:	C18111982CA233A7FC5D1E893F9BD8A3ED739756A47651E0638DEBB0704066AF6B25942C7961CDEEDF953A206EB159FE50E0E10055C40B68EB0D22F6064BB363
Malicious:	false
Preview:	; ***************************************************************************..; Copyright (C) 2002-2014 OpenVPN Technologies, Inc. ..; This program is free software; you can redistribute it and/or modify ..; it under the terms of the GNU General Public License version 2 ..; as published by the Free Software Foundation. ..; *************************************************************************....; SYNTAX CHECKER..; cd \WINDDK\3790\tools\chkinf..; chkinf c:\src\openvpn\tap-win32\i386\oemvista.inf..; OUTPUT -> file:///c:/WINDDK/3790/tools/chkinf/htm/c%23+src+openvpn+tap-win32+i386+__OemWin2k.htm....; INSTALL/REMOVE DRIVER..; tapinstall install OemVista.inf tapoas..; tapinstall update OemVista.inf tapoas..; tapinstall remove tapoas....;*******************************************************..; Note to Developers:..;..; If you are bundling the TAP-Windows driver with your app,..; you should try

C:\Windows\System32\DriverStore\Temp\{7fc39624-296a-4042-b309-10cc640cfd85}\tap0901.cat (copy)

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	data
Category:	dropped
Size (bytes):	10739
Entropy (8bit):	7.214364446291792
Encrypted:	false
SSDEEP:	192:JDVLGVDFfap5UEwQl/WGhYCt17vJ4qnaj6jQc:7GCpzlnh3t1x4l2jn
MD5:	F73AC62E8DF97FAF3FC8D83E7F71BF3F
SHA1:	619A6E8F7A9803A4C71F73060649903606BEAF4E
SHA-256:	CC74CDB88C198EB00AEF4CAA20BF1FDA9256917713A916E6B94435CD4DCB7F7B
SHA-512:	F81F5757E0E449AD66A632299BCBE268ED02DF61333A304DCCAFB76B2AD26BAF1A09E7F837762EE4780AFB47D90A09BF07CB5B8B519C6FB231B54FA4FBE17FFE
Malicious:	false
Preview:	0.)....H........).0.)....1.0...`.H.e......0..i..+.....7.....Z0..V0...+.....7.......r?.X.M.....F.A..201008141946Z0...+.....7.....0..T0.... .....S!F.3....#.a.2`..e...#e...1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0<..+.....7...1.0,...F.i.l.e........o.e.m.v.i.s.t.a...i.n.f...0U..+.....7...1G0E0...+.....7.......010...`.H.e....... .....S!F.3....#.a.2`..e...#e...0...."~..m..8C. i$.4.l..1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0:..+.....7...1,0...F.i.l.e........t.a.p.0.9.0.1...s.y.s...0.... ..j(.M<.cR..XrT....F..R.]....?1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0:..+.....7...1,0*...F.i.l.e........t.a.p.0.9.0.1...s.y.s...0]..+.....7...1O0M0...+.....7...0...........010...`.H.e....... ..j(.M<.cR..XrT....F..R.]....?0.....".....A.Rw..... .1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0<..+.....7...1.0,...F.i.l.e........o.e.m.v.i.s.t.a...i.n.f.......0...0....+.

C:\Windows\System32\DriverStore\Temp\{7fc39624-296a-4042-b309-10cc640cfd85}\tap0901.sys (copy)

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	39920
Entropy (8bit):	6.338128217115975
Encrypted:	false
SSDEEP:	768:XtCuL1O/+AphG3F9NlXt5oZhDzbV104mmuiExsFwQvYp33U35:XdCoTxk1lmmjExsFNvYtk
MD5:	C10CCDEC5D7AF458E726A51BB3CDC732
SHA1:	0553AAB8C2106ABB4120353360D747B0A2B4C94F
SHA-256:	589C5667B1602837205DA8EA8E92FE13F8C36048B293DF931C99B39641052253
SHA-512:	7437C12AE5B31E389DE3053A55996E7A0D30689C6E0D10BDE28F1FBF55CEE42E65AA441B7B82448334E725C0899384DEE2645CE5C311F3A3CFC68E42AD046981
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........~..[...[...[....w..Z....w..^...[...m....w.._....w..^.../t..Q.../t..Z.../t..Z...Rich[...........................PE..d......_.........."......Z.....................@....................................=w....`A....................................................<.......X....p..T....x...#...........R..8............................S...............P...............................text..._>.......@.................. ..h.rdata.......P.......D..............@..H.data........`.......P..............@....pdata..T....p.......R..............@..HPAGE.................V.............. ..`INIT.................d.............. ..b.rsrc...X............p..............@..B.reloc...............v..............@..B................................................................................................................................................................................

C:\Windows\System32\catroot2\dberr.txt

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	4403
Entropy (8bit):	5.391110108510809
Encrypted:	false
SSDEEP:	96:QO00eO00erMwUgWUg0B1kE3ZhpJp8ZpkRepk3hpTpbCpEpDk+psNVpsLH:QO00eO00erMwmkB1kAIrN4D
MD5:	CE0ABE7CD3052AC0F2C561D4D61D3CEA
SHA1:	D4A06AE3E3FD6FB7BFB84EDF35D775B0E2706EC0
SHA-256:	F37D940EB3F78184DE72DC77B90D32699EA3CE4DC4E96571BE39DAE806B61F49
SHA-512:	E384894031B02CCBFB293E2E9D938C36B28A52D290045D83767FE1C8F114A34570A76B5797D0ECFC2A663BD32036697F384A68A38AF74E7D8587A1D164F0FE04
Malicious:	false
Preview:	CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #6041 encountered JET error -1409..CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #6699 encountered JET error -1409..CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #4398 encountered JET error -1409..CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #6041 encountered JET error -1409..CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #6699 encountered JET error -1409..CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #4398 encountered JET error -1409..CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #2083 encountered JET error -1409..CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #2459 encountered JET error -1409..CatalogDB: 08:57:12 03/10/2023: SyncAllDBs Corruption or Schema Change..CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #891 encountered JET error -1409..CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #1307 encountered JET error -1601..CatalogDB: 08:57:12 03/10/2023: SyncDB:: Sync sta

C:\Windows\System32\drivers\SET9E3C.tmp

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	39920
Entropy (8bit):	6.338128217115975
Encrypted:	false
SSDEEP:	768:XtCuL1O/+AphG3F9NlXt5oZhDzbV104mmuiExsFwQvYp33U35:XdCoTxk1lmmjExsFNvYtk
MD5:	C10CCDEC5D7AF458E726A51BB3CDC732
SHA1:	0553AAB8C2106ABB4120353360D747B0A2B4C94F
SHA-256:	589C5667B1602837205DA8EA8E92FE13F8C36048B293DF931C99B39641052253
SHA-512:	7437C12AE5B31E389DE3053A55996E7A0D30689C6E0D10BDE28F1FBF55CEE42E65AA441B7B82448334E725C0899384DEE2645CE5C311F3A3CFC68E42AD046981
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........~..[...[...[....w..Z....w..^...[...m....w.._....w..^.../t..Q.../t..Z.../t..Z...Rich[...........................PE..d......_.........."......Z.....................@....................................=w....`A....................................................<.......X....p..T....x...#...........R..8............................S...............P...............................text..._>.......@.................. ..h.rdata.......P.......D..............@..H.data........`.......P..............@....pdata..T....p.......R..............@..HPAGE.................V.............. ..`INIT.................d.............. ..b.rsrc...X............p..............@..B.reloc...............v..............@..B................................................................................................................................................................................

C:\Windows\System32\drivers\tap0901.sys (copy)

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	39920
Entropy (8bit):	6.338128217115975
Encrypted:	false
SSDEEP:	768:XtCuL1O/+AphG3F9NlXt5oZhDzbV104mmuiExsFwQvYp33U35:XdCoTxk1lmmjExsFNvYtk
MD5:	C10CCDEC5D7AF458E726A51BB3CDC732
SHA1:	0553AAB8C2106ABB4120353360D747B0A2B4C94F
SHA-256:	589C5667B1602837205DA8EA8E92FE13F8C36048B293DF931C99B39641052253
SHA-512:	7437C12AE5B31E389DE3053A55996E7A0D30689C6E0D10BDE28F1FBF55CEE42E65AA441B7B82448334E725C0899384DEE2645CE5C311F3A3CFC68E42AD046981
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........~..[...[...[....w..Z....w..^...[...m....w.._....w..^.../t..Q.../t..Z.../t..Z...Rich[...........................PE..d......_.........."......Z.....................@....................................=w....`A....................................................<.......X....p..T....x...#...........R..8............................S...............P...............................text..._>.......@.................. ..h.rdata.......P.......D..............@..H.data........`.......P..............@....pdata..T....p.......R..............@..HPAGE.................V.............. ..`INIT.................d.............. ..b.rsrc...X............p..............@..B.reloc...............v..............@..B................................................................................................................................................................................

C:\Windows\Temp\~DF17937B31B5A0524E.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF3BC5D24711BE1CFC.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.4743557719535751
Encrypted:	false
SSDEEP:	48:M8PhfuRc06WXJanT5iX+Zd0Skd+AECToGd0SkdET:jhf1RnTC+Y30
MD5:	12444C24C476A8F6965EBCF4A203A2E5
SHA1:	DB9A72CF11133FF4730A63097F43A01245A92F10
SHA-256:	E173E7F850628A416452F71D87926B1D87F6FFA0F1602D5CEC2E3F6DA177595E
SHA-512:	25723AA168FDD458D6FA83DC276D5E0C5371BF261E706FC0813568B5BC63A912370307279EF5173CB9BF1E6F94961E7D786D30A4C9BA2AF8A35646E9DE4CBB9A
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF40B62EEBA8B9ABB7.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF45ECC1F3834B303A.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.07062569763786998
Encrypted:	false
SSDEEP:	6:2/9LG7iVCnLG7iVrKOzPLHKOm1JLhURAJtiVky6l7:2F0i8n0itFzDHFmv97b7
MD5:	0B8A42DC3676EB152818E1AFD93446AA
SHA1:	DF4AE7A5AD4DC1F05BA767BA4D6BF9D5328DA7CF
SHA-256:	B8EE2255CCD38944476FA0E48BFEC21076A877C066210E0346FE844739756660
SHA-512:	BD1038F6CA89FA570051159EC0C173F18C78A1AA2BA3DAD72062726C9909A93F8BF10AD45599E22B8D274FF0DFDB96C9B3536703AB31FDD4FF73A74FF3BDCA4E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF76C1447C2DDEB1A0.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	73728
Entropy (8bit):	0.10239111529161787
Encrypted:	false
SSDEEP:	24:2iTx+d0ipV+dm+d0ipV+d+AEVkTV2BwGquL+IJP:zT4d0SkdJd0Skd+AECToZLD
MD5:	0F7F0F9D372F0C07D74150506BDD32FE
SHA1:	7766141A64AB73D266BA49024CECBE788B1F1676
SHA-256:	9349DF57667579922FC9CBFC48B80DB8AD9F462832D4C43287F1BC110D23AAC7
SHA-512:	957291D0BFC3F8AF2F46F07C93E81BD6D1473D36D689EF90D9A578571B0AE68330280805528C15BD6FBEFEFCCE83A24342713FE57FD25663AD5F1DA4479814D0
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF7A22E7A3DC4B5BBC.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF91A7B325E5A23495.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.1876100247249464
Encrypted:	false
SSDEEP:	48:zwsHuZM+CFXJpT5rX+Zd0Skd+AECToGd0SkdET:zVHXRT1+Y30
MD5:	0B764079495FC8E8154812C20AB68244
SHA1:	ABB9ADA1035E7283F9584A363126A1CCEFB0CD31
SHA-256:	83BADFB4FF7194FBF92632A805FB787E2413023AFB4405D605FCB360E0765AA4
SHA-512:	CFB8691B9EB0868239DF2F12F58C47C471F74953BF746DED75D39C8628A3D2046C9B5AE6F2C051BACB1639BDA7686AC0213D0CD4E58204BE6EB25E49E4F3B71F
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFD38A73A490CFD1AE.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.1876100247249464
Encrypted:	false
SSDEEP:	48:zwsHuZM+CFXJpT5rX+Zd0Skd+AECToGd0SkdET:zVHXRT1+Y30
MD5:	0B764079495FC8E8154812C20AB68244
SHA1:	ABB9ADA1035E7283F9584A363126A1CCEFB0CD31
SHA-256:	83BADFB4FF7194FBF92632A805FB787E2413023AFB4405D605FCB360E0765AA4
SHA-512:	CFB8691B9EB0868239DF2F12F58C47C471F74953BF746DED75D39C8628A3D2046C9B5AE6F2C051BACB1639BDA7686AC0213D0CD4E58204BE6EB25E49E4F3B71F
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFE5C8E9D5DEF9D48A.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFE80AD5AC9720AFC0.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFEE4AADABDA518FEA.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.4743557719535751
Encrypted:	false
SSDEEP:	48:M8PhfuRc06WXJanT5iX+Zd0Skd+AECToGd0SkdET:jhf1RnTC+Y30
MD5:	12444C24C476A8F6965EBCF4A203A2E5
SHA1:	DB9A72CF11133FF4730A63097F43A01245A92F10
SHA-256:	E173E7F850628A416452F71D87926B1D87F6FFA0F1602D5CEC2E3F6DA177595E
SHA-512:	25723AA168FDD458D6FA83DC276D5E0C5371BF261E706FC0813568B5BC63A912370307279EF5173CB9BF1E6F94961E7D786D30A4C9BA2AF8A35646E9DE4CBB9A
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFFCD868162EDB3EBF.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.1876100247249464
Encrypted:	false
SSDEEP:	48:zwsHuZM+CFXJpT5rX+Zd0Skd+AECToGd0SkdET:zVHXRT1+Y30
MD5:	0B764079495FC8E8154812C20AB68244
SHA1:	ABB9ADA1035E7283F9584A363126A1CCEFB0CD31
SHA-256:	83BADFB4FF7194FBF92632A805FB787E2413023AFB4405D605FCB360E0765AA4
SHA-512:	CFB8691B9EB0868239DF2F12F58C47C471F74953BF746DED75D39C8628A3D2046C9B5AE6F2C051BACB1639BDA7686AC0213D0CD4E58204BE6EB25E49E4F3B71F
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Security: 0, Code page: 936, Revision Number: {D5081896-4C2D-4C53-BFE1-6025F1920CD2}, Number of Words: 2, Subject: 1etsvpn, Author: 1etsvpn, Name of Creating Application: 1etsvpn, Template: ;2052, Comments: Installer 1etsvpn , Title: Installation Database, Keywords: Installer, MSI, Database, Create Time/Date: Thu Jul 18 07:56:44 2024, Last Saved Time/Date: Thu Jul 18 07:56:44 2024, Last Printed: Thu Jul 18 07:56:44 2024, Number of Pages: 450
Entropy (8bit):	7.992676731270942
TrID:	Windows SDK Setup Transform Script (63028/2) 47.91% Microsoft Windows Installer (60509/1) 46.00% Generic OLE2 / Multistream Compound File (8008/1) 6.09%
File name:	lets-test.msi
File size:	52'425'728 bytes
MD5:	b0428243a495bc1691d4c4f33b54e0eb
SHA1:	e7b0c8d355fc3cc1158b96b3a0e3420fac2b3f06
SHA256:	5683928d134cc328a0ae1460fb0c58ddf97d5bc854758c97a5c4d3c1869b842d
SHA512:	2e61c7d1e97b8e878b6ed492230ba89dd803410086959cf9cab71bb407eeb9f3b66bbdb9b48f2344be6a7f1f6bddffaeb60a190c335df9e53faab7bd7b086b29
SSDEEP:	786432:4xAq3kvG6v0/mooApRkpeGUIhkdoOcATOGqltpIXfiOlMVVqSqGVEA+c:hqUvL8/mQrk0RolAKZi1lyVqwEA+c
TLSH:	CEB73332388AC435E25F2A752A3B6B2E463D7D31076440DBE3D4BE3659B6AC35130B97
File Content Preview:	........................>................... ...................................=...>...?...@...A...B...C...D...E...............H...I...J...K...L...M..........................................................................................................

File Icon


Icon Hash:	2d2e3797b32b2b99

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 18, 2024 22:57:14.375804901 CEST	49737	443	192.168.2.4	142.250.186.129
Jul 18, 2024 22:57:14.375843048 CEST	443	49737	142.250.186.129	192.168.2.4
Jul 18, 2024 22:57:14.375893116 CEST	49737	443	192.168.2.4	142.250.186.129
Jul 18, 2024 22:57:14.376102924 CEST	49737	443	192.168.2.4	142.250.186.129
Jul 18, 2024 22:57:14.376115084 CEST	443	49737	142.250.186.129	192.168.2.4
Jul 18, 2024 22:57:15.120768070 CEST	443	49737	142.250.186.129	192.168.2.4
Jul 18, 2024 22:57:15.121033907 CEST	49737	443	192.168.2.4	142.250.186.129
Jul 18, 2024 22:57:15.121052980 CEST	443	49737	142.250.186.129	192.168.2.4
Jul 18, 2024 22:57:15.121584892 CEST	443	49737	142.250.186.129	192.168.2.4
Jul 18, 2024 22:57:15.121608019 CEST	443	49737	142.250.186.129	192.168.2.4
Jul 18, 2024 22:57:15.121648073 CEST	49737	443	192.168.2.4	142.250.186.129
Jul 18, 2024 22:57:15.121654987 CEST	443	49737	142.250.186.129	192.168.2.4
Jul 18, 2024 22:57:15.121686935 CEST	49737	443	192.168.2.4	142.250.186.129
Jul 18, 2024 22:57:15.121706963 CEST	49737	443	192.168.2.4	142.250.186.129
Jul 18, 2024 22:57:15.122353077 CEST	443	49737	142.250.186.129	192.168.2.4
Jul 18, 2024 22:57:15.123714924 CEST	49737	443	192.168.2.4	142.250.186.129
Jul 18, 2024 22:57:15.123784065 CEST	443	49737	142.250.186.129	192.168.2.4
Jul 18, 2024 22:57:15.123959064 CEST	49737	443	192.168.2.4	142.250.186.129
Jul 18, 2024 22:57:15.123966932 CEST	443	49737	142.250.186.129	192.168.2.4
Jul 18, 2024 22:57:15.139812946 CEST	49740	80	192.168.2.4	103.7.30.83
Jul 18, 2024 22:57:15.144618988 CEST	80	49740	103.7.30.83	192.168.2.4
Jul 18, 2024 22:57:15.144752979 CEST	49740	80	192.168.2.4	103.7.30.83
Jul 18, 2024 22:57:15.248580933 CEST	49737	443	192.168.2.4	142.250.186.129
Jul 18, 2024 22:57:15.250777960 CEST	49740	80	192.168.2.4	103.7.30.83
Jul 18, 2024 22:57:15.250866890 CEST	49740	80	192.168.2.4	103.7.30.83
Jul 18, 2024 22:57:15.256145954 CEST	80	49740	103.7.30.83	192.168.2.4
Jul 18, 2024 22:57:15.256256104 CEST	80	49740	103.7.30.83	192.168.2.4
Jul 18, 2024 22:57:15.382152081 CEST	443	49737	142.250.186.129	192.168.2.4
Jul 18, 2024 22:57:15.382189035 CEST	443	49737	142.250.186.129	192.168.2.4
Jul 18, 2024 22:57:15.382256985 CEST	49737	443	192.168.2.4	142.250.186.129
Jul 18, 2024 22:57:15.382273912 CEST	443	49737	142.250.186.129	192.168.2.4
Jul 18, 2024 22:57:15.385359049 CEST	443	49737	142.250.186.129	192.168.2.4
Jul 18, 2024 22:57:15.385438919 CEST	49737	443	192.168.2.4	142.250.186.129
Jul 18, 2024 22:57:15.385447979 CEST	443	49737	142.250.186.129	192.168.2.4
Jul 18, 2024 22:57:15.391836882 CEST	443	49737	142.250.186.129	192.168.2.4
Jul 18, 2024 22:57:15.391942024 CEST	49737	443	192.168.2.4	142.250.186.129
Jul 18, 2024 22:57:15.391951084 CEST	443	49737	142.250.186.129	192.168.2.4
Jul 18, 2024 22:57:15.398272991 CEST	443	49737	142.250.186.129	192.168.2.4
Jul 18, 2024 22:57:15.398325920 CEST	49737	443	192.168.2.4	142.250.186.129
Jul 18, 2024 22:57:15.398334026 CEST	443	49737	142.250.186.129	192.168.2.4
Jul 18, 2024 22:57:15.404776096 CEST	443	49737	142.250.186.129	192.168.2.4
Jul 18, 2024 22:57:15.404839993 CEST	49737	443	192.168.2.4	142.250.186.129
Jul 18, 2024 22:57:15.404848099 CEST	443	49737	142.250.186.129	192.168.2.4
Jul 18, 2024 22:57:15.411266088 CEST	443	49737	142.250.186.129	192.168.2.4
Jul 18, 2024 22:57:15.411329985 CEST	49737	443	192.168.2.4	142.250.186.129
Jul 18, 2024 22:57:15.411338091 CEST	443	49737	142.250.186.129	192.168.2.4
Jul 18, 2024 22:57:15.417778015 CEST	443	49737	142.250.186.129	192.168.2.4
Jul 18, 2024 22:57:15.417850971 CEST	49737	443	192.168.2.4	142.250.186.129
Jul 18, 2024 22:57:15.417859077 CEST	443	49737	142.250.186.129	192.168.2.4
Jul 18, 2024 22:57:15.424449921 CEST	443	49737	142.250.186.129	192.168.2.4
Jul 18, 2024 22:57:15.424505949 CEST	49737	443	192.168.2.4	142.250.186.129
Jul 18, 2024 22:57:15.424514055 CEST	443	49737	142.250.186.129	192.168.2.4
Jul 18, 2024 22:57:15.470822096 CEST	443	49737	142.250.186.129	192.168.2.4
Jul 18, 2024 22:57:15.470892906 CEST	49737	443	192.168.2.4	142.250.186.129
Jul 18, 2024 22:57:15.470909119 CEST	443	49737	142.250.186.129	192.168.2.4
Jul 18, 2024 22:57:15.471657991 CEST	443	49737	142.250.186.129	192.168.2.4
Jul 18, 2024 22:57:15.471714020 CEST	49737	443	192.168.2.4	142.250.186.129
Jul 18, 2024 22:57:15.471728086 CEST	443	49737	142.250.186.129	192.168.2.4
Jul 18, 2024 22:57:15.478231907 CEST	443	49737	142.250.186.129	192.168.2.4
Jul 18, 2024 22:57:15.478286982 CEST	49737	443	192.168.2.4	142.250.186.129
Jul 18, 2024 22:57:15.478295088 CEST	443	49737	142.250.186.129	192.168.2.4
Jul 18, 2024 22:57:15.484788895 CEST	443	49737	142.250.186.129	192.168.2.4
Jul 18, 2024 22:57:15.484844923 CEST	49737	443	192.168.2.4	142.250.186.129
Jul 18, 2024 22:57:15.484853983 CEST	443	49737	142.250.186.129	192.168.2.4
Jul 18, 2024 22:57:15.491625071 CEST	443	49737	142.250.186.129	192.168.2.4
Jul 18, 2024 22:57:15.491692066 CEST	49737	443	192.168.2.4	142.250.186.129
Jul 18, 2024 22:57:15.491703987 CEST	443	49737	142.250.186.129	192.168.2.4
Jul 18, 2024 22:57:15.497777939 CEST	443	49737	142.250.186.129	192.168.2.4
Jul 18, 2024 22:57:15.497848034 CEST	49737	443	192.168.2.4	142.250.186.129
Jul 18, 2024 22:57:15.497858047 CEST	443	49737	142.250.186.129	192.168.2.4
Jul 18, 2024 22:57:15.504146099 CEST	443	49737	142.250.186.129	192.168.2.4
Jul 18, 2024 22:57:15.504198074 CEST	49737	443	192.168.2.4	142.250.186.129
Jul 18, 2024 22:57:15.504206896 CEST	443	49737	142.250.186.129	192.168.2.4
Jul 18, 2024 22:57:15.510621071 CEST	443	49737	142.250.186.129	192.168.2.4
Jul 18, 2024 22:57:15.510684013 CEST	49737	443	192.168.2.4	142.250.186.129
Jul 18, 2024 22:57:15.510694981 CEST	443	49737	142.250.186.129	192.168.2.4
Jul 18, 2024 22:57:15.517141104 CEST	443	49737	142.250.186.129	192.168.2.4
Jul 18, 2024 22:57:15.517195940 CEST	49737	443	192.168.2.4	142.250.186.129
Jul 18, 2024 22:57:15.517206907 CEST	443	49737	142.250.186.129	192.168.2.4
Jul 18, 2024 22:57:15.523658991 CEST	443	49737	142.250.186.129	192.168.2.4
Jul 18, 2024 22:57:15.523716927 CEST	49737	443	192.168.2.4	142.250.186.129
Jul 18, 2024 22:57:15.523725986 CEST	443	49737	142.250.186.129	192.168.2.4
Jul 18, 2024 22:57:15.529381990 CEST	443	49737	142.250.186.129	192.168.2.4
Jul 18, 2024 22:57:15.529484987 CEST	49737	443	192.168.2.4	142.250.186.129
Jul 18, 2024 22:57:15.529494047 CEST	443	49737	142.250.186.129	192.168.2.4
Jul 18, 2024 22:57:15.530070066 CEST	49741	443	192.168.2.4	13.107.246.60
Jul 18, 2024 22:57:15.530136108 CEST	443	49741	13.107.246.60	192.168.2.4
Jul 18, 2024 22:57:15.530281067 CEST	49741	443	192.168.2.4	13.107.246.60
Jul 18, 2024 22:57:15.530585051 CEST	49741	443	192.168.2.4	13.107.246.60
Jul 18, 2024 22:57:15.530602932 CEST	443	49741	13.107.246.60	192.168.2.4
Jul 18, 2024 22:57:15.534799099 CEST	443	49737	142.250.186.129	192.168.2.4
Jul 18, 2024 22:57:15.534866095 CEST	49737	443	192.168.2.4	142.250.186.129
Jul 18, 2024 22:57:15.534874916 CEST	443	49737	142.250.186.129	192.168.2.4
Jul 18, 2024 22:57:15.540610075 CEST	443	49737	142.250.186.129	192.168.2.4
Jul 18, 2024 22:57:15.540664911 CEST	49737	443	192.168.2.4	142.250.186.129
Jul 18, 2024 22:57:15.540673971 CEST	443	49737	142.250.186.129	192.168.2.4
Jul 18, 2024 22:57:15.545835972 CEST	443	49737	142.250.186.129	192.168.2.4
Jul 18, 2024 22:57:15.545893908 CEST	49737	443	192.168.2.4	142.250.186.129
Jul 18, 2024 22:57:15.545901060 CEST	443	49737	142.250.186.129	192.168.2.4
Jul 18, 2024 22:57:15.551152945 CEST	443	49737	142.250.186.129	192.168.2.4
Jul 18, 2024 22:57:15.551203966 CEST	49737	443	192.168.2.4	142.250.186.129
Jul 18, 2024 22:57:15.551212072 CEST	443	49737	142.250.186.129	192.168.2.4
Jul 18, 2024 22:57:15.556845903 CEST	443	49737	142.250.186.129	192.168.2.4
Jul 18, 2024 22:57:15.556902885 CEST	49737	443	192.168.2.4	142.250.186.129
Jul 18, 2024 22:57:15.556915045 CEST	443	49737	142.250.186.129	192.168.2.4
Jul 18, 2024 22:57:15.560832977 CEST	443	49737	142.250.186.129	192.168.2.4
Jul 18, 2024 22:57:15.560884953 CEST	49737	443	192.168.2.4	142.250.186.129
Jul 18, 2024 22:57:15.560894012 CEST	443	49737	142.250.186.129	192.168.2.4
Jul 18, 2024 22:57:15.564414978 CEST	443	49737	142.250.186.129	192.168.2.4
Jul 18, 2024 22:57:15.564467907 CEST	49737	443	192.168.2.4	142.250.186.129
Jul 18, 2024 22:57:15.564476013 CEST	443	49737	142.250.186.129	192.168.2.4
Jul 18, 2024 22:57:15.568188906 CEST	443	49737	142.250.186.129	192.168.2.4
Jul 18, 2024 22:57:15.568242073 CEST	49737	443	192.168.2.4	142.250.186.129
Jul 18, 2024 22:57:15.568249941 CEST	443	49737	142.250.186.129	192.168.2.4
Jul 18, 2024 22:57:15.571999073 CEST	443	49737	142.250.186.129	192.168.2.4
Jul 18, 2024 22:57:15.572086096 CEST	49737	443	192.168.2.4	142.250.186.129
Jul 18, 2024 22:57:15.572094917 CEST	443	49737	142.250.186.129	192.168.2.4
Jul 18, 2024 22:57:15.575341940 CEST	443	49737	142.250.186.129	192.168.2.4
Jul 18, 2024 22:57:15.575412989 CEST	49737	443	192.168.2.4	142.250.186.129
Jul 18, 2024 22:57:15.575422049 CEST	443	49737	142.250.186.129	192.168.2.4
Jul 18, 2024 22:57:15.578823090 CEST	443	49737	142.250.186.129	192.168.2.4
Jul 18, 2024 22:57:15.578881025 CEST	49737	443	192.168.2.4	142.250.186.129
Jul 18, 2024 22:57:15.578890085 CEST	443	49737	142.250.186.129	192.168.2.4
Jul 18, 2024 22:57:15.582257032 CEST	443	49737	142.250.186.129	192.168.2.4
Jul 18, 2024 22:57:15.582304001 CEST	49737	443	192.168.2.4	142.250.186.129
Jul 18, 2024 22:57:15.582313061 CEST	443	49737	142.250.186.129	192.168.2.4
Jul 18, 2024 22:57:15.585829020 CEST	443	49737	142.250.186.129	192.168.2.4
Jul 18, 2024 22:57:15.585892916 CEST	49737	443	192.168.2.4	142.250.186.129
Jul 18, 2024 22:57:15.585901976 CEST	443	49737	142.250.186.129	192.168.2.4
Jul 18, 2024 22:57:15.589340925 CEST	443	49737	142.250.186.129	192.168.2.4
Jul 18, 2024 22:57:15.589395046 CEST	49737	443	192.168.2.4	142.250.186.129
Jul 18, 2024 22:57:15.589401960 CEST	443	49737	142.250.186.129	192.168.2.4
Jul 18, 2024 22:57:15.592765093 CEST	443	49737	142.250.186.129	192.168.2.4
Jul 18, 2024 22:57:15.592953920 CEST	49737	443	192.168.2.4	142.250.186.129
Jul 18, 2024 22:57:15.592967987 CEST	443	49737	142.250.186.129	192.168.2.4
Jul 18, 2024 22:57:15.596254110 CEST	443	49737	142.250.186.129	192.168.2.4
Jul 18, 2024 22:57:15.596364021 CEST	49737	443	192.168.2.4	142.250.186.129
Jul 18, 2024 22:57:15.596373081 CEST	443	49737	142.250.186.129	192.168.2.4
Jul 18, 2024 22:57:15.599909067 CEST	443	49737	142.250.186.129	192.168.2.4
Jul 18, 2024 22:57:15.599963903 CEST	49737	443	192.168.2.4	142.250.186.129
Jul 18, 2024 22:57:15.599982977 CEST	443	49737	142.250.186.129	192.168.2.4
Jul 18, 2024 22:57:15.603435993 CEST	443	49737	142.250.186.129	192.168.2.4
Jul 18, 2024 22:57:15.603494883 CEST	49737	443	192.168.2.4	142.250.186.129
Jul 18, 2024 22:57:15.603517056 CEST	443	49737	142.250.186.129	192.168.2.4
Jul 18, 2024 22:57:15.606750965 CEST	443	49737	142.250.186.129	192.168.2.4
Jul 18, 2024 22:57:15.606812000 CEST	49737	443	192.168.2.4	142.250.186.129
Jul 18, 2024 22:57:15.606825113 CEST	443	49737	142.250.186.129	192.168.2.4
Jul 18, 2024 22:57:15.610655069 CEST	443	49737	142.250.186.129	192.168.2.4
Jul 18, 2024 22:57:15.610699892 CEST	49737	443	192.168.2.4	142.250.186.129
Jul 18, 2024 22:57:15.610709906 CEST	443	49737	142.250.186.129	192.168.2.4
Jul 18, 2024 22:57:15.610816002 CEST	49737	443	192.168.2.4	142.250.186.129
Jul 18, 2024 22:57:15.610833883 CEST	443	49737	142.250.186.129	192.168.2.4
Jul 18, 2024 22:57:15.610877037 CEST	49737	443	192.168.2.4	142.250.186.129
Jul 18, 2024 22:57:16.209867954 CEST	443	49741	13.107.246.60	192.168.2.4
Jul 18, 2024 22:57:16.222067118 CEST	49741	443	192.168.2.4	13.107.246.60
Jul 18, 2024 22:57:16.222115040 CEST	443	49741	13.107.246.60	192.168.2.4
Jul 18, 2024 22:57:16.223332882 CEST	443	49741	13.107.246.60	192.168.2.4
Jul 18, 2024 22:57:16.223416090 CEST	49741	443	192.168.2.4	13.107.246.60
Jul 18, 2024 22:57:16.251559973 CEST	49741	443	192.168.2.4	13.107.246.60
Jul 18, 2024 22:57:16.251801014 CEST	443	49741	13.107.246.60	192.168.2.4
Jul 18, 2024 22:57:16.251890898 CEST	49741	443	192.168.2.4	13.107.246.60
Jul 18, 2024 22:57:16.251902103 CEST	443	49741	13.107.246.60	192.168.2.4
Jul 18, 2024 22:57:16.313937902 CEST	49741	443	192.168.2.4	13.107.246.60
Jul 18, 2024 22:57:16.648653984 CEST	443	49741	13.107.246.60	192.168.2.4
Jul 18, 2024 22:57:16.648674965 CEST	443	49741	13.107.246.60	192.168.2.4
Jul 18, 2024 22:57:16.648682117 CEST	443	49741	13.107.246.60	192.168.2.4
Jul 18, 2024 22:57:16.648750067 CEST	49741	443	192.168.2.4	13.107.246.60
Jul 18, 2024 22:57:16.648753881 CEST	443	49741	13.107.246.60	192.168.2.4
Jul 18, 2024 22:57:16.648807049 CEST	443	49741	13.107.246.60	192.168.2.4
Jul 18, 2024 22:57:16.648843050 CEST	443	49741	13.107.246.60	192.168.2.4
Jul 18, 2024 22:57:16.648852110 CEST	443	49741	13.107.246.60	192.168.2.4
Jul 18, 2024 22:57:16.648860931 CEST	49741	443	192.168.2.4	13.107.246.60
Jul 18, 2024 22:57:16.648888111 CEST	49741	443	192.168.2.4	13.107.246.60
Jul 18, 2024 22:57:16.648895979 CEST	443	49741	13.107.246.60	192.168.2.4
Jul 18, 2024 22:57:16.648953915 CEST	443	49741	13.107.246.60	192.168.2.4
Jul 18, 2024 22:57:16.649008989 CEST	49741	443	192.168.2.4	13.107.246.60
Jul 18, 2024 22:57:16.651509047 CEST	49741	443	192.168.2.4	13.107.246.60
Jul 18, 2024 22:57:16.651523113 CEST	443	49741	13.107.246.60	192.168.2.4
Jul 18, 2024 22:57:16.651532888 CEST	49741	443	192.168.2.4	13.107.246.60
Jul 18, 2024 22:57:16.651582003 CEST	49741	443	192.168.2.4	13.107.246.60
Jul 18, 2024 22:57:16.851126909 CEST	49744	443	192.168.2.4	162.159.61.3
Jul 18, 2024 22:57:16.851166964 CEST	443	49744	162.159.61.3	192.168.2.4
Jul 18, 2024 22:57:16.851815939 CEST	49744	443	192.168.2.4	162.159.61.3
Jul 18, 2024 22:57:16.852061033 CEST	49744	443	192.168.2.4	162.159.61.3
Jul 18, 2024 22:57:16.852077007 CEST	443	49744	162.159.61.3	192.168.2.4
Jul 18, 2024 22:57:16.852226973 CEST	49745	443	192.168.2.4	162.159.61.3
Jul 18, 2024 22:57:16.852267027 CEST	443	49745	162.159.61.3	192.168.2.4
Jul 18, 2024 22:57:16.852325916 CEST	49745	443	192.168.2.4	162.159.61.3
Jul 18, 2024 22:57:16.852566004 CEST	49745	443	192.168.2.4	162.159.61.3
Jul 18, 2024 22:57:16.852576017 CEST	443	49745	162.159.61.3	192.168.2.4
Jul 18, 2024 22:57:16.908824921 CEST	49746	443	192.168.2.4	172.64.41.3
Jul 18, 2024 22:57:16.908847094 CEST	443	49746	172.64.41.3	192.168.2.4
Jul 18, 2024 22:57:16.908989906 CEST	49746	443	192.168.2.4	172.64.41.3
Jul 18, 2024 22:57:16.909507990 CEST	49746	443	192.168.2.4	172.64.41.3
Jul 18, 2024 22:57:16.909518957 CEST	443	49746	172.64.41.3	192.168.2.4
Jul 18, 2024 22:57:17.351669073 CEST	443	49744	162.159.61.3	192.168.2.4
Jul 18, 2024 22:57:17.352616072 CEST	49744	443	192.168.2.4	162.159.61.3
Jul 18, 2024 22:57:17.352632999 CEST	443	49744	162.159.61.3	192.168.2.4
Jul 18, 2024 22:57:17.354244947 CEST	443	49744	162.159.61.3	192.168.2.4
Jul 18, 2024 22:57:17.354403973 CEST	49744	443	192.168.2.4	162.159.61.3
Jul 18, 2024 22:57:17.354945898 CEST	443	49745	162.159.61.3	192.168.2.4
Jul 18, 2024 22:57:17.355540991 CEST	49745	443	192.168.2.4	162.159.61.3
Jul 18, 2024 22:57:17.355571032 CEST	443	49745	162.159.61.3	192.168.2.4
Jul 18, 2024 22:57:17.357223988 CEST	443	49745	162.159.61.3	192.168.2.4
Jul 18, 2024 22:57:17.357286930 CEST	49745	443	192.168.2.4	162.159.61.3
Jul 18, 2024 22:57:17.361115932 CEST	49744	443	192.168.2.4	162.159.61.3
Jul 18, 2024 22:57:17.361202955 CEST	443	49744	162.159.61.3	192.168.2.4
Jul 18, 2024 22:57:17.361331940 CEST	49744	443	192.168.2.4	162.159.61.3
Jul 18, 2024 22:57:17.361341000 CEST	443	49744	162.159.61.3	192.168.2.4
Jul 18, 2024 22:57:17.361582041 CEST	49745	443	192.168.2.4	162.159.61.3
Jul 18, 2024 22:57:17.361665964 CEST	443	49745	162.159.61.3	192.168.2.4
Jul 18, 2024 22:57:17.361871958 CEST	49745	443	192.168.2.4	162.159.61.3
Jul 18, 2024 22:57:17.361877918 CEST	443	49745	162.159.61.3	192.168.2.4
Jul 18, 2024 22:57:17.403917074 CEST	443	49746	172.64.41.3	192.168.2.4
Jul 18, 2024 22:57:17.404864073 CEST	49744	443	192.168.2.4	162.159.61.3
Jul 18, 2024 22:57:17.405061960 CEST	49745	443	192.168.2.4	162.159.61.3
Jul 18, 2024 22:57:17.406039000 CEST	49746	443	192.168.2.4	172.64.41.3
Jul 18, 2024 22:57:17.406052113 CEST	443	49746	172.64.41.3	192.168.2.4
Jul 18, 2024 22:57:17.406915903 CEST	443	49746	172.64.41.3	192.168.2.4
Jul 18, 2024 22:57:17.407028913 CEST	49746	443	192.168.2.4	172.64.41.3
Jul 18, 2024 22:57:17.409292936 CEST	49746	443	192.168.2.4	172.64.41.3
Jul 18, 2024 22:57:17.409344912 CEST	443	49746	172.64.41.3	192.168.2.4
Jul 18, 2024 22:57:17.409487963 CEST	49746	443	192.168.2.4	172.64.41.3
Jul 18, 2024 22:57:17.409504890 CEST	443	49746	172.64.41.3	192.168.2.4
Jul 18, 2024 22:57:17.451819897 CEST	49746	443	192.168.2.4	172.64.41.3
Jul 18, 2024 22:57:17.472577095 CEST	443	49745	162.159.61.3	192.168.2.4
Jul 18, 2024 22:57:17.472757101 CEST	443	49745	162.159.61.3	192.168.2.4
Jul 18, 2024 22:57:17.472811937 CEST	49745	443	192.168.2.4	162.159.61.3
Jul 18, 2024 22:57:17.473243952 CEST	49745	443	192.168.2.4	162.159.61.3
Jul 18, 2024 22:57:17.473256111 CEST	443	49745	162.159.61.3	192.168.2.4
Jul 18, 2024 22:57:17.489737034 CEST	443	49744	162.159.61.3	192.168.2.4
Jul 18, 2024 22:57:17.489800930 CEST	443	49744	162.159.61.3	192.168.2.4
Jul 18, 2024 22:57:17.490252972 CEST	49744	443	192.168.2.4	162.159.61.3
Jul 18, 2024 22:57:17.490328074 CEST	49744	443	192.168.2.4	162.159.61.3
Jul 18, 2024 22:57:17.490348101 CEST	443	49744	162.159.61.3	192.168.2.4
Jul 18, 2024 22:57:17.755907059 CEST	49748	443	192.168.2.4	172.64.41.3
Jul 18, 2024 22:57:17.755956888 CEST	443	49748	172.64.41.3	192.168.2.4
Jul 18, 2024 22:57:17.756033897 CEST	49748	443	192.168.2.4	172.64.41.3
Jul 18, 2024 22:57:17.756784916 CEST	49748	443	192.168.2.4	172.64.41.3
Jul 18, 2024 22:57:17.756800890 CEST	443	49748	172.64.41.3	192.168.2.4
Jul 18, 2024 22:57:17.882496119 CEST	443	49746	172.64.41.3	192.168.2.4
Jul 18, 2024 22:57:17.882560015 CEST	443	49746	172.64.41.3	192.168.2.4
Jul 18, 2024 22:57:17.882632017 CEST	49746	443	192.168.2.4	172.64.41.3
Jul 18, 2024 22:57:17.883378029 CEST	49746	443	192.168.2.4	172.64.41.3
Jul 18, 2024 22:57:17.883403063 CEST	443	49746	172.64.41.3	192.168.2.4
Jul 18, 2024 22:57:18.382160902 CEST	443	49748	172.64.41.3	192.168.2.4
Jul 18, 2024 22:57:18.382819891 CEST	49748	443	192.168.2.4	172.64.41.3
Jul 18, 2024 22:57:18.382841110 CEST	443	49748	172.64.41.3	192.168.2.4
Jul 18, 2024 22:57:18.383310080 CEST	443	49748	172.64.41.3	192.168.2.4
Jul 18, 2024 22:57:18.387281895 CEST	49748	443	192.168.2.4	172.64.41.3
Jul 18, 2024 22:57:18.387301922 CEST	49748	443	192.168.2.4	172.64.41.3
Jul 18, 2024 22:57:18.387371063 CEST	443	49748	172.64.41.3	192.168.2.4
Jul 18, 2024 22:57:18.434879065 CEST	49748	443	192.168.2.4	172.64.41.3
Jul 18, 2024 22:57:18.522444963 CEST	443	49748	172.64.41.3	192.168.2.4
Jul 18, 2024 22:57:18.522524118 CEST	443	49748	172.64.41.3	192.168.2.4
Jul 18, 2024 22:57:18.522666931 CEST	49748	443	192.168.2.4	172.64.41.3
Jul 18, 2024 22:57:18.527189970 CEST	49748	443	192.168.2.4	172.64.41.3
Jul 18, 2024 22:57:18.527215958 CEST	443	49748	172.64.41.3	192.168.2.4
Jul 18, 2024 22:57:18.962564945 CEST	49749	443	192.168.2.4	162.159.61.3
Jul 18, 2024 22:57:18.962609053 CEST	443	49749	162.159.61.3	192.168.2.4
Jul 18, 2024 22:57:18.962740898 CEST	49750	443	192.168.2.4	162.159.61.3
Jul 18, 2024 22:57:18.962740898 CEST	49749	443	192.168.2.4	162.159.61.3
Jul 18, 2024 22:57:18.962764025 CEST	443	49750	162.159.61.3	192.168.2.4
Jul 18, 2024 22:57:18.962846994 CEST	49750	443	192.168.2.4	162.159.61.3
Jul 18, 2024 22:57:18.963265896 CEST	49749	443	192.168.2.4	162.159.61.3
Jul 18, 2024 22:57:18.963284016 CEST	443	49749	162.159.61.3	192.168.2.4
Jul 18, 2024 22:57:18.963330030 CEST	49750	443	192.168.2.4	162.159.61.3
Jul 18, 2024 22:57:18.963344097 CEST	443	49750	162.159.61.3	192.168.2.4
Jul 18, 2024 22:57:19.483325005 CEST	443	49749	162.159.61.3	192.168.2.4
Jul 18, 2024 22:57:19.484210014 CEST	49749	443	192.168.2.4	162.159.61.3
Jul 18, 2024 22:57:19.484232903 CEST	443	49749	162.159.61.3	192.168.2.4
Jul 18, 2024 22:57:19.484785080 CEST	443	49749	162.159.61.3	192.168.2.4
Jul 18, 2024 22:57:19.485692024 CEST	49749	443	192.168.2.4	162.159.61.3
Jul 18, 2024 22:57:19.485805035 CEST	443	49749	162.159.61.3	192.168.2.4
Jul 18, 2024 22:57:19.486917019 CEST	443	49750	162.159.61.3	192.168.2.4
Jul 18, 2024 22:57:19.487190008 CEST	49750	443	192.168.2.4	162.159.61.3
Jul 18, 2024 22:57:19.487204075 CEST	443	49750	162.159.61.3	192.168.2.4
Jul 18, 2024 22:57:19.487546921 CEST	443	49750	162.159.61.3	192.168.2.4
Jul 18, 2024 22:57:19.487960100 CEST	49750	443	192.168.2.4	162.159.61.3
Jul 18, 2024 22:57:19.488044024 CEST	443	49750	162.159.61.3	192.168.2.4
Jul 18, 2024 22:57:19.529844999 CEST	49749	443	192.168.2.4	162.159.61.3
Jul 18, 2024 22:57:19.530005932 CEST	49750	443	192.168.2.4	162.159.61.3
Jul 18, 2024 22:57:19.569515944 CEST	49751	443	192.168.2.4	142.251.35.170
Jul 18, 2024 22:57:19.569559097 CEST	443	49751	142.251.35.170	192.168.2.4
Jul 18, 2024 22:57:19.569830894 CEST	49751	443	192.168.2.4	142.251.35.170
Jul 18, 2024 22:57:19.570333958 CEST	49751	443	192.168.2.4	142.251.35.170
Jul 18, 2024 22:57:19.570363045 CEST	443	49751	142.251.35.170	192.168.2.4
Jul 18, 2024 22:57:20.061037064 CEST	443	49751	142.251.35.170	192.168.2.4
Jul 18, 2024 22:57:20.061620951 CEST	49751	443	192.168.2.4	142.251.35.170
Jul 18, 2024 22:57:20.061631918 CEST	443	49751	142.251.35.170	192.168.2.4
Jul 18, 2024 22:57:20.063368082 CEST	443	49751	142.251.35.170	192.168.2.4
Jul 18, 2024 22:57:20.063440084 CEST	49751	443	192.168.2.4	142.251.35.170
Jul 18, 2024 22:57:20.064784050 CEST	49751	443	192.168.2.4	142.251.35.170
Jul 18, 2024 22:57:20.064863920 CEST	443	49751	142.251.35.170	192.168.2.4
Jul 18, 2024 22:57:20.065195084 CEST	49751	443	192.168.2.4	142.251.35.170
Jul 18, 2024 22:57:20.065201998 CEST	443	49751	142.251.35.170	192.168.2.4
Jul 18, 2024 22:57:20.107965946 CEST	49751	443	192.168.2.4	142.251.35.170
Jul 18, 2024 22:57:20.204130888 CEST	443	49751	142.251.35.170	192.168.2.4
Jul 18, 2024 22:57:20.204358101 CEST	443	49751	142.251.35.170	192.168.2.4
Jul 18, 2024 22:57:20.204456091 CEST	49751	443	192.168.2.4	142.251.35.170
Jul 18, 2024 22:57:20.205388069 CEST	49751	443	192.168.2.4	142.251.35.170
Jul 18, 2024 22:57:20.205404997 CEST	443	49751	142.251.35.170	192.168.2.4
Jul 18, 2024 22:57:32.757966042 CEST	49758	443	192.168.2.4	152.195.19.97
Jul 18, 2024 22:57:32.758003950 CEST	443	49758	152.195.19.97	192.168.2.4
Jul 18, 2024 22:57:32.758161068 CEST	49758	443	192.168.2.4	152.195.19.97
Jul 18, 2024 22:57:32.758332014 CEST	49758	443	192.168.2.4	152.195.19.97
Jul 18, 2024 22:57:32.758352995 CEST	443	49758	152.195.19.97	192.168.2.4
Jul 18, 2024 22:57:33.359110117 CEST	443	49758	152.195.19.97	192.168.2.4
Jul 18, 2024 22:57:33.359534025 CEST	49758	443	192.168.2.4	152.195.19.97
Jul 18, 2024 22:57:33.359544992 CEST	443	49758	152.195.19.97	192.168.2.4
Jul 18, 2024 22:57:33.360580921 CEST	443	49758	152.195.19.97	192.168.2.4
Jul 18, 2024 22:57:33.361915112 CEST	49758	443	192.168.2.4	152.195.19.97
Jul 18, 2024 22:57:33.361915112 CEST	49758	443	192.168.2.4	152.195.19.97
Jul 18, 2024 22:57:33.361974955 CEST	443	49758	152.195.19.97	192.168.2.4
Jul 18, 2024 22:57:33.362101078 CEST	49758	443	192.168.2.4	152.195.19.97
Jul 18, 2024 22:57:33.362112999 CEST	443	49758	152.195.19.97	192.168.2.4
Jul 18, 2024 22:57:33.404970884 CEST	49758	443	192.168.2.4	152.195.19.97
Jul 18, 2024 22:57:33.464728117 CEST	443	49758	152.195.19.97	192.168.2.4
Jul 18, 2024 22:57:33.465384960 CEST	443	49758	152.195.19.97	192.168.2.4
Jul 18, 2024 22:57:33.465406895 CEST	443	49758	152.195.19.97	192.168.2.4
Jul 18, 2024 22:57:33.465447903 CEST	443	49758	152.195.19.97	192.168.2.4
Jul 18, 2024 22:57:33.465461969 CEST	49758	443	192.168.2.4	152.195.19.97
Jul 18, 2024 22:57:33.465487003 CEST	443	49758	152.195.19.97	192.168.2.4
Jul 18, 2024 22:57:33.465491056 CEST	49758	443	192.168.2.4	152.195.19.97
Jul 18, 2024 22:57:33.465507030 CEST	49758	443	192.168.2.4	152.195.19.97
Jul 18, 2024 22:57:33.465632915 CEST	443	49758	152.195.19.97	192.168.2.4
Jul 18, 2024 22:57:33.465662003 CEST	49758	443	192.168.2.4	152.195.19.97
Jul 18, 2024 22:57:33.465673923 CEST	443	49758	152.195.19.97	192.168.2.4
Jul 18, 2024 22:57:33.465724945 CEST	49758	443	192.168.2.4	152.195.19.97
Jul 18, 2024 22:57:33.465724945 CEST	49758	443	192.168.2.4	152.195.19.97
Jul 18, 2024 22:57:33.761456966 CEST	49759	443	192.168.2.4	162.159.61.3
Jul 18, 2024 22:57:33.761497974 CEST	443	49759	162.159.61.3	192.168.2.4
Jul 18, 2024 22:57:33.761590958 CEST	49759	443	192.168.2.4	162.159.61.3
Jul 18, 2024 22:57:33.761671066 CEST	49760	443	192.168.2.4	162.159.61.3
Jul 18, 2024 22:57:33.761703968 CEST	443	49760	162.159.61.3	192.168.2.4
Jul 18, 2024 22:57:33.761764050 CEST	49760	443	192.168.2.4	162.159.61.3
Jul 18, 2024 22:57:33.761964083 CEST	49760	443	192.168.2.4	162.159.61.3
Jul 18, 2024 22:57:33.761972904 CEST	443	49760	162.159.61.3	192.168.2.4
Jul 18, 2024 22:57:33.761991978 CEST	49759	443	192.168.2.4	162.159.61.3
Jul 18, 2024 22:57:33.762005091 CEST	443	49759	162.159.61.3	192.168.2.4
Jul 18, 2024 22:57:34.249866009 CEST	443	49759	162.159.61.3	192.168.2.4
Jul 18, 2024 22:57:34.250593901 CEST	49759	443	192.168.2.4	162.159.61.3
Jul 18, 2024 22:57:34.250607967 CEST	443	49759	162.159.61.3	192.168.2.4
Jul 18, 2024 22:57:34.250909090 CEST	443	49760	162.159.61.3	192.168.2.4
Jul 18, 2024 22:57:34.250933886 CEST	443	49759	162.159.61.3	192.168.2.4
Jul 18, 2024 22:57:34.251214981 CEST	49759	443	192.168.2.4	162.159.61.3
Jul 18, 2024 22:57:34.251260996 CEST	443	49759	162.159.61.3	192.168.2.4
Jul 18, 2024 22:57:34.251588106 CEST	49760	443	192.168.2.4	162.159.61.3
Jul 18, 2024 22:57:34.251600027 CEST	443	49760	162.159.61.3	192.168.2.4
Jul 18, 2024 22:57:34.251904964 CEST	443	49760	162.159.61.3	192.168.2.4
Jul 18, 2024 22:57:34.252321005 CEST	49760	443	192.168.2.4	162.159.61.3
Jul 18, 2024 22:57:34.252367973 CEST	443	49760	162.159.61.3	192.168.2.4
Jul 18, 2024 22:57:34.295486927 CEST	49760	443	192.168.2.4	162.159.61.3
Jul 18, 2024 22:57:34.298935890 CEST	49759	443	192.168.2.4	162.159.61.3
Jul 18, 2024 22:57:34.389813900 CEST	443	49749	162.159.61.3	192.168.2.4
Jul 18, 2024 22:57:34.389873981 CEST	443	49749	162.159.61.3	192.168.2.4
Jul 18, 2024 22:57:34.390309095 CEST	49749	443	192.168.2.4	162.159.61.3
Jul 18, 2024 22:57:34.393671989 CEST	443	49750	162.159.61.3	192.168.2.4
Jul 18, 2024 22:57:34.393748999 CEST	443	49750	162.159.61.3	192.168.2.4
Jul 18, 2024 22:57:34.393956900 CEST	49750	443	192.168.2.4	162.159.61.3
Jul 18, 2024 22:57:36.514441013 CEST	80	49740	103.7.30.83	192.168.2.4
Jul 18, 2024 22:57:36.514519930 CEST	49740	80	192.168.2.4	103.7.30.83
Jul 18, 2024 22:57:36.532665968 CEST	49740	80	192.168.2.4	103.7.30.83
Jul 18, 2024 22:57:36.537724972 CEST	80	49740	103.7.30.83	192.168.2.4
Jul 18, 2024 22:57:45.845010996 CEST	49764	80	192.168.2.4	54.169.168.67
Jul 18, 2024 22:57:45.849912882 CEST	80	49764	54.169.168.67	192.168.2.4
Jul 18, 2024 22:57:45.850528955 CEST	49764	80	192.168.2.4	54.169.168.67
Jul 18, 2024 22:57:45.871335030 CEST	49764	80	192.168.2.4	54.169.168.67
Jul 18, 2024 22:57:45.876249075 CEST	80	49764	54.169.168.67	192.168.2.4
Jul 18, 2024 22:57:46.768934011 CEST	80	49764	54.169.168.67	192.168.2.4
Jul 18, 2024 22:57:46.977157116 CEST	49764	80	192.168.2.4	54.169.168.67
Jul 18, 2024 22:57:46.977545023 CEST	80	49764	54.169.168.67	192.168.2.4
Jul 18, 2024 22:57:46.977655888 CEST	49764	80	192.168.2.4	54.169.168.67
Jul 18, 2024 22:57:47.316726923 CEST	49765	53	192.168.2.4	8.8.8.8
Jul 18, 2024 22:57:47.318799019 CEST	49767	443	192.168.2.4	103.235.46.96
Jul 18, 2024 22:57:47.318835020 CEST	443	49767	103.235.46.96	192.168.2.4
Jul 18, 2024 22:57:47.318994999 CEST	49767	443	192.168.2.4	103.235.46.96
Jul 18, 2024 22:57:47.319458008 CEST	49768	443	192.168.2.4	142.250.186.164
Jul 18, 2024 22:57:47.319483995 CEST	443	49768	142.250.186.164	192.168.2.4
Jul 18, 2024 22:57:47.319622993 CEST	49768	443	192.168.2.4	142.250.186.164
Jul 18, 2024 22:57:47.320429087 CEST	49767	443	192.168.2.4	103.235.46.96
Jul 18, 2024 22:57:47.320508003 CEST	443	49767	103.235.46.96	192.168.2.4
Jul 18, 2024 22:57:47.320569038 CEST	49767	443	192.168.2.4	103.235.46.96
Jul 18, 2024 22:57:47.321813107 CEST	53	49765	8.8.8.8	192.168.2.4
Jul 18, 2024 22:57:47.321907043 CEST	49765	53	192.168.2.4	8.8.8.8
Jul 18, 2024 22:57:47.324043036 CEST	49768	443	192.168.2.4	142.250.186.164
Jul 18, 2024 22:57:47.324136972 CEST	443	49768	142.250.186.164	192.168.2.4
Jul 18, 2024 22:57:47.324373960 CEST	49768	443	192.168.2.4	142.250.186.164
Jul 18, 2024 22:57:47.324713945 CEST	49765	53	192.168.2.4	8.8.8.8
Jul 18, 2024 22:57:47.330136061 CEST	53	49765	8.8.8.8	192.168.2.4
Jul 18, 2024 22:57:47.330207109 CEST	49765	53	192.168.2.4	8.8.8.8
Jul 18, 2024 22:57:47.344052076 CEST	49769	443	192.168.2.4	77.88.55.88
Jul 18, 2024 22:57:47.344088078 CEST	443	49769	77.88.55.88	192.168.2.4
Jul 18, 2024 22:57:47.344207048 CEST	49769	443	192.168.2.4	77.88.55.88
Jul 18, 2024 22:57:47.354844093 CEST	49769	443	192.168.2.4	77.88.55.88
Jul 18, 2024 22:57:47.354933977 CEST	443	49769	77.88.55.88	192.168.2.4
Jul 18, 2024 22:57:47.356017113 CEST	49769	443	192.168.2.4	77.88.55.88
Jul 18, 2024 22:57:47.469232082 CEST	80	49764	54.169.168.67	192.168.2.4
Jul 18, 2024 22:57:47.578962088 CEST	49764	80	192.168.2.4	54.169.168.67
Jul 18, 2024 22:57:47.784744978 CEST	49764	80	192.168.2.4	54.169.168.67
Jul 18, 2024 22:57:47.790091991 CEST	80	49764	54.169.168.67	192.168.2.4
Jul 18, 2024 22:57:47.860955954 CEST	49770	443	192.168.2.4	3.164.160.102
Jul 18, 2024 22:57:47.861052036 CEST	443	49770	3.164.160.102	192.168.2.4
Jul 18, 2024 22:57:47.861215115 CEST	49771	443	192.168.2.4	3.164.160.102
Jul 18, 2024 22:57:47.861243010 CEST	443	49771	3.164.160.102	192.168.2.4
Jul 18, 2024 22:57:47.861262083 CEST	49770	443	192.168.2.4	3.164.160.102
Jul 18, 2024 22:57:47.861262083 CEST	49772	443	192.168.2.4	3.164.160.102
Jul 18, 2024 22:57:47.861315012 CEST	49771	443	192.168.2.4	3.164.160.102
Jul 18, 2024 22:57:47.861366987 CEST	443	49772	3.164.160.102	192.168.2.4
Jul 18, 2024 22:57:47.861519098 CEST	49772	443	192.168.2.4	3.164.160.102
Jul 18, 2024 22:57:47.869642019 CEST	49772	443	192.168.2.4	3.164.160.102
Jul 18, 2024 22:57:47.869669914 CEST	443	49772	3.164.160.102	192.168.2.4
Jul 18, 2024 22:57:47.870075941 CEST	49771	443	192.168.2.4	3.164.160.102
Jul 18, 2024 22:57:47.870090961 CEST	443	49771	3.164.160.102	192.168.2.4
Jul 18, 2024 22:57:47.870443106 CEST	49770	443	192.168.2.4	3.164.160.102
Jul 18, 2024 22:57:47.870472908 CEST	443	49770	3.164.160.102	192.168.2.4
Jul 18, 2024 22:57:48.036190033 CEST	49773	443	192.168.2.4	23.98.101.155
Jul 18, 2024 22:57:48.036245108 CEST	443	49773	23.98.101.155	192.168.2.4
Jul 18, 2024 22:57:48.036302090 CEST	49773	443	192.168.2.4	23.98.101.155
Jul 18, 2024 22:57:48.036942959 CEST	49773	443	192.168.2.4	23.98.101.155
Jul 18, 2024 22:57:48.036967039 CEST	443	49773	23.98.101.155	192.168.2.4
Jul 18, 2024 22:57:48.111686945 CEST	80	49764	54.169.168.67	192.168.2.4
Jul 18, 2024 22:57:48.115165949 CEST	49764	80	192.168.2.4	54.169.168.67
Jul 18, 2024 22:57:48.612075090 CEST	443	49771	3.164.160.102	192.168.2.4
Jul 18, 2024 22:57:48.612190962 CEST	49771	443	192.168.2.4	3.164.160.102
Jul 18, 2024 22:57:48.614761114 CEST	49771	443	192.168.2.4	3.164.160.102
Jul 18, 2024 22:57:48.614768028 CEST	443	49771	3.164.160.102	192.168.2.4
Jul 18, 2024 22:57:48.614931107 CEST	443	49771	3.164.160.102	192.168.2.4
Jul 18, 2024 22:57:48.614957094 CEST	49771	443	192.168.2.4	3.164.160.102
Jul 18, 2024 22:57:48.640726089 CEST	443	49772	3.164.160.102	192.168.2.4
Jul 18, 2024 22:57:48.640868902 CEST	49772	443	192.168.2.4	3.164.160.102
Jul 18, 2024 22:57:48.643335104 CEST	49772	443	192.168.2.4	3.164.160.102
Jul 18, 2024 22:57:48.643342972 CEST	443	49772	3.164.160.102	192.168.2.4
Jul 18, 2024 22:57:48.643421888 CEST	443	49772	3.164.160.102	192.168.2.4
Jul 18, 2024 22:57:48.643455982 CEST	49772	443	192.168.2.4	3.164.160.102
Jul 18, 2024 22:57:48.645870924 CEST	443	49770	3.164.160.102	192.168.2.4
Jul 18, 2024 22:57:48.645961046 CEST	49770	443	192.168.2.4	3.164.160.102
Jul 18, 2024 22:57:48.648797035 CEST	49770	443	192.168.2.4	3.164.160.102
Jul 18, 2024 22:57:48.648812056 CEST	443	49770	3.164.160.102	192.168.2.4
Jul 18, 2024 22:57:48.648964882 CEST	443	49770	3.164.160.102	192.168.2.4
Jul 18, 2024 22:57:48.649055958 CEST	49770	443	192.168.2.4	3.164.160.102
Jul 18, 2024 22:57:48.660495996 CEST	443	49771	3.164.160.102	192.168.2.4
Jul 18, 2024 22:57:48.684516907 CEST	443	49772	3.164.160.102	192.168.2.4
Jul 18, 2024 22:57:48.692497969 CEST	443	49770	3.164.160.102	192.168.2.4
Jul 18, 2024 22:57:48.786459923 CEST	49771	443	192.168.2.4	3.164.160.102
Jul 18, 2024 22:57:48.786484003 CEST	443	49771	3.164.160.102	192.168.2.4
Jul 18, 2024 22:57:48.833607912 CEST	49772	443	192.168.2.4	3.164.160.102
Jul 18, 2024 22:57:48.833607912 CEST	49770	443	192.168.2.4	3.164.160.102
Jul 18, 2024 22:57:48.833673954 CEST	443	49772	3.164.160.102	192.168.2.4
Jul 18, 2024 22:57:48.833713055 CEST	443	49770	3.164.160.102	192.168.2.4
Jul 18, 2024 22:57:48.942819118 CEST	49772	443	192.168.2.4	3.164.160.102
Jul 18, 2024 22:57:48.942919970 CEST	49770	443	192.168.2.4	3.164.160.102
Jul 18, 2024 22:57:48.989548922 CEST	49771	443	192.168.2.4	3.164.160.102
Jul 18, 2024 22:57:49.153353930 CEST	443	49760	162.159.61.3	192.168.2.4
Jul 18, 2024 22:57:49.153526068 CEST	443	49760	162.159.61.3	192.168.2.4
Jul 18, 2024 22:57:49.153582096 CEST	49760	443	192.168.2.4	162.159.61.3
Jul 18, 2024 22:57:49.155244112 CEST	443	49759	162.159.61.3	192.168.2.4
Jul 18, 2024 22:57:49.155426025 CEST	443	49759	162.159.61.3	192.168.2.4
Jul 18, 2024 22:57:49.155522108 CEST	49759	443	192.168.2.4	162.159.61.3
Jul 18, 2024 22:57:49.204005957 CEST	443	49771	3.164.160.102	192.168.2.4
Jul 18, 2024 22:57:49.204307079 CEST	443	49771	3.164.160.102	192.168.2.4
Jul 18, 2024 22:57:49.204394102 CEST	49771	443	192.168.2.4	3.164.160.102
Jul 18, 2024 22:57:49.209610939 CEST	49771	443	192.168.2.4	3.164.160.102
Jul 18, 2024 22:57:49.209635973 CEST	443	49771	3.164.160.102	192.168.2.4
Jul 18, 2024 22:57:49.209650040 CEST	49771	443	192.168.2.4	3.164.160.102
Jul 18, 2024 22:57:49.209657907 CEST	443	49771	3.164.160.102	192.168.2.4
Jul 18, 2024 22:57:49.256273985 CEST	443	49772	3.164.160.102	192.168.2.4
Jul 18, 2024 22:57:49.256567001 CEST	443	49772	3.164.160.102	192.168.2.4
Jul 18, 2024 22:57:49.256649971 CEST	49772	443	192.168.2.4	3.164.160.102
Jul 18, 2024 22:57:49.270381927 CEST	443	49770	3.164.160.102	192.168.2.4
Jul 18, 2024 22:57:49.270492077 CEST	443	49770	3.164.160.102	192.168.2.4
Jul 18, 2024 22:57:49.270546913 CEST	49770	443	192.168.2.4	3.164.160.102
Jul 18, 2024 22:57:49.298969984 CEST	49770	443	192.168.2.4	3.164.160.102
Jul 18, 2024 22:57:49.299000978 CEST	443	49770	3.164.160.102	192.168.2.4
Jul 18, 2024 22:57:49.299015999 CEST	49770	443	192.168.2.4	3.164.160.102
Jul 18, 2024 22:57:49.299021959 CEST	443	49770	3.164.160.102	192.168.2.4
Jul 18, 2024 22:57:49.299369097 CEST	49772	443	192.168.2.4	3.164.160.102
Jul 18, 2024 22:57:49.299374104 CEST	443	49772	3.164.160.102	192.168.2.4
Jul 18, 2024 22:57:49.348853111 CEST	443	49773	23.98.101.155	192.168.2.4
Jul 18, 2024 22:57:49.349107027 CEST	49773	443	192.168.2.4	23.98.101.155
Jul 18, 2024 22:57:49.469660044 CEST	49773	443	192.168.2.4	23.98.101.155
Jul 18, 2024 22:57:49.469743967 CEST	443	49773	23.98.101.155	192.168.2.4
Jul 18, 2024 22:57:49.470366955 CEST	443	49773	23.98.101.155	192.168.2.4
Jul 18, 2024 22:57:49.470439911 CEST	49773	443	192.168.2.4	23.98.101.155
Jul 18, 2024 22:57:49.470839977 CEST	49776	443	192.168.2.4	183.60.146.66
Jul 18, 2024 22:57:49.470927000 CEST	443	49776	183.60.146.66	192.168.2.4
Jul 18, 2024 22:57:49.470999002 CEST	49776	443	192.168.2.4	183.60.146.66
Jul 18, 2024 22:57:49.472220898 CEST	49776	443	192.168.2.4	183.60.146.66
Jul 18, 2024 22:57:49.472253084 CEST	443	49776	183.60.146.66	192.168.2.4
Jul 18, 2024 22:57:50.889568090 CEST	443	49776	183.60.146.66	192.168.2.4
Jul 18, 2024 22:57:50.889674902 CEST	49776	443	192.168.2.4	183.60.146.66
Jul 18, 2024 22:57:50.891330957 CEST	49776	443	192.168.2.4	183.60.146.66
Jul 18, 2024 22:57:50.891355991 CEST	443	49776	183.60.146.66	192.168.2.4
Jul 18, 2024 22:57:50.891530991 CEST	443	49776	183.60.146.66	192.168.2.4
Jul 18, 2024 22:57:50.891875982 CEST	49776	443	192.168.2.4	183.60.146.66
Jul 18, 2024 22:57:50.892088890 CEST	49778	443	192.168.2.4	35.227.223.56
Jul 18, 2024 22:57:50.892127991 CEST	443	49778	35.227.223.56	192.168.2.4
Jul 18, 2024 22:57:50.892189980 CEST	49778	443	192.168.2.4	35.227.223.56
Jul 18, 2024 22:57:50.892765999 CEST	49778	443	192.168.2.4	35.227.223.56
Jul 18, 2024 22:57:50.892777920 CEST	443	49778	35.227.223.56	192.168.2.4
Jul 18, 2024 22:57:52.154885054 CEST	443	49778	35.227.223.56	192.168.2.4
Jul 18, 2024 22:57:52.154966116 CEST	49778	443	192.168.2.4	35.227.223.56
Jul 18, 2024 22:57:52.155550003 CEST	443	49778	35.227.223.56	192.168.2.4
Jul 18, 2024 22:57:52.155596018 CEST	49778	443	192.168.2.4	35.227.223.56
Jul 18, 2024 22:57:52.156850100 CEST	49778	443	192.168.2.4	35.227.223.56
Jul 18, 2024 22:57:52.156858921 CEST	443	49778	35.227.223.56	192.168.2.4
Jul 18, 2024 22:57:52.157022953 CEST	443	49778	35.227.223.56	192.168.2.4
Jul 18, 2024 22:57:52.157088041 CEST	49778	443	192.168.2.4	35.227.223.56
Jul 18, 2024 22:57:52.157771111 CEST	49779	443	192.168.2.4	23.98.101.155
Jul 18, 2024 22:57:52.157813072 CEST	443	49779	23.98.101.155	192.168.2.4
Jul 18, 2024 22:57:52.157902956 CEST	49779	443	192.168.2.4	23.98.101.155
Jul 18, 2024 22:57:52.158484936 CEST	49779	443	192.168.2.4	23.98.101.155
Jul 18, 2024 22:57:52.158500910 CEST	443	49779	23.98.101.155	192.168.2.4
Jul 18, 2024 22:57:52.778738022 CEST	49764	80	192.168.2.4	54.169.168.67
Jul 18, 2024 22:57:52.783818960 CEST	80	49764	54.169.168.67	192.168.2.4
Jul 18, 2024 22:57:53.629539967 CEST	443	49779	23.98.101.155	192.168.2.4
Jul 18, 2024 22:57:53.629738092 CEST	49779	443	192.168.2.4	23.98.101.155
Jul 18, 2024 22:57:53.632841110 CEST	49779	443	192.168.2.4	23.98.101.155
Jul 18, 2024 22:57:53.632853985 CEST	443	49779	23.98.101.155	192.168.2.4
Jul 18, 2024 22:57:53.633024931 CEST	443	49779	23.98.101.155	192.168.2.4
Jul 18, 2024 22:57:53.633080006 CEST	49779	443	192.168.2.4	23.98.101.155
Jul 18, 2024 22:57:53.633943081 CEST	49780	443	192.168.2.4	23.98.101.155
Jul 18, 2024 22:57:53.633994102 CEST	443	49780	23.98.101.155	192.168.2.4
Jul 18, 2024 22:57:53.634066105 CEST	49780	443	192.168.2.4	23.98.101.155
Jul 18, 2024 22:57:53.634605885 CEST	49780	443	192.168.2.4	23.98.101.155
Jul 18, 2024 22:57:53.634620905 CEST	443	49780	23.98.101.155	192.168.2.4
Jul 18, 2024 22:57:54.940726995 CEST	443	49780	23.98.101.155	192.168.2.4
Jul 18, 2024 22:57:54.940834045 CEST	49780	443	192.168.2.4	23.98.101.155
Jul 18, 2024 22:57:54.944161892 CEST	49780	443	192.168.2.4	23.98.101.155
Jul 18, 2024 22:57:54.944175005 CEST	443	49780	23.98.101.155	192.168.2.4
Jul 18, 2024 22:57:54.944338083 CEST	443	49780	23.98.101.155	192.168.2.4
Jul 18, 2024 22:57:54.944390059 CEST	49780	443	192.168.2.4	23.98.101.155
Jul 18, 2024 22:57:54.945086002 CEST	49781	443	192.168.2.4	23.98.101.155
Jul 18, 2024 22:57:54.945141077 CEST	443	49781	23.98.101.155	192.168.2.4
Jul 18, 2024 22:57:54.945244074 CEST	49781	443	192.168.2.4	23.98.101.155
Jul 18, 2024 22:57:54.946082115 CEST	49781	443	192.168.2.4	23.98.101.155
Jul 18, 2024 22:57:54.946100950 CEST	443	49781	23.98.101.155	192.168.2.4
Jul 18, 2024 22:57:56.213314056 CEST	443	49781	23.98.101.155	192.168.2.4
Jul 18, 2024 22:57:56.213423014 CEST	49781	443	192.168.2.4	23.98.101.155
Jul 18, 2024 22:57:56.215610981 CEST	49781	443	192.168.2.4	23.98.101.155
Jul 18, 2024 22:57:56.215624094 CEST	443	49781	23.98.101.155	192.168.2.4
Jul 18, 2024 22:57:56.215827942 CEST	443	49781	23.98.101.155	192.168.2.4
Jul 18, 2024 22:57:56.216033936 CEST	49781	443	192.168.2.4	23.98.101.155
Jul 18, 2024 22:57:56.218089104 CEST	49782	443	192.168.2.4	23.98.101.155
Jul 18, 2024 22:57:56.218117952 CEST	443	49782	23.98.101.155	192.168.2.4
Jul 18, 2024 22:57:56.218250036 CEST	49782	443	192.168.2.4	23.98.101.155
Jul 18, 2024 22:57:56.220263958 CEST	49782	443	192.168.2.4	23.98.101.155
Jul 18, 2024 22:57:56.220282078 CEST	443	49782	23.98.101.155	192.168.2.4
Jul 18, 2024 22:57:57.494415045 CEST	443	49782	23.98.101.155	192.168.2.4
Jul 18, 2024 22:57:57.494494915 CEST	49782	443	192.168.2.4	23.98.101.155
Jul 18, 2024 22:57:57.496296883 CEST	49782	443	192.168.2.4	23.98.101.155
Jul 18, 2024 22:57:57.496304989 CEST	443	49782	23.98.101.155	192.168.2.4
Jul 18, 2024 22:57:57.496450901 CEST	443	49782	23.98.101.155	192.168.2.4
Jul 18, 2024 22:57:57.496496916 CEST	49782	443	192.168.2.4	23.98.101.155
Jul 18, 2024 22:57:57.498613119 CEST	49783	443	192.168.2.4	183.60.146.66
Jul 18, 2024 22:57:57.498645067 CEST	443	49783	183.60.146.66	192.168.2.4
Jul 18, 2024 22:57:57.498955011 CEST	49783	443	192.168.2.4	183.60.146.66
Jul 18, 2024 22:57:57.499638081 CEST	49783	443	192.168.2.4	183.60.146.66
Jul 18, 2024 22:57:57.499650002 CEST	443	49783	183.60.146.66	192.168.2.4
Jul 18, 2024 22:57:58.824107885 CEST	443	49783	183.60.146.66	192.168.2.4
Jul 18, 2024 22:57:58.824234962 CEST	49783	443	192.168.2.4	183.60.146.66
Jul 18, 2024 22:57:58.826030970 CEST	49783	443	192.168.2.4	183.60.146.66
Jul 18, 2024 22:57:58.826045036 CEST	443	49783	183.60.146.66	192.168.2.4
Jul 18, 2024 22:57:58.826354027 CEST	443	49783	183.60.146.66	192.168.2.4
Jul 18, 2024 22:57:58.826569080 CEST	49783	443	192.168.2.4	183.60.146.66
Jul 18, 2024 22:57:58.826569080 CEST	49784	443	192.168.2.4	183.60.146.66
Jul 18, 2024 22:57:58.826617002 CEST	443	49784	183.60.146.66	192.168.2.4
Jul 18, 2024 22:57:58.827249050 CEST	49784	443	192.168.2.4	183.60.146.66
Jul 18, 2024 22:57:58.827346087 CEST	49784	443	192.168.2.4	183.60.146.66
Jul 18, 2024 22:57:58.827358007 CEST	443	49784	183.60.146.66	192.168.2.4
Jul 18, 2024 22:58:00.105842113 CEST	443	49784	183.60.146.66	192.168.2.4
Jul 18, 2024 22:58:00.106983900 CEST	49784	443	192.168.2.4	183.60.146.66
Jul 18, 2024 22:58:00.110021114 CEST	49784	443	192.168.2.4	183.60.146.66
Jul 18, 2024 22:58:00.110035896 CEST	443	49784	183.60.146.66	192.168.2.4
Jul 18, 2024 22:58:00.110297918 CEST	443	49784	183.60.146.66	192.168.2.4
Jul 18, 2024 22:58:00.111124039 CEST	49785	443	192.168.2.4	183.60.146.66
Jul 18, 2024 22:58:00.111165047 CEST	443	49785	183.60.146.66	192.168.2.4
Jul 18, 2024 22:58:00.111232042 CEST	49785	443	192.168.2.4	183.60.146.66
Jul 18, 2024 22:58:00.112386942 CEST	49785	443	192.168.2.4	183.60.146.66
Jul 18, 2024 22:58:00.112401962 CEST	443	49785	183.60.146.66	192.168.2.4
Jul 18, 2024 22:58:00.113044024 CEST	49784	443	192.168.2.4	183.60.146.66
Jul 18, 2024 22:58:01.401640892 CEST	443	49785	183.60.146.66	192.168.2.4
Jul 18, 2024 22:58:01.401743889 CEST	49785	443	192.168.2.4	183.60.146.66
Jul 18, 2024 22:58:01.509716034 CEST	49785	443	192.168.2.4	183.60.146.66
Jul 18, 2024 22:58:01.509773970 CEST	443	49785	183.60.146.66	192.168.2.4
Jul 18, 2024 22:58:01.510109901 CEST	443	49785	183.60.146.66	192.168.2.4
Jul 18, 2024 22:58:01.510899067 CEST	49785	443	192.168.2.4	183.60.146.66
Jul 18, 2024 22:58:01.522836924 CEST	49786	443	192.168.2.4	183.60.146.66
Jul 18, 2024 22:58:01.522903919 CEST	443	49786	183.60.146.66	192.168.2.4
Jul 18, 2024 22:58:01.522975922 CEST	49786	443	192.168.2.4	183.60.146.66
Jul 18, 2024 22:58:01.640444040 CEST	49786	443	192.168.2.4	183.60.146.66
Jul 18, 2024 22:58:01.640497923 CEST	443	49786	183.60.146.66	192.168.2.4
Jul 18, 2024 22:58:02.926383972 CEST	443	49786	183.60.146.66	192.168.2.4
Jul 18, 2024 22:58:02.926475048 CEST	49786	443	192.168.2.4	183.60.146.66
Jul 18, 2024 22:58:02.940705061 CEST	49786	443	192.168.2.4	183.60.146.66
Jul 18, 2024 22:58:02.940727949 CEST	443	49786	183.60.146.66	192.168.2.4
Jul 18, 2024 22:58:02.940993071 CEST	443	49786	183.60.146.66	192.168.2.4
Jul 18, 2024 22:58:02.941052914 CEST	49786	443	192.168.2.4	183.60.146.66
Jul 18, 2024 22:58:02.944303989 CEST	49788	443	192.168.2.4	35.227.223.56
Jul 18, 2024 22:58:02.944354057 CEST	443	49788	35.227.223.56	192.168.2.4
Jul 18, 2024 22:58:02.944432020 CEST	49788	443	192.168.2.4	35.227.223.56
Jul 18, 2024 22:58:02.945960045 CEST	49788	443	192.168.2.4	35.227.223.56
Jul 18, 2024 22:58:02.945976019 CEST	443	49788	35.227.223.56	192.168.2.4
Jul 18, 2024 22:58:03.957642078 CEST	443	49788	35.227.223.56	192.168.2.4
Jul 18, 2024 22:58:03.957798004 CEST	49788	443	192.168.2.4	35.227.223.56
Jul 18, 2024 22:58:03.960153103 CEST	443	49788	35.227.223.56	192.168.2.4
Jul 18, 2024 22:58:03.960236073 CEST	49788	443	192.168.2.4	35.227.223.56
Jul 18, 2024 22:58:04.185199022 CEST	49788	443	192.168.2.4	35.227.223.56
Jul 18, 2024 22:58:04.185246944 CEST	443	49788	35.227.223.56	192.168.2.4
Jul 18, 2024 22:58:04.185545921 CEST	443	49788	35.227.223.56	192.168.2.4
Jul 18, 2024 22:58:04.185889959 CEST	49788	443	192.168.2.4	35.227.223.56
Jul 18, 2024 22:58:04.186523914 CEST	49790	443	192.168.2.4	35.227.223.56
Jul 18, 2024 22:58:04.186574936 CEST	443	49790	35.227.223.56	192.168.2.4
Jul 18, 2024 22:58:04.188292027 CEST	49790	443	192.168.2.4	35.227.223.56
Jul 18, 2024 22:58:04.309787035 CEST	49790	443	192.168.2.4	35.227.223.56
Jul 18, 2024 22:58:04.309820890 CEST	443	49790	35.227.223.56	192.168.2.4
Jul 18, 2024 22:58:04.328520060 CEST	49786	443	192.168.2.4	183.60.146.66
Jul 18, 2024 22:58:04.328562975 CEST	443	49786	183.60.146.66	192.168.2.4
Jul 18, 2024 22:58:04.328617096 CEST	49785	443	192.168.2.4	183.60.146.66
Jul 18, 2024 22:58:04.328624010 CEST	443	49785	183.60.146.66	192.168.2.4
Jul 18, 2024 22:58:04.328640938 CEST	49784	443	192.168.2.4	183.60.146.66
Jul 18, 2024 22:58:04.328663111 CEST	443	49784	183.60.146.66	192.168.2.4
Jul 18, 2024 22:58:04.328717947 CEST	49782	443	192.168.2.4	23.98.101.155
Jul 18, 2024 22:58:04.328747034 CEST	443	49782	23.98.101.155	192.168.2.4
Jul 18, 2024 22:58:04.328758001 CEST	49780	443	192.168.2.4	23.98.101.155
Jul 18, 2024 22:58:04.328788042 CEST	443	49780	23.98.101.155	192.168.2.4
Jul 18, 2024 22:58:04.328794003 CEST	49778	443	192.168.2.4	35.227.223.56
Jul 18, 2024 22:58:04.328819990 CEST	443	49778	35.227.223.56	192.168.2.4
Jul 18, 2024 22:58:04.328903913 CEST	49781	443	192.168.2.4	23.98.101.155
Jul 18, 2024 22:58:04.328911066 CEST	443	49781	23.98.101.155	192.168.2.4
Jul 18, 2024 22:58:04.328943968 CEST	49773	443	192.168.2.4	23.98.101.155
Jul 18, 2024 22:58:04.329000950 CEST	49788	443	192.168.2.4	35.227.223.56
Jul 18, 2024 22:58:04.329015017 CEST	443	49773	23.98.101.155	192.168.2.4
Jul 18, 2024 22:58:04.329082012 CEST	443	49788	35.227.223.56	192.168.2.4
Jul 18, 2024 22:58:04.329116106 CEST	49783	443	192.168.2.4	183.60.146.66
Jul 18, 2024 22:58:04.329122066 CEST	443	49783	183.60.146.66	192.168.2.4
Jul 18, 2024 22:58:04.329875946 CEST	49779	443	192.168.2.4	23.98.101.155
Jul 18, 2024 22:58:04.329886913 CEST	443	49779	23.98.101.155	192.168.2.4
Jul 18, 2024 22:58:04.329894066 CEST	49776	443	192.168.2.4	183.60.146.66
Jul 18, 2024 22:58:04.329900026 CEST	443	49776	183.60.146.66	192.168.2.4
Jul 18, 2024 22:58:06.269270897 CEST	443	49790	35.227.223.56	192.168.2.4
Jul 18, 2024 22:58:06.269418001 CEST	49790	443	192.168.2.4	35.227.223.56
Jul 18, 2024 22:58:06.271792889 CEST	443	49790	35.227.223.56	192.168.2.4
Jul 18, 2024 22:58:06.271874905 CEST	49790	443	192.168.2.4	35.227.223.56
Jul 18, 2024 22:58:06.272255898 CEST	49790	443	192.168.2.4	35.227.223.56
Jul 18, 2024 22:58:06.272273064 CEST	443	49790	35.227.223.56	192.168.2.4
Jul 18, 2024 22:58:06.272733927 CEST	443	49790	35.227.223.56	192.168.2.4
Jul 18, 2024 22:58:06.273026943 CEST	49790	443	192.168.2.4	35.227.223.56
Jul 18, 2024 22:58:06.273644924 CEST	49791	443	192.168.2.4	35.227.223.56
Jul 18, 2024 22:58:06.273703098 CEST	443	49791	35.227.223.56	192.168.2.4
Jul 18, 2024 22:58:06.273802042 CEST	49791	443	192.168.2.4	35.227.223.56
Jul 18, 2024 22:58:06.274713993 CEST	49791	443	192.168.2.4	35.227.223.56
Jul 18, 2024 22:58:06.274734020 CEST	443	49791	35.227.223.56	192.168.2.4
Jul 18, 2024 22:58:07.307149887 CEST	443	49791	35.227.223.56	192.168.2.4
Jul 18, 2024 22:58:07.307255983 CEST	49791	443	192.168.2.4	35.227.223.56
Jul 18, 2024 22:58:07.307892084 CEST	443	49791	35.227.223.56	192.168.2.4
Jul 18, 2024 22:58:07.307945013 CEST	49791	443	192.168.2.4	35.227.223.56
Jul 18, 2024 22:58:07.317754984 CEST	49791	443	192.168.2.4	35.227.223.56
Jul 18, 2024 22:58:07.317786932 CEST	443	49791	35.227.223.56	192.168.2.4
Jul 18, 2024 22:58:07.318053007 CEST	443	49791	35.227.223.56	192.168.2.4
Jul 18, 2024 22:58:07.318100929 CEST	49791	443	192.168.2.4	35.227.223.56
Jul 18, 2024 22:58:07.318347931 CEST	49792	443	192.168.2.4	35.227.223.56
Jul 18, 2024 22:58:07.318397045 CEST	443	49792	35.227.223.56	192.168.2.4
Jul 18, 2024 22:58:07.318459988 CEST	49792	443	192.168.2.4	35.227.223.56
Jul 18, 2024 22:58:07.320813894 CEST	49792	443	192.168.2.4	35.227.223.56
Jul 18, 2024 22:58:07.320835114 CEST	443	49792	35.227.223.56	192.168.2.4
Jul 18, 2024 22:58:08.315411091 CEST	443	49792	35.227.223.56	192.168.2.4
Jul 18, 2024 22:58:08.315515995 CEST	49792	443	192.168.2.4	35.227.223.56
Jul 18, 2024 22:58:08.316127062 CEST	443	49792	35.227.223.56	192.168.2.4
Jul 18, 2024 22:58:08.316957951 CEST	49792	443	192.168.2.4	35.227.223.56
Jul 18, 2024 22:58:08.317243099 CEST	49792	443	192.168.2.4	35.227.223.56
Jul 18, 2024 22:58:08.317274094 CEST	443	49792	35.227.223.56	192.168.2.4
Jul 18, 2024 22:58:08.317460060 CEST	443	49792	35.227.223.56	192.168.2.4
Jul 18, 2024 22:58:08.317626953 CEST	49792	443	192.168.2.4	35.227.223.56
Jul 18, 2024 22:58:08.332066059 CEST	49793	443	192.168.2.4	108.138.24.13
Jul 18, 2024 22:58:08.332103014 CEST	443	49793	108.138.24.13	192.168.2.4
Jul 18, 2024 22:58:08.332182884 CEST	49793	443	192.168.2.4	108.138.24.13
Jul 18, 2024 22:58:08.332833052 CEST	49793	443	192.168.2.4	108.138.24.13
Jul 18, 2024 22:58:08.332847118 CEST	443	49793	108.138.24.13	192.168.2.4
Jul 18, 2024 22:58:09.106905937 CEST	443	49793	108.138.24.13	192.168.2.4
Jul 18, 2024 22:58:09.106995106 CEST	49793	443	192.168.2.4	108.138.24.13
Jul 18, 2024 22:58:09.110097885 CEST	49793	443	192.168.2.4	108.138.24.13
Jul 18, 2024 22:58:09.110114098 CEST	443	49793	108.138.24.13	192.168.2.4
Jul 18, 2024 22:58:09.110219955 CEST	49793	443	192.168.2.4	108.138.24.13
Jul 18, 2024 22:58:09.110224962 CEST	443	49793	108.138.24.13	192.168.2.4
Jul 18, 2024 22:58:09.110265017 CEST	443	49793	108.138.24.13	192.168.2.4
Jul 18, 2024 22:58:09.164551020 CEST	49793	443	192.168.2.4	108.138.24.13
Jul 18, 2024 22:58:09.164568901 CEST	443	49793	108.138.24.13	192.168.2.4
Jul 18, 2024 22:58:09.211452007 CEST	49793	443	192.168.2.4	108.138.24.13
Jul 18, 2024 22:58:09.735301018 CEST	443	49793	108.138.24.13	192.168.2.4
Jul 18, 2024 22:58:09.735568047 CEST	443	49793	108.138.24.13	192.168.2.4
Jul 18, 2024 22:58:09.735630989 CEST	49793	443	192.168.2.4	108.138.24.13
Jul 18, 2024 22:58:09.735971928 CEST	49793	443	192.168.2.4	108.138.24.13
Jul 18, 2024 22:58:09.735989094 CEST	443	49793	108.138.24.13	192.168.2.4
Jul 18, 2024 22:58:09.736001968 CEST	49793	443	192.168.2.4	108.138.24.13
Jul 18, 2024 22:58:09.736007929 CEST	443	49793	108.138.24.13	192.168.2.4
Jul 18, 2024 22:58:12.882181883 CEST	49759	443	192.168.2.4	162.159.61.3
Jul 18, 2024 22:58:12.882217884 CEST	443	49759	162.159.61.3	192.168.2.4
Jul 18, 2024 22:58:12.882366896 CEST	49760	443	192.168.2.4	162.159.61.3
Jul 18, 2024 22:58:12.882390022 CEST	443	49760	162.159.61.3	192.168.2.4
Jul 18, 2024 22:58:19.404489040 CEST	49749	443	192.168.2.4	162.159.61.3
Jul 18, 2024 22:58:19.404489040 CEST	49750	443	192.168.2.4	162.159.61.3
Jul 18, 2024 22:58:19.404529095 CEST	443	49749	162.159.61.3	192.168.2.4
Jul 18, 2024 22:58:19.404544115 CEST	443	49750	162.159.61.3	192.168.2.4
Jul 18, 2024 22:58:21.277205944 CEST	49790	443	192.168.2.4	35.227.223.56
Jul 18, 2024 22:58:21.277242899 CEST	443	49790	35.227.223.56	192.168.2.4
Jul 18, 2024 22:58:22.319309950 CEST	49791	443	192.168.2.4	35.227.223.56
Jul 18, 2024 22:58:22.319343090 CEST	443	49791	35.227.223.56	192.168.2.4
Jul 18, 2024 22:58:23.317625046 CEST	49792	443	192.168.2.4	35.227.223.56
Jul 18, 2024 22:58:23.317675114 CEST	443	49792	35.227.223.56	192.168.2.4
Jul 18, 2024 22:58:36.289870977 CEST	49790	443	192.168.2.4	35.227.223.56
Jul 18, 2024 22:58:36.289917946 CEST	443	49790	35.227.223.56	192.168.2.4
Jul 18, 2024 22:58:37.319283009 CEST	49791	443	192.168.2.4	35.227.223.56
Jul 18, 2024 22:58:37.319328070 CEST	443	49791	35.227.223.56	192.168.2.4
Jul 18, 2024 22:58:38.323765039 CEST	49792	443	192.168.2.4	35.227.223.56
Jul 18, 2024 22:58:38.323800087 CEST	443	49792	35.227.223.56	192.168.2.4
Jul 18, 2024 22:58:51.298212051 CEST	49790	443	192.168.2.4	35.227.223.56
Jul 18, 2024 22:58:51.298253059 CEST	443	49790	35.227.223.56	192.168.2.4
Jul 18, 2024 22:58:52.326738119 CEST	49791	443	192.168.2.4	35.227.223.56
Jul 18, 2024 22:58:52.326771975 CEST	443	49791	35.227.223.56	192.168.2.4
Jul 18, 2024 22:58:53.327662945 CEST	49792	443	192.168.2.4	35.227.223.56
Jul 18, 2024 22:58:53.327702999 CEST	443	49792	35.227.223.56	192.168.2.4
Jul 18, 2024 22:59:04.531323910 CEST	49749	443	192.168.2.4	162.159.61.3
Jul 18, 2024 22:59:04.531352997 CEST	443	49749	162.159.61.3	192.168.2.4
Jul 18, 2024 22:59:04.531387091 CEST	49750	443	192.168.2.4	162.159.61.3
Jul 18, 2024 22:59:04.531404972 CEST	443	49750	162.159.61.3	192.168.2.4
Jul 18, 2024 22:59:06.341191053 CEST	49790	443	192.168.2.4	35.227.223.56
Jul 18, 2024 22:59:06.341233015 CEST	443	49790	35.227.223.56	192.168.2.4
Jul 18, 2024 22:59:07.328212023 CEST	49791	443	192.168.2.4	35.227.223.56
Jul 18, 2024 22:59:07.328244925 CEST	443	49791	35.227.223.56	192.168.2.4
Jul 18, 2024 22:59:08.437112093 CEST	49792	443	192.168.2.4	35.227.223.56
Jul 18, 2024 22:59:08.437148094 CEST	443	49792	35.227.223.56	192.168.2.4
Jul 18, 2024 22:59:12.803164005 CEST	49791	443	192.168.2.4	35.227.223.56
Jul 18, 2024 22:59:12.803209066 CEST	443	49791	35.227.223.56	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 18, 2024 22:57:12.122569084 CEST	58368	53	192.168.2.4	1.1.1.1
Jul 18, 2024 22:57:12.729069948 CEST	53	58368	1.1.1.1	192.168.2.4
Jul 18, 2024 22:57:12.732191086 CEST	55367	53	192.168.2.4	1.1.1.1
Jul 18, 2024 22:57:12.993700981 CEST	53	55367	1.1.1.1	192.168.2.4
Jul 18, 2024 22:57:13.972997904 CEST	59728	8000	192.168.2.4	103.7.30.61
Jul 18, 2024 22:57:14.367027044 CEST	52673	53	192.168.2.4	1.1.1.1
Jul 18, 2024 22:57:14.367248058 CEST	59528	53	192.168.2.4	1.1.1.1
Jul 18, 2024 22:57:14.374957085 CEST	53	52673	1.1.1.1	192.168.2.4
Jul 18, 2024 22:57:14.375193119 CEST	53	59528	1.1.1.1	192.168.2.4
Jul 18, 2024 22:57:14.831830025 CEST	54816	53	192.168.2.4	1.1.1.1
Jul 18, 2024 22:57:14.994512081 CEST	53	54816	1.1.1.1	192.168.2.4
Jul 18, 2024 22:57:16.843118906 CEST	62332	53	192.168.2.4	1.1.1.1
Jul 18, 2024 22:57:16.843341112 CEST	57429	53	192.168.2.4	1.1.1.1
Jul 18, 2024 22:57:16.843817949 CEST	57771	53	192.168.2.4	1.1.1.1
Jul 18, 2024 22:57:16.843955040 CEST	51114	53	192.168.2.4	1.1.1.1
Jul 18, 2024 22:57:16.850263119 CEST	53	62332	1.1.1.1	192.168.2.4
Jul 18, 2024 22:57:16.850298882 CEST	53	57429	1.1.1.1	192.168.2.4
Jul 18, 2024 22:57:16.850681067 CEST	53	51114	1.1.1.1	192.168.2.4
Jul 18, 2024 22:57:16.851717949 CEST	53	57771	1.1.1.1	192.168.2.4
Jul 18, 2024 22:57:16.900005102 CEST	55443	53	192.168.2.4	1.1.1.1
Jul 18, 2024 22:57:16.900316000 CEST	51826	53	192.168.2.4	1.1.1.1
Jul 18, 2024 22:57:16.907383919 CEST	53	51826	1.1.1.1	192.168.2.4
Jul 18, 2024 22:57:16.908361912 CEST	53	55443	1.1.1.1	192.168.2.4
Jul 18, 2024 22:57:18.961889029 CEST	49885	443	192.168.2.4	162.159.61.3
Jul 18, 2024 22:57:19.264466047 CEST	49885	443	192.168.2.4	162.159.61.3
Jul 18, 2024 22:57:19.462930918 CEST	443	49885	162.159.61.3	192.168.2.4
Jul 18, 2024 22:57:19.463046074 CEST	443	49885	162.159.61.3	192.168.2.4
Jul 18, 2024 22:57:19.463180065 CEST	443	49885	162.159.61.3	192.168.2.4
Jul 18, 2024 22:57:19.463887930 CEST	443	49885	162.159.61.3	192.168.2.4
Jul 18, 2024 22:57:19.464133978 CEST	49885	443	192.168.2.4	162.159.61.3
Jul 18, 2024 22:57:19.464447021 CEST	443	49885	162.159.61.3	192.168.2.4
Jul 18, 2024 22:57:19.467289925 CEST	49885	443	192.168.2.4	162.159.61.3
Jul 18, 2024 22:57:19.467813969 CEST	49885	443	192.168.2.4	162.159.61.3
Jul 18, 2024 22:57:19.467989922 CEST	49885	443	192.168.2.4	162.159.61.3
Jul 18, 2024 22:57:19.468511105 CEST	49885	443	192.168.2.4	162.159.61.3
Jul 18, 2024 22:57:19.468677998 CEST	49885	443	192.168.2.4	162.159.61.3
Jul 18, 2024 22:57:19.566179037 CEST	443	49885	162.159.61.3	192.168.2.4
Jul 18, 2024 22:57:19.566267014 CEST	443	49885	162.159.61.3	192.168.2.4
Jul 18, 2024 22:57:19.566298008 CEST	443	49885	162.159.61.3	192.168.2.4
Jul 18, 2024 22:57:19.566325903 CEST	443	49885	162.159.61.3	192.168.2.4
Jul 18, 2024 22:57:19.566817999 CEST	49885	443	192.168.2.4	162.159.61.3
Jul 18, 2024 22:57:19.566916943 CEST	49885	443	192.168.2.4	162.159.61.3
Jul 18, 2024 22:57:19.567007065 CEST	443	49885	162.159.61.3	192.168.2.4
Jul 18, 2024 22:57:19.567706108 CEST	443	49885	162.159.61.3	192.168.2.4
Jul 18, 2024 22:57:19.568422079 CEST	443	49885	162.159.61.3	192.168.2.4
Jul 18, 2024 22:57:19.568773031 CEST	49885	443	192.168.2.4	162.159.61.3
Jul 18, 2024 22:57:19.663289070 CEST	443	49885	162.159.61.3	192.168.2.4
Jul 18, 2024 22:57:19.701798916 CEST	49885	443	192.168.2.4	162.159.61.3
Jul 18, 2024 22:57:32.634438038 CEST	49885	443	192.168.2.4	162.159.61.3
Jul 18, 2024 22:57:32.634680033 CEST	49885	443	192.168.2.4	162.159.61.3
Jul 18, 2024 22:57:32.733066082 CEST	443	49885	162.159.61.3	192.168.2.4
Jul 18, 2024 22:57:32.738368988 CEST	443	49885	162.159.61.3	192.168.2.4
Jul 18, 2024 22:57:32.757021904 CEST	443	49885	162.159.61.3	192.168.2.4
Jul 18, 2024 22:57:32.757505894 CEST	49885	443	192.168.2.4	162.159.61.3
Jul 18, 2024 22:57:33.759655952 CEST	49885	443	192.168.2.4	162.159.61.3
Jul 18, 2024 22:57:33.760202885 CEST	49885	443	192.168.2.4	162.159.61.3
Jul 18, 2024 22:57:33.761070967 CEST	59609	443	192.168.2.4	162.159.61.3
Jul 18, 2024 22:57:33.857827902 CEST	443	49885	162.159.61.3	192.168.2.4
Jul 18, 2024 22:57:33.859461069 CEST	443	49885	162.159.61.3	192.168.2.4
Jul 18, 2024 22:57:33.859581947 CEST	443	49885	162.159.61.3	192.168.2.4
Jul 18, 2024 22:57:33.859764099 CEST	443	49885	162.159.61.3	192.168.2.4
Jul 18, 2024 22:57:33.860099077 CEST	49885	443	192.168.2.4	162.159.61.3
Jul 18, 2024 22:57:34.077667952 CEST	59609	443	192.168.2.4	162.159.61.3
Jul 18, 2024 22:57:34.218126059 CEST	443	59609	162.159.61.3	192.168.2.4
Jul 18, 2024 22:57:34.218164921 CEST	443	59609	162.159.61.3	192.168.2.4
Jul 18, 2024 22:57:34.219230890 CEST	443	59609	162.159.61.3	192.168.2.4
Jul 18, 2024 22:57:34.219265938 CEST	443	59609	162.159.61.3	192.168.2.4
Jul 18, 2024 22:57:34.219302893 CEST	443	59609	162.159.61.3	192.168.2.4
Jul 18, 2024 22:57:34.219456911 CEST	59609	443	192.168.2.4	162.159.61.3
Jul 18, 2024 22:57:34.219527006 CEST	59609	443	192.168.2.4	162.159.61.3
Jul 18, 2024 22:57:34.222048044 CEST	59609	443	192.168.2.4	162.159.61.3
Jul 18, 2024 22:57:34.222196102 CEST	59609	443	192.168.2.4	162.159.61.3
Jul 18, 2024 22:57:34.222507000 CEST	59609	443	192.168.2.4	162.159.61.3
Jul 18, 2024 22:57:34.222701073 CEST	59609	443	192.168.2.4	162.159.61.3
Jul 18, 2024 22:57:34.324970961 CEST	443	59609	162.159.61.3	192.168.2.4
Jul 18, 2024 22:57:34.325016975 CEST	443	59609	162.159.61.3	192.168.2.4
Jul 18, 2024 22:57:34.325462103 CEST	443	59609	162.159.61.3	192.168.2.4
Jul 18, 2024 22:57:34.325474977 CEST	443	59609	162.159.61.3	192.168.2.4
Jul 18, 2024 22:57:34.325598955 CEST	59609	443	192.168.2.4	162.159.61.3
Jul 18, 2024 22:57:34.325695038 CEST	59609	443	192.168.2.4	162.159.61.3
Jul 18, 2024 22:57:34.326172113 CEST	443	59609	162.159.61.3	192.168.2.4
Jul 18, 2024 22:57:34.326514959 CEST	443	59609	162.159.61.3	192.168.2.4
Jul 18, 2024 22:57:34.326719999 CEST	59609	443	192.168.2.4	162.159.61.3
Jul 18, 2024 22:57:34.422760963 CEST	443	59609	162.159.61.3	192.168.2.4
Jul 18, 2024 22:57:34.453962088 CEST	59609	443	192.168.2.4	162.159.61.3
Jul 18, 2024 22:57:36.531887054 CEST	59474	8000	192.168.2.4	103.7.30.83
Jul 18, 2024 22:57:43.030553102 CEST	63420	53	192.168.2.4	1.1.1.1
Jul 18, 2024 22:57:45.801223993 CEST	59754	53	192.168.2.4	1.1.1.1
Jul 18, 2024 22:57:45.842638969 CEST	53	59754	1.1.1.1	192.168.2.4
Jul 18, 2024 22:57:47.307521105 CEST	58451	53	192.168.2.4	1.1.1.1
Jul 18, 2024 22:57:47.307949066 CEST	57894	53	192.168.2.4	1.1.1.1
Jul 18, 2024 22:57:47.313497066 CEST	60021	53	192.168.2.4	1.1.1.1
Jul 18, 2024 22:57:47.314783096 CEST	53	58451	1.1.1.1	192.168.2.4
Jul 18, 2024 22:57:47.315726042 CEST	53	57894	1.1.1.1	192.168.2.4
Jul 18, 2024 22:57:47.321775913 CEST	53	60021	1.1.1.1	192.168.2.4
Jul 18, 2024 22:57:47.839534044 CEST	60023	53	192.168.2.4	8.8.8.8
Jul 18, 2024 22:57:47.839867115 CEST	54761	53	192.168.2.4	1.1.1.1
Jul 18, 2024 22:57:47.842751026 CEST	60024	53	192.168.2.4	8.8.8.8
Jul 18, 2024 22:57:47.848001003 CEST	53	54761	1.1.1.1	192.168.2.4
Jul 18, 2024 22:57:47.859025955 CEST	54762	53	192.168.2.4	8.8.8.8
Jul 18, 2024 22:57:48.035912037 CEST	54763	443	192.168.2.4	23.98.101.155
Jul 18, 2024 22:57:48.078005075 CEST	53	60024	8.8.8.8	192.168.2.4
Jul 18, 2024 22:57:48.096014977 CEST	53	54762	8.8.8.8	192.168.2.4
Jul 18, 2024 22:57:48.145606995 CEST	53	60023	8.8.8.8	192.168.2.4
Jul 18, 2024 22:57:48.270456076 CEST	61527	53	192.168.2.4	1.1.1.1
Jul 18, 2024 22:57:49.470283031 CEST	61528	443	192.168.2.4	183.60.146.66
Jul 18, 2024 22:57:50.891899109 CEST	57335	443	192.168.2.4	35.227.223.56
Jul 18, 2024 22:57:52.157469034 CEST	57336	443	192.168.2.4	23.98.101.155
Jul 18, 2024 22:57:53.633419991 CEST	57337	443	192.168.2.4	23.98.101.155
Jul 18, 2024 22:57:54.944839954 CEST	57338	443	192.168.2.4	23.98.101.155
Jul 18, 2024 22:57:56.216576099 CEST	57339	443	192.168.2.4	23.98.101.155
Jul 18, 2024 22:57:57.498002052 CEST	57340	443	192.168.2.4	183.60.146.66
Jul 18, 2024 22:57:58.826363087 CEST	57341	443	192.168.2.4	183.60.146.66
Jul 18, 2024 22:58:00.110742092 CEST	57342	443	192.168.2.4	183.60.146.66
Jul 18, 2024 22:58:01.522526979 CEST	57343	443	192.168.2.4	183.60.146.66
Jul 18, 2024 22:58:02.943325043 CEST	57344	443	192.168.2.4	35.227.223.56
Jul 18, 2024 22:58:03.148869038 CEST	55984	53	192.168.2.4	1.1.1.1
Jul 18, 2024 22:58:04.185846090 CEST	55985	443	192.168.2.4	35.227.223.56
Jul 18, 2024 22:58:06.273314953 CEST	55986	443	192.168.2.4	35.227.223.56
Jul 18, 2024 22:58:07.318085909 CEST	55987	443	192.168.2.4	35.227.223.56
Jul 18, 2024 22:58:08.318795919 CEST	55988	53	192.168.2.4	8.8.8.8
Jul 18, 2024 22:58:08.319052935 CEST	57093	53	192.168.2.4	1.1.1.1
Jul 18, 2024 22:58:08.331227064 CEST	53	57093	1.1.1.1	192.168.2.4
Jul 18, 2024 22:58:08.554013968 CEST	53	55988	8.8.8.8	192.168.2.4
Jul 18, 2024 22:58:25.808140993 CEST	57501	53	192.168.2.4	1.1.1.1
Jul 18, 2024 22:58:25.821979046 CEST	53	57501	1.1.1.1	192.168.2.4
Jul 18, 2024 22:59:15.909946918 CEST	53491	53	192.168.2.4	1.1.1.1
Jul 18, 2024 23:00:07.794265032 CEST	65191	53	192.168.2.4	1.1.1.1

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Jul 18, 2024 22:57:15.539145947 CEST	192.168.2.4	1.1.1.1	c2b9	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jul 18, 2024 22:57:12.122569084 CEST	192.168.2.4	1.1.1.1	0xcbe0	Standard query (0)	ied-tqos.wegamex.com.hk	A (IP address)	IN (0x0001)	false
Jul 18, 2024 22:57:12.732191086 CEST	192.168.2.4	1.1.1.1	0x1576	Standard query (0)	tqos.wegamex.com.hk	A (IP address)	IN (0x0001)	false
Jul 18, 2024 22:57:14.367027044 CEST	192.168.2.4	1.1.1.1	0x42b7	Standard query (0)	clients2.googleusercontent.com	A (IP address)	IN (0x0001)	false
Jul 18, 2024 22:57:14.367248058 CEST	192.168.2.4	1.1.1.1	0xa07	Standard query (0)	clients2.googleusercontent.com	65	IN (0x0001)	false
Jul 18, 2024 22:57:14.831830025 CEST	192.168.2.4	1.1.1.1	0x779d	Standard query (0)	tqos.wegamex.com.hk	A (IP address)	IN (0x0001)	false
Jul 18, 2024 22:57:16.843118906 CEST	192.168.2.4	1.1.1.1	0x2429	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Jul 18, 2024 22:57:16.843341112 CEST	192.168.2.4	1.1.1.1	0x4dd6	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Jul 18, 2024 22:57:16.843817949 CEST	192.168.2.4	1.1.1.1	0x11e3	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Jul 18, 2024 22:57:16.843955040 CEST	192.168.2.4	1.1.1.1	0x9374	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Jul 18, 2024 22:57:16.900005102 CEST	192.168.2.4	1.1.1.1	0x7688	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Jul 18, 2024 22:57:16.900316000 CEST	192.168.2.4	1.1.1.1	0xf985	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Jul 18, 2024 22:57:43.030553102 CEST	192.168.2.4	1.1.1.1	0xc473	Standard query (0)	crt.sectigo.com	A (IP address)	IN (0x0001)	false
Jul 18, 2024 22:57:45.801223993 CEST	192.168.2.4	1.1.1.1	0x645d	Standard query (0)	ws-ap1.pusher.com	A (IP address)	IN (0x0001)	false
Jul 18, 2024 22:57:47.307521105 CEST	192.168.2.4	1.1.1.1	0xedaa	Standard query (0)	www.baidu.com	A (IP address)	IN (0x0001)	false
Jul 18, 2024 22:57:47.307949066 CEST	192.168.2.4	1.1.1.1	0x3a58	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Jul 18, 2024 22:57:47.313497066 CEST	192.168.2.4	1.1.1.1	0xc2a5	Standard query (0)	www.yandex.com	A (IP address)	IN (0x0001)	false
Jul 18, 2024 22:57:47.839534044 CEST	192.168.2.4	8.8.8.8	0x3a5c	Standard query (0)	nal.fqoqehwib.com	A (IP address)	IN (0x0001)	false
Jul 18, 2024 22:57:47.839867115 CEST	192.168.2.4	1.1.1.1	0x6d60	Standard query (0)	d1dmgcawtbm6l9.cloudfront.net	A (IP address)	IN (0x0001)	false
Jul 18, 2024 22:57:47.842751026 CEST	192.168.2.4	8.8.8.8	0x641b	Standard query (0)	chr.alipayassets.com	A (IP address)	IN (0x0001)	false
Jul 18, 2024 22:57:47.859025955 CEST	192.168.2.4	8.8.8.8	0xf281	Standard query (0)	nit.crash1ytics.com	A (IP address)	IN (0x0001)	false
Jul 18, 2024 22:57:48.270456076 CEST	192.168.2.4	1.1.1.1	0x4545	Standard query (0)	in.appcenter.ms	A (IP address)	IN (0x0001)	false
Jul 18, 2024 22:58:03.148869038 CEST	192.168.2.4	1.1.1.1	0xecb6	Standard query (0)	in.appcenter.ms	A (IP address)	IN (0x0001)	false
Jul 18, 2024 22:58:08.318795919 CEST	192.168.2.4	8.8.8.8	0xeb35	Standard query (0)	nit.crash1ytics.com	A (IP address)	IN (0x0001)	false
Jul 18, 2024 22:58:08.319052935 CEST	192.168.2.4	1.1.1.1	0x56	Standard query (0)	d1dmgcawtbm6l9.cloudfront.net	A (IP address)	IN (0x0001)	false
Jul 18, 2024 22:58:25.808140993 CEST	192.168.2.4	1.1.1.1	0x342f	Standard query (0)	d1dmgcawtbm6l9.cloudfront.net	A (IP address)	IN (0x0001)	false
Jul 18, 2024 22:59:15.909946918 CEST	192.168.2.4	1.1.1.1	0xd178	Standard query (0)	in.appcenter.ms	A (IP address)	IN (0x0001)	false
Jul 18, 2024 23:00:07.794265032 CEST	192.168.2.4	1.1.1.1	0xa076	Standard query (0)	in.appcenter.ms	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jul 18, 2024 22:57:12.729069948 CEST	1.1.1.1	192.168.2.4	0xcbe0	No error (0)	ied-tqos.wegamex.com.hk		103.7.30.61	A (IP address)	IN (0x0001)	false
Jul 18, 2024 22:57:12.993700981 CEST	1.1.1.1	192.168.2.4	0x1576	No error (0)	tqos.wegamex.com.hk		103.7.30.83	A (IP address)	IN (0x0001)	false
Jul 18, 2024 22:57:14.374957085 CEST	1.1.1.1	192.168.2.4	0x42b7	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 18, 2024 22:57:14.374957085 CEST	1.1.1.1	192.168.2.4	0x42b7	No error (0)	googlehosted.l.googleusercontent.com		142.250.186.129	A (IP address)	IN (0x0001)	false
Jul 18, 2024 22:57:14.375193119 CEST	1.1.1.1	192.168.2.4	0xa07	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 18, 2024 22:57:14.994512081 CEST	1.1.1.1	192.168.2.4	0x779d	No error (0)	tqos.wegamex.com.hk		103.7.30.83	A (IP address)	IN (0x0001)	false
Jul 18, 2024 22:57:15.524110079 CEST	1.1.1.1	192.168.2.4	0xb60a	No error (0)	shed.dual-low.s-part-0032.t-0009.t-msedge.net	s-part-0032.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 18, 2024 22:57:15.524110079 CEST	1.1.1.1	192.168.2.4	0xb60a	No error (0)	s-part-0032.t-0009.t-msedge.net		13.107.246.60	A (IP address)	IN (0x0001)	false
Jul 18, 2024 22:57:15.636862040 CEST	1.1.1.1	192.168.2.4	0x3a37	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 18, 2024 22:57:15.637530088 CEST	1.1.1.1	192.168.2.4	0x4977	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 18, 2024 22:57:15.637530088 CEST	1.1.1.1	192.168.2.4	0x4977	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Jul 18, 2024 22:57:16.658274889 CEST	1.1.1.1	192.168.2.4	0x1ef9	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 18, 2024 22:57:16.658397913 CEST	1.1.1.1	192.168.2.4	0x11ae	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 18, 2024 22:57:16.658397913 CEST	1.1.1.1	192.168.2.4	0x11ae	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Jul 18, 2024 22:57:16.850263119 CEST	1.1.1.1	192.168.2.4	0x2429	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Jul 18, 2024 22:57:16.850263119 CEST	1.1.1.1	192.168.2.4	0x2429	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Jul 18, 2024 22:57:16.850298882 CEST	1.1.1.1	192.168.2.4	0x4dd6	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Jul 18, 2024 22:57:16.850681067 CEST	1.1.1.1	192.168.2.4	0x9374	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Jul 18, 2024 22:57:16.851717949 CEST	1.1.1.1	192.168.2.4	0x11e3	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Jul 18, 2024 22:57:16.851717949 CEST	1.1.1.1	192.168.2.4	0x11e3	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Jul 18, 2024 22:57:16.907383919 CEST	1.1.1.1	192.168.2.4	0xf985	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Jul 18, 2024 22:57:16.908361912 CEST	1.1.1.1	192.168.2.4	0x7688	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Jul 18, 2024 22:57:16.908361912 CEST	1.1.1.1	192.168.2.4	0x7688	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Jul 18, 2024 22:57:18.678456068 CEST	1.1.1.1	192.168.2.4	0xe61e	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 18, 2024 22:57:18.678456068 CEST	1.1.1.1	192.168.2.4	0xe61e	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Jul 18, 2024 22:57:19.693850040 CEST	1.1.1.1	192.168.2.4	0xe61e	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 18, 2024 22:57:19.693850040 CEST	1.1.1.1	192.168.2.4	0xe61e	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Jul 18, 2024 22:57:20.724427938 CEST	1.1.1.1	192.168.2.4	0xe61e	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 18, 2024 22:57:20.724427938 CEST	1.1.1.1	192.168.2.4	0xe61e	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Jul 18, 2024 22:57:22.733129025 CEST	1.1.1.1	192.168.2.4	0xe61e	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 18, 2024 22:57:22.733129025 CEST	1.1.1.1	192.168.2.4	0xe61e	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Jul 18, 2024 22:57:26.727200031 CEST	1.1.1.1	192.168.2.4	0xe61e	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 18, 2024 22:57:26.727200031 CEST	1.1.1.1	192.168.2.4	0xe61e	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Jul 18, 2024 22:57:43.038465977 CEST	1.1.1.1	192.168.2.4	0xc473	No error (0)	crt.sectigo.com	crt.comodoca.com.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 18, 2024 22:57:45.842638969 CEST	1.1.1.1	192.168.2.4	0x645d	No error (0)	ws-ap1.pusher.com	socket-ap1-ingress-1471706552.ap-southeast-1.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 18, 2024 22:57:45.842638969 CEST	1.1.1.1	192.168.2.4	0x645d	No error (0)	socket-ap1-ingress-1471706552.ap-southeast-1.elb.amazonaws.com		54.169.168.67	A (IP address)	IN (0x0001)	false
Jul 18, 2024 22:57:45.842638969 CEST	1.1.1.1	192.168.2.4	0x645d	No error (0)	socket-ap1-ingress-1471706552.ap-southeast-1.elb.amazonaws.com		54.169.173.39	A (IP address)	IN (0x0001)	false
Jul 18, 2024 22:57:45.842638969 CEST	1.1.1.1	192.168.2.4	0x645d	No error (0)	socket-ap1-ingress-1471706552.ap-southeast-1.elb.amazonaws.com		52.220.169.49	A (IP address)	IN (0x0001)	false
Jul 18, 2024 22:57:47.314783096 CEST	1.1.1.1	192.168.2.4	0xedaa	No error (0)	www.baidu.com	www.a.shifen.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 18, 2024 22:57:47.314783096 CEST	1.1.1.1	192.168.2.4	0xedaa	No error (0)	www.a.shifen.com	www.wshifen.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 18, 2024 22:57:47.314783096 CEST	1.1.1.1	192.168.2.4	0xedaa	No error (0)	www.wshifen.com		103.235.46.96	A (IP address)	IN (0x0001)	false
Jul 18, 2024 22:57:47.314783096 CEST	1.1.1.1	192.168.2.4	0xedaa	No error (0)	www.wshifen.com		103.235.47.188	A (IP address)	IN (0x0001)	false
Jul 18, 2024 22:57:47.315726042 CEST	1.1.1.1	192.168.2.4	0x3a58	No error (0)	www.google.com		142.250.186.164	A (IP address)	IN (0x0001)	false
Jul 18, 2024 22:57:47.321775913 CEST	1.1.1.1	192.168.2.4	0xc2a5	No error (0)	www.yandex.com	yandex.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 18, 2024 22:57:47.321775913 CEST	1.1.1.1	192.168.2.4	0xc2a5	No error (0)	yandex.com		77.88.55.88	A (IP address)	IN (0x0001)	false
Jul 18, 2024 22:57:47.321775913 CEST	1.1.1.1	192.168.2.4	0xc2a5	No error (0)	yandex.com		5.255.255.77	A (IP address)	IN (0x0001)	false
Jul 18, 2024 22:57:47.321775913 CEST	1.1.1.1	192.168.2.4	0xc2a5	No error (0)	yandex.com		77.88.44.55	A (IP address)	IN (0x0001)	false
Jul 18, 2024 22:57:47.848001003 CEST	1.1.1.1	192.168.2.4	0x6d60	No error (0)	d1dmgcawtbm6l9.cloudfront.net		3.164.160.102	A (IP address)	IN (0x0001)	false
Jul 18, 2024 22:57:47.848001003 CEST	1.1.1.1	192.168.2.4	0x6d60	No error (0)	d1dmgcawtbm6l9.cloudfront.net		3.164.160.66	A (IP address)	IN (0x0001)	false
Jul 18, 2024 22:57:47.848001003 CEST	1.1.1.1	192.168.2.4	0x6d60	No error (0)	d1dmgcawtbm6l9.cloudfront.net		3.164.160.24	A (IP address)	IN (0x0001)	false
Jul 18, 2024 22:57:47.848001003 CEST	1.1.1.1	192.168.2.4	0x6d60	No error (0)	d1dmgcawtbm6l9.cloudfront.net		3.164.160.138	A (IP address)	IN (0x0001)	false
Jul 18, 2024 22:57:48.078005075 CEST	8.8.8.8	192.168.2.4	0x641b	No error (0)	chr.alipayassets.com		85.222.79.57	A (IP address)	IN (0x0001)	false
Jul 18, 2024 22:57:48.078005075 CEST	8.8.8.8	192.168.2.4	0x641b	No error (0)	chr.alipayassets.com		12.206.118.229	A (IP address)	IN (0x0001)	false
Jul 18, 2024 22:57:48.078005075 CEST	8.8.8.8	192.168.2.4	0x641b	No error (0)	chr.alipayassets.com		222.91.58.119	A (IP address)	IN (0x0001)	false
Jul 18, 2024 22:57:48.096014977 CEST	8.8.8.8	192.168.2.4	0xf281	No error (0)	nit.crash1ytics.com		142.242.204.31	A (IP address)	IN (0x0001)	false
Jul 18, 2024 22:57:48.096014977 CEST	8.8.8.8	192.168.2.4	0xf281	No error (0)	nit.crash1ytics.com		223.61.70.52	A (IP address)	IN (0x0001)	false
Jul 18, 2024 22:57:48.096014977 CEST	8.8.8.8	192.168.2.4	0xf281	No error (0)	nit.crash1ytics.com		19.88.16.251	A (IP address)	IN (0x0001)	false
Jul 18, 2024 22:57:48.096014977 CEST	8.8.8.8	192.168.2.4	0xf281	No error (0)	nit.crash1ytics.com		67.137.174.254	A (IP address)	IN (0x0001)	false
Jul 18, 2024 22:57:48.145606995 CEST	8.8.8.8	192.168.2.4	0x3a5c	No error (0)	nal.fqoqehwib.com		104.112.172.245	A (IP address)	IN (0x0001)	false
Jul 18, 2024 22:57:48.145606995 CEST	8.8.8.8	192.168.2.4	0x3a5c	No error (0)	nal.fqoqehwib.com		10.176.38.125	A (IP address)	IN (0x0001)	false
Jul 18, 2024 22:57:48.145606995 CEST	8.8.8.8	192.168.2.4	0x3a5c	No error (0)	nal.fqoqehwib.com		33.86.72.19	A (IP address)	IN (0x0001)	false
Jul 18, 2024 22:57:48.145606995 CEST	8.8.8.8	192.168.2.4	0x3a5c	No error (0)	nal.fqoqehwib.com		99.34.124.121	A (IP address)	IN (0x0001)	false
Jul 18, 2024 22:57:48.145606995 CEST	8.8.8.8	192.168.2.4	0x3a5c	No error (0)	nal.fqoqehwib.com		5.217.108.181	A (IP address)	IN (0x0001)	false
Jul 18, 2024 22:57:48.278223991 CEST	1.1.1.1	192.168.2.4	0x4545	No error (0)	in.appcenter.ms	in-prod-pme-eastus2-ingestion-66ddb56a.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 18, 2024 22:58:03.158303976 CEST	1.1.1.1	192.168.2.4	0xecb6	No error (0)	in.appcenter.ms	in-prod-pme-eastus2-ingestion-66ddb56a.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 18, 2024 22:58:08.331227064 CEST	1.1.1.1	192.168.2.4	0x56	No error (0)	d1dmgcawtbm6l9.cloudfront.net		108.138.24.13	A (IP address)	IN (0x0001)	false
Jul 18, 2024 22:58:08.331227064 CEST	1.1.1.1	192.168.2.4	0x56	No error (0)	d1dmgcawtbm6l9.cloudfront.net		108.138.24.115	A (IP address)	IN (0x0001)	false
Jul 18, 2024 22:58:08.331227064 CEST	1.1.1.1	192.168.2.4	0x56	No error (0)	d1dmgcawtbm6l9.cloudfront.net		108.138.24.182	A (IP address)	IN (0x0001)	false
Jul 18, 2024 22:58:08.331227064 CEST	1.1.1.1	192.168.2.4	0x56	No error (0)	d1dmgcawtbm6l9.cloudfront.net		108.138.24.227	A (IP address)	IN (0x0001)	false
Jul 18, 2024 22:58:08.554013968 CEST	8.8.8.8	192.168.2.4	0xeb35	No error (0)	nit.crash1ytics.com		223.61.70.52	A (IP address)	IN (0x0001)	false
Jul 18, 2024 22:58:08.554013968 CEST	8.8.8.8	192.168.2.4	0xeb35	No error (0)	nit.crash1ytics.com		19.88.16.251	A (IP address)	IN (0x0001)	false
Jul 18, 2024 22:58:08.554013968 CEST	8.8.8.8	192.168.2.4	0xeb35	No error (0)	nit.crash1ytics.com		142.242.204.31	A (IP address)	IN (0x0001)	false
Jul 18, 2024 22:58:08.554013968 CEST	8.8.8.8	192.168.2.4	0xeb35	No error (0)	nit.crash1ytics.com		67.137.174.254	A (IP address)	IN (0x0001)	false
Jul 18, 2024 22:58:25.821979046 CEST	1.1.1.1	192.168.2.4	0x342f	No error (0)	d1dmgcawtbm6l9.cloudfront.net		108.138.24.182	A (IP address)	IN (0x0001)	false
Jul 18, 2024 22:58:25.821979046 CEST	1.1.1.1	192.168.2.4	0x342f	No error (0)	d1dmgcawtbm6l9.cloudfront.net		108.138.24.13	A (IP address)	IN (0x0001)	false
Jul 18, 2024 22:58:25.821979046 CEST	1.1.1.1	192.168.2.4	0x342f	No error (0)	d1dmgcawtbm6l9.cloudfront.net		108.138.24.227	A (IP address)	IN (0x0001)	false
Jul 18, 2024 22:58:25.821979046 CEST	1.1.1.1	192.168.2.4	0x342f	No error (0)	d1dmgcawtbm6l9.cloudfront.net		108.138.24.115	A (IP address)	IN (0x0001)	false
Jul 18, 2024 22:59:15.918083906 CEST	1.1.1.1	192.168.2.4	0xd178	No error (0)	in.appcenter.ms	in-prod-pme-eastus2-ingestion-66ddb56a.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 18, 2024 23:00:07.804301977 CEST	1.1.1.1	192.168.2.4	0xa076	No error (0)	in.appcenter.ms	in-prod-pme-eastus2-ingestion-66ddb56a.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

clients2.googleusercontent.com

edgeassetservice.azureedge.net

chrome.cloudflare-dns.com

www.googleapis.com

msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com

d1dmgcawtbm6l9.cloudfront.net

tqos.wegamex.com.hk

ws-ap1.pusher.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49740	103.7.30.83	80	7800	C:\Program Files (x86)\Common Files\wegame.exe

Timestamp	Bytes transferred	Direction	Data
Jul 18, 2024 22:57:15.250777960 CEST	166	OUT	POST / HTTP/1.1 Host: tqos.wegamex.com.hk Accept: / Content-Length: 689 Content-Type: multipart/form-data; boundary=------------------------15ced2856b975cac
Jul 18, 2024 22:57:15.250866890 CEST	689	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 31 35 63 65 64 32 38 35 36 62 39 37 35 63 61 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 Data Ascii: --------------------------15ced2856b975cacContent-Disposition: form-data; name="tqos"tqos={"Body":{"QOSRep":{"BusinessID":1,"Flag":1,"QosList":[{"AppendDesc":{"Comm":{"IntList":[0,0,-856844160,1484,2905,-1,0,0,0,0,0,0],"IntNum":12,"StrLi

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49764	54.169.168.67	80	8464	C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe

Timestamp	Bytes transferred	Direction	Data
Jul 18, 2024 22:57:45.871335030 CEST	265	OUT	GET /app/4fc436ef36f4026102d7?protocol=5&client=pusher-dotnet-client&version=1.1.2 HTTP/1.1 Host: ws-ap1.pusher.com Upgrade: websocket Connection: Upgrade Sec-WebSocket-Version: 13 Sec-WebSocket-Key: NmRhMTFjMTgtMjY0OC00OQ== Origin: ws://ws-ap1.pusher.com
Jul 18, 2024 22:57:46.768934011 CEST	166	IN	HTTP/1.1 101 Switching Protocols Date: Thu, 18 Jul 2024 20:57:46 GMT Connection: upgrade Upgrade: websocket Sec-WebSocket-Accept: xRIXWW4XTl1JhIKyqxOe5sPS9wE=
Jul 18, 2024 22:57:46.977545023 CEST	166	IN	HTTP/1.1 101 Switching Protocols Date: Thu, 18 Jul 2024 20:57:46 GMT Connection: upgrade Upgrade: websocket Sec-WebSocket-Accept: xRIXWW4XTl1JhIKyqxOe5sPS9wE=
Jul 18, 2024 22:57:47.469232082 CEST	242	IN	Data Raw: 81 7e 00 92 7b 22 65 76 65 6e 74 22 3a 22 70 75 73 68 65 72 3a 65 72 72 6f 72 22 2c 22 64 61 74 61 22 3a 7b 22 63 6f 64 65 22 3a 34 30 30 31 2c 22 6d 65 73 73 61 67 65 22 3a 22 41 70 70 20 6b 65 79 20 34 66 63 34 33 36 65 66 33 36 66 34 30 32 36 Data Ascii: ~{"event":"pusher:error","data":{"code":4001,"message":"App key 4fc436ef36f4026102d7 not in this cluster. Did you forget to specify the cluster?"}}ZApp key 4fc436ef36f4026102d7 not in this cluster. Did you forget to specify the cluster?
Jul 18, 2024 22:57:47.784744978 CEST	8	OUT	Data Raw: 88 82 19 b6 01 6e 1a 5e Data Ascii: n^

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49737	142.250.186.129	443	7316	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-18 20:57:15 UTC	594	OUT	GET /crx/blobs/Af2yII2B0rZ8cHZ0zhAQMpE5nnHa-luPaKnkV2HzRYHJSUKQp47BzdeiX0Igp7uG9ixLd9f-dn93AlqvBwPDqfl_F5H1vnj2K-nXA2wr_RToPGmP3S9lmWq3G-LCKHiOc8oAxlKa5TcGVwrsFgTq79yNDjEULjiD5Cwy/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_79_1_0.crx HTTP/1.1 Host: clients2.googleusercontent.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-07-18 20:57:15 UTC	571	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Length: 105751 X-GUploader-UploadID: ACJd0Nqnc5nOjVvdizvsjHOd24E6OcXUPfZIKfHPtJKyXQt7emlhz-8N8Crz0lh7pA1aMKf5nus7a79kAw X-Goog-Hash: crc32c=+iMxGQ== Server: UploadServer Date: Thu, 18 Jul 2024 20:53:17 GMT Expires: Fri, 18 Jul 2025 20:53:17 GMT Cache-Control: public, max-age=31536000 Age: 238 Last-Modified: Tue, 16 Jul 2024 20:53:03 GMT ETag: d0ca9368_cfe1c52e_26a2b87e_8ea78d1b_1848b259 Content-Type: application/x-chrome-extension Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-07-18 20:57:15 UTC	819	IN	Data Raw: 43 72 32 34 03 00 00 00 38 16 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 9c 5e d1 18 b0 31 22 89 f4 fd 77 8d 67 83 0b 74 fd c3 32 4a 0e 47 31 00 29 58 34 b1 bf 3d 26 90 3f 5b 6a 2c 4c 7a fd d5 6a b0 75 cf 65 5b 49 85 71 2a 42 61 2f 58 dd ee dc 50 c1 68 fc cd 84 4c 04 88 b9 99 dc 32 25 33 5f 6f f4 ae b5 ad 19 0d d4 b8 48 f7 29 27 b9 3d d6 95 65 f8 ac c8 9c 3f 15 e6 ef 1f 08 ab 11 6a e1 a9 c8 33 55 48 fd 7c bf 58 8c 4d 06 e3 97 75 cc c2 9c 73 5b a6 2a f2 ea 3f 24 f3 9c db 8a 05 9f 46 25 11 1d 18 b4 49 08 19 94 80 29 08 f2 2c 2d c0 2f 90 65 35 29 a6 66 83 e7 4f e4 b2 71 14 5e ff 90 92 01 8d d3 bf ca a0 d0 39 a0 08 28 e3 d2 5f d5 70 68 32 fe 10 5e d5 59 42 50 58 66 5f 38 cc 0b 08 Data Ascii: Cr2480"0H0^1"wgt2JG1)X4=&?[j,Lzjue[IqBa/XPhL2%3_oH)'=e?j3UH\|XMus[*?$F%I),-/e5)fOq^9(_ph2^YBPXf_8
2024-07-18 20:57:15 UTC	1390	IN	Data Raw: bf fe f1 4b d6 d7 ea eb 3c 8c e7 4b ff eb ef bf c6 af ba 6e 8a 6b f3 1f 43 fd f5 1f ef 67 55 ff fa cf 5f d7 f3 47 5f cb df ab 4b 3f d6 fd f8 eb ef ff f8 35 14 0f 75 29 a4 79 7f fd 88 da d2 76 2d c1 5d 2b b3 9b a6 b2 1b 55 3d 0e 4f dc b9 9e 73 3d 7d e7 f6 f8 5e d9 ea 49 a4 87 27 b4 7f 71 d1 f9 7e 16 81 ea 45 86 ac 43 7b 39 9b f7 37 71 4b ed c3 cf bf 6b 75 15 59 7c 3e a9 f1 b7 43 ef 35 32 f8 38 9f ce 87 29 6e 3f 6e 55 e0 f6 3f ef a9 f4 f6 5b c2 ed 25 cf d0 e5 e7 f3 c2 46 5c 3c ac 89 f3 8f 47 da 8d 18 31 38 52 3d b6 22 40 ba d0 14 c8 99 1d 2a 10 21 04 c4 8e e8 e8 51 84 d1 a6 0e 84 2b 1e d1 f6 18 5e cf 55 00 ad 62 77 78 3a a8 ed b5 b4 51 53 06 6c 3e da 50 1f 6d a0 2a 07 35 c2 36 af f5 30 97 f6 e6 7c dc 45 8f d2 de fe 7b 9d 3f f7 16 4d 85 af 7a e6 34 fb 14 32 Data Ascii: K<KnkCgU_G_K?5u)yv-]+U=Os=}^I'q~EC{97qKkuY\|>C528)n?nU?[%F\<G18R="@!Q+^Ubwx:QSl>Pm560\|E{?Mz42
2024-07-18 20:57:15 UTC	1390	IN	Data Raw: 26 3f 65 c9 86 b5 91 c8 75 f7 40 b0 72 4d cd a2 45 f6 c6 fb af bc 3e ce 67 36 89 cc cc 7b 85 6d 64 59 0e 65 b0 90 3e 0a ca 3d 4c 8a 10 e1 58 f9 8e d4 cd 0e fb d0 68 40 84 ab 07 08 b1 25 bf 17 af df 1f d6 7a ee 0d 99 a3 31 ee 95 12 d6 e4 1d 29 ba c7 74 d4 54 c9 5d b9 97 7e ba 97 51 45 45 82 01 f6 aa de 68 34 35 7a c4 e8 14 87 cb 7b 5f fd 7f 68 70 d5 e2 21 b7 1a 25 43 f1 55 d8 2a 4b fd 78 24 a1 e7 27 ad e8 85 1d e5 58 9b 52 70 bc b3 f0 45 4e b5 78 ab 14 f4 b0 2d 37 cb bd 27 d7 f2 1f 8d cf dd e0 40 f8 68 6e 3a e9 47 36 01 50 a3 50 88 c2 1a 8e 64 36 1a 10 60 1e 87 2f 76 62 df ef 2c c4 49 4e f1 be d6 1f f7 45 fe ce da de 1b 7c a4 60 97 39 c3 ab 54 fe 7c 82 4d 47 00 a2 d8 69 22 93 31 52 d1 81 d9 64 1d 6a e6 41 90 58 e0 15 11 15 54 0e b4 cb 65 ef 77 29 56 b2 c7 Data Ascii: &?eu@rME>g6{mdYe>=LXh@%z1)tT]~QEEh45z{_hp!%CU*Kx$'XRpENx-7'@hn:G6PPd6`/vb,INE\|`9T\|MGi"1RdjAXTew)V
2024-07-18 20:57:15 UTC	1390	IN	Data Raw: ec 05 25 f2 48 b8 c9 51 9a b9 d8 89 76 b5 9e de 4e a9 f5 a8 42 f9 55 58 38 33 9e 6b 9f c2 01 16 b3 e8 84 36 b9 63 89 bd e3 35 6b 7d ce 89 6e 5c ca 23 2d f8 01 10 c0 3e 51 37 f8 82 bb 0d 6f 21 22 74 4c 70 e0 de 88 6e 14 f7 a1 9d 32 e4 d6 1a 7e 62 53 9b 4b ec ab 60 25 7b 35 d0 a2 85 a2 6a bd 73 c5 b7 47 42 b1 9d 38 78 23 b4 78 cd 89 f7 4d 8c eb c7 dd b6 41 7c fb 60 56 0e 48 f7 0c 52 a7 02 c5 fe 65 89 fd dd f0 dd d1 95 ba 53 85 fe 24 e0 87 23 ba c1 30 8f 7a b6 c7 63 aa d1 89 f8 46 87 68 77 ff 39 6f 24 c1 70 cd 1d f1 d3 7f 5d de 47 8f 38 38 3c fe 1f fc ad 0c 78 74 6d fd 33 b0 3d c8 cc b3 b8 3f be 26 d6 36 2c 15 e2 c9 cc ba 14 26 33 85 9d cb f9 f8 14 ef bd 3c 25 12 54 14 5d b0 1a 5a 31 c3 45 dd af f4 ca 99 ab b0 c9 af d1 2d 69 3f dc d8 77 fd c2 ac af 08 9a b4 Data Ascii: %HQvNBUX83k6c5k}n\#->Q7o!"tLpn2~bSK`%{5jsGB8x#xMA\|`VHReS$#0zcFhw9o$p]G88<xtm3=?&6,&3<%T]Z1E-i?w
2024-07-18 20:57:15 UTC	1390	IN	Data Raw: 6b b4 57 57 36 7a 08 ce 6e c2 f4 9a e4 40 95 3d 36 eb 57 3f bc 87 f2 fc 3f b0 56 e2 2b d6 13 2d 80 3f 97 00 e5 44 fb f7 72 ef bd 9f 60 74 4d f9 c6 2e ac 2d ae 02 29 30 cd 37 95 23 8e 15 17 f7 0a 78 76 4a fe 74 8e 75 ff e9 e5 cc 66 63 ae 59 97 39 3f 1c d4 fd 0f ee 7f 75 5d 1d 8f c4 52 9f 24 13 11 f2 d9 6b 0e 3c 72 a4 ee a1 cc 3c 17 1b 45 a1 1d f2 70 48 e7 b2 47 2a 25 f9 84 f7 2f 4e ca a2 36 b3 ff f4 7b c9 6c 6a da 2e 38 52 99 23 4d 96 18 95 f1 85 67 53 df ef 55 18 7d 8b ff e9 fa 6a 48 4f 19 da 11 8b dd 8b 7e e8 8e a4 b9 8b 4c b6 d2 49 ee c6 3f 6b 6c 4d 45 49 e5 bd 64 28 a4 19 75 65 1b bd 53 dd 98 d9 d2 9d df 99 75 3d 68 61 ae 05 1a f9 47 bd e2 1f ee ff aa 27 53 5f 7f 5c 03 6e cf 3f 9a 57 80 ed 5c 64 83 32 7b 64 c5 fb ce fe d7 67 95 e9 05 f0 93 e3 ff 38 4b Data Ascii: kWW6zn@=6W??V+-?Dr`tM.-)07#xvJtufcY9?u]R$k<r<EpHG*%/N6{lj.8R#MgSU}jHO~LI?klMEId(ueSu=haG'S_\n?W\d2{dg8K
2024-07-18 20:57:15 UTC	1390	IN	Data Raw: 35 76 33 3f e7 db b8 95 87 59 90 f0 15 f0 9d 24 9d c5 d3 c1 84 76 c5 6d a6 99 c3 34 71 5b 68 84 8f f5 2e 68 cd c7 47 40 74 46 79 f8 c3 75 72 18 21 5f 2c e7 64 16 8f 87 93 ef 33 9a 0d 8c ce 45 f4 69 4d 19 20 ef d0 f5 7e eb ec ff f9 e4 c9 93 36 8d dc 4f 35 55 00 90 06 1a a2 ad c1 3c 9d 32 9c b9 05 5a 7b 30 2c e4 85 57 2b 79 06 a2 3b b4 a5 1b 07 a3 f9 1f fc e9 d3 c0 7e dc 2d d9 70 92 26 aa 58 e7 91 fe 28 9f e1 f5 fd 6d fd 5a 3e 3f 2b c7 cc fe f1 e8 01 fd 70 24 26 37 1c cf 8f 61 96 f1 e3 48 6e b6 58 e2 6f 12 fe 3c 8e 8e e3 7e 3f 10 bb 35 09 4d ba b5 b9 29 5f 6b a0 03 f2 6e 58 45 60 6d 8d cf b7 c3 de 55 02 9c 01 e6 8b 6d 0a 88 ed 2d 15 29 33 76 6d 26 48 d9 d5 28 bd 98 77 81 ca b1 e3 0a d8 fb 61 3d 67 58 6a d2 a8 29 63 61 72 1f 06 f8 71 1e 32 8d c2 03 c6 69 04 Data Ascii: 5v3?Y$vm4q[h.hG@tFyur!_,d3EiM ~6O5U<2Z{0,W+y;~-p&X(mZ>?+p$&7aHnXo<~?5M)_knXE`mUm-)3vm&H(wa=gXj)carq2i
2024-07-18 20:57:15 UTC	1390	IN	Data Raw: 9c f7 3d c9 9a 89 4c 73 2e 94 11 78 62 ab cb d7 06 02 a8 dd ae 78 37 cc 9c d5 b2 6e ab 8d 4f 95 8d c6 79 8a 2d 00 48 5a 5d aa c6 ca 8a 1c 00 d4 5e be 22 3e 63 75 81 04 a7 d2 8b 62 14 a5 bb e7 7f d6 da 14 c7 8c 3d 0b 31 34 ff 48 80 60 c0 78 86 ee 1e 3e cb be 7f c2 eb 09 fe bb 5c 76 3f 13 2b 19 fa 13 ff 22 ac 08 13 d4 cf 30 dc 0b 26 e1 e7 a5 80 30 00 08 16 d2 1f 7a be 60 45 72 79 2f ec 19 50 47 16 e1 32 d4 3f 9a 9f cb 89 ec 0a 1d 1b b0 f5 33 f7 ae 04 c7 18 b6 24 b3 e8 00 6b 1b c2 6e e7 1c 80 33 87 ed 6e 61 be 93 3c c1 22 82 9f 40 3b 9a 00 f0 81 b4 11 5d eb 02 05 bc 83 cd 06 9c b9 0e 0d c1 e7 84 cb 46 3d 44 b9 52 90 f3 13 2e f2 94 9e 12 05 db 38 0f b1 dc 61 42 cf b8 ba 75 40 a8 4a 6d 3e e0 7b c9 e5 36 ac c7 e2 f4 b6 b5 e4 2e 81 e1 42 49 7f 12 0e 85 da 17 6c Data Ascii: =Ls.xbx7nOy-HZ]^">cub=14H`x>\v?+"0&0z`Ery/PG2?3$kn3na<"@;]F=DR.8aBu@Jm>{6.BIl
2024-07-18 20:57:15 UTC	1390	IN	Data Raw: 18 ec 20 d8 28 82 94 2c 7d de 3b 97 a5 45 bb 9e 5f 6d 81 d3 42 f1 79 e5 ab f5 81 56 1d f6 b4 cd 77 d2 6b 08 3e ed 25 0d 17 45 8a a9 4d b4 db e0 00 7b 2e ff 4b ae d2 18 76 6a 8b 76 b3 0f 92 bd f8 c0 e9 c9 62 21 18 83 04 67 81 e0 f4 ef 88 e6 2a 33 92 6f 89 cc 9a 3f 4c 3e 60 57 54 c5 88 2f 20 0d d6 d3 de da f2 37 da 1e b1 21 73 c2 71 99 b2 a9 69 d0 a8 a1 31 2b 30 ad 10 1d bb 45 8b eb 16 0a 5b 37 14 14 f9 18 ed 4a 16 bf 57 95 5c 03 f6 62 f9 11 e6 84 1f 76 7d b1 6b 6b fc b6 31 6f 60 b5 71 80 3e a0 9b 2f 9a eb a3 9e 65 b6 08 df fe 51 73 0d 6a ae da 0a b5 7d 4d 3b 77 6a 1b e2 13 ac 34 05 c4 7c 9f 99 c6 89 aa 22 8d 0b 62 50 2f a0 f9 86 0e 2d 68 fe 24 14 b4 06 e6 4d 4a 52 e9 4f 68 7f 22 e1 27 fb b9 d5 e9 aa 63 bc 06 e8 81 34 77 89 f1 a7 5c 3f e4 ce 2f 90 ea 9f a1 Data Ascii: (,};E_mByVwk>%EM{.Kvjvb!g*3o?L>`WT/ 7!sqi1+0E[7JW\bv}kk1o`q>/eQsj}M;wj4\|"bP/-h$MJROh"'c4w\?/
2024-07-18 20:57:15 UTC	1390	IN	Data Raw: 98 44 c5 5c ab 1d cb 20 bb 8d 52 91 29 52 9a e1 b2 de fb ed ce 9d c6 ee 78 72 39 1d e4 c5 bc 81 9a e3 6e 39 9e 9d 4e d3 c6 eb 41 34 65 d3 cb c6 ce e9 bc 18 4f 67 ad 3b 8d a3 77 7b 5f b7 5e 0f e2 74 34 4b b7 0e 12 d8 d6 83 6c 90 4e bb 8d 9d 09 10 f2 74 6b bb d5 be f3 db bd 3b 38 ed 19 0b 67 40 14 af 96 fe 39 41 71 b1 c0 f8 43 7d 3e 61 2e d5 34 fb 18 11 5f a5 f3 80 01 00 f0 88 90 12 d7 38 10 8f 28 a0 d9 0a e6 5a 2c cc 4f ae 83 2d 38 4d ac 6f 4a 9c 52 8f 23 2b 00 f4 58 0c 32 94 3d 03 8f 29 b3 25 1a 26 f8 3a f4 62 20 56 c0 12 e0 df 8d d5 f3 64 f0 b6 87 e7 95 92 7e 97 ff 09 af 96 5d fa 1b 69 4f c6 a9 98 1e 9f cf 19 73 9d dd d7 6f 8f 3e 7d d8 ff fe ec f5 ce f3 23 87 42 fc b1 0b a6 bc 57 4c 28 1c ac 6b b4 73 26 8e 71 d4 9e b5 8a c2 73 71 5a 85 99 31 d6 b8 cf c2 Data Ascii: D\ R)Rxr9n9NA4eOg;w{_^t4KlNtk;8g@9AqC}>a.4_8(Z,O-8MoJR#+X2=)%&:b Vd~]iOso>}#BWL(ks&qsqZ1
2024-07-18 20:57:15 UTC	1390	IN	Data Raw: 06 25 ff 9f 35 d6 93 ef ba fc f8 75 16 85 d0 aa e7 e7 f4 d7 d9 4e 01 05 03 e9 1f 16 32 0a fe f4 4f 98 6b f9 e4 dd ab 17 51 b7 e3 ef 47 dd 6d 7f 37 ea 3e f0 df 46 dd 3f fc 37 f0 ee 91 ff 3a ea de df f6 e7 51 f7 d1 03 ff 23 bc d9 fe c3 7f 0a e5 1e 3e f2 77 a2 ee c3 ce b6 ff 0c 5e b6 b7 1f f8 97 f0 b6 fd e0 0f ff 08 1a 68 ff f9 c8 ff 05 6d 74 fe dc 5e 7a 20 68 90 b2 5d 44 61 12 55 4f 45 1f 67 51 7f 01 3a 69 b7 f2 be f5 55 c9 26 3d f8 01 45 ba 6b 4e 17 43 85 ab af 5d e9 e8 f4 af 4b 55 90 82 96 96 8a 2f e8 90 5d fa 83 ca 98 b4 bc 46 03 6b 2f bb 75 df 60 3c ed a5 7f 72 6d dd 75 35 97 fe 8f 75 70 30 73 12 dc 00 8f ff 23 e0 08 6a 64 d5 32 e2 03 f8 11 81 86 e4 b2 05 30 98 ad ce 83 87 7f 76 4c 9d 64 58 29 74 ff 01 2f f5 f0 77 83 71 8d 22 61 24 78 f2 a4 f3 80 0c 94 Data Ascii: %5uN2OkQGm7>F?7:Q#>w^hmt^z h]DaUOEgQ:iU&=EkNC]KU/]Fk/u`<rmu5up0s#jd20vLdX)t/wq"a$x

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49741	13.107.246.60	443	7316	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-18 20:57:16 UTC	486	OUT	GET /assets/arbitration_priority_list/4.0.5/asset?assetgroup=ArbitrationService HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: ArbitrationService Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-07-18 20:57:16 UTC	571	IN	HTTP/1.1 200 OK Date: Thu, 18 Jul 2024 20:57:16 GMT Content-Type: application/octet-stream Content-Length: 11989 Connection: close Content-MD5: 2Sac1JgWnA2goeZEYMrzXg== Last-Modified: Wed, 10 Jul 2024 22:08:29 GMT ETag: 0x8DCA12CD4988DF1 x-ms-request-id: 649b69ab-701e-0068-1a55-d93656000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20240718T205716Z-15b94bb6ff9l2slhr3ee6x866g0000000bc000000000txd4 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-07-18 20:57:16 UTC	11989	IN	Data Raw: 7b 0d 0a 20 20 22 63 6f 6e 66 69 67 56 65 72 73 69 6f 6e 22 3a 20 33 32 2c 0d 0a 20 20 22 50 72 69 76 69 6c 65 67 65 64 45 78 70 65 72 69 65 6e 63 65 73 22 3a 20 5b 0d 0a 20 20 20 20 22 53 68 6f 72 65 6c 69 6e 65 50 72 69 76 69 6c 65 67 65 64 45 78 70 65 72 69 65 6e 63 65 49 44 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 43 4f 55 50 4f 4e 53 5f 43 48 45 43 4b 4f 55 54 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 4c 4f 57 45 52 5f 50 52 49 43 45 5f 46 4f 55 4e 44 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 42 49 4e 47 5f 53 45 41 52 43 48 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 52 45 42 41 54 45 Data Ascii: { "configVersion": 32, "PrivilegedExperiences": [ "ShorelinePrivilegedExperienceID", "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT", "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND", "SHOPPING_AUTO_SHOW_BING_SEARCH", "SHOPPING_AUTO_SHOW_REBATE

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49744	162.159.61.3	443	7316	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-18 20:57:17 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-07-18 20:57:17 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-07-18 20:57:17 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Thu, 18 Jul 2024 20:57:17 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8a55621bfafe0f6f-EWR alt-svc: h3=":443"; ma=86400
2024-07-18 20:57:17 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 f2 00 04 8e fa 41 a3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomA)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49745	162.159.61.3	443	7316	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-18 20:57:17 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-07-18 20:57:17 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-07-18 20:57:17 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Thu, 18 Jul 2024 20:57:17 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8a55621bd9df0c7c-EWR alt-svc: h3=":443"; ma=86400
2024-07-18 20:57:17 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 92 00 04 8e fa 50 43 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomPC)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49746	172.64.41.3	443	7316	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-18 20:57:17 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-07-18 20:57:17 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-07-18 20:57:17 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Thu, 18 Jul 2024 20:57:17 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8a55621c4803182d-EWR alt-svc: h3=":443"; ma=86400
2024-07-18 20:57:17 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 23 00 04 8e fb 20 63 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom# c)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49748	172.64.41.3	443	7316	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-18 20:57:18 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-07-18 20:57:18 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-07-18 20:57:18 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Thu, 18 Jul 2024 20:57:18 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8a5562227cdf42b7-EWR alt-svc: h3=":443"; ma=86400
2024-07-18 20:57:18 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 19 00 04 8e fa b0 c3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49751	142.251.35.170	443	7316	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-18 20:57:20 UTC	448	OUT	POST /chromewebstore/v1.1/items/verify HTTP/1.1 Host: www.googleapis.com Connection: keep-alive Content-Length: 119 Content-Type: application/json Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-07-18 20:57:20 UTC	119	OUT	Data Raw: 7b 22 68 61 73 68 22 3a 22 41 75 50 61 72 61 58 73 76 48 4b 63 57 59 75 7a 4c 67 50 2f 4c 72 4b 45 50 5a 33 57 6e 30 4b 67 48 51 31 55 71 52 68 6e 4b 43 30 3d 22 2c 22 69 64 73 22 3a 5b 22 67 68 62 6d 6e 6e 6a 6f 6f 65 6b 70 6d 6f 65 63 6e 6e 6e 69 6c 6e 6e 62 64 6c 6f 6c 68 6b 68 69 22 5d 2c 22 70 72 6f 74 6f 63 6f 6c 5f 76 65 72 73 69 6f 6e 22 3a 31 7d Data Ascii: {"hash":"AuParaXsvHKcWYuzLgP/LrKEPZ3Wn0KgHQ1UqRhnKC0=","ids":["ghbmnnjooekpmoecnnnilnnbdlolhkhi"],"protocol_version":1}
2024-07-18 20:57:20 UTC	341	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=UTF-8 Vary: Origin Vary: X-Origin Vary: Referer Date: Thu, 18 Jul 2024 20:57:20 GMT Server: ESF Content-Length: 483 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-07-18 20:57:20 UTC	483	IN	Data Raw: 7b 0a 20 20 22 70 72 6f 74 6f 63 6f 6c 5f 76 65 72 73 69 6f 6e 22 3a 20 31 2c 0a 20 20 22 73 69 67 6e 61 74 75 72 65 22 3a 20 22 68 34 5a 36 65 31 50 44 69 39 78 32 52 45 7a 5a 76 6e 74 30 58 2f 2f 37 4c 6e 51 6c 73 2f 74 53 71 55 47 55 59 74 71 75 48 52 72 54 50 6a 69 5a 57 59 4e 7a 30 74 65 78 75 44 41 69 4a 76 38 6e 50 57 7a 52 37 39 36 45 49 44 74 6b 75 2b 6c 38 67 74 67 58 6d 73 6d 35 76 75 71 75 75 56 2f 48 6b 35 2f 30 77 45 33 70 75 47 43 77 41 6f 79 55 7a 2b 6f 6a 38 76 43 54 70 35 4b 4f 35 6b 33 61 6b 64 61 77 70 67 77 55 76 33 6e 79 43 74 33 67 68 6d 65 58 4e 59 4c 75 56 45 72 33 4a 79 6b 75 69 46 52 62 64 31 64 48 2b 36 68 71 4d 65 38 64 41 36 41 62 62 68 38 77 75 43 6a 5a 30 44 65 39 70 4e 50 64 46 33 6c 41 65 34 34 59 6f 61 4d 37 64 53 43 4d Data Ascii: { "protocol_version": 1, "signature": "h4Z6e1PDi9x2REzZvnt0X//7LnQls/tSqUGUYtquHRrTPjiZWYNz0texuDAiJv8nPWzR796EIDtku+l8gtgXmsm5vuquuV/Hk5/0wE3puGCwAoyUz+oj8vCTp5KO5k3akdawpgwUv3nyCt3ghmeXNYLuVEr3JykuiFRbd1dH+6hqMe8dA6Abbh8wuCjZ0De9pNPdF3lAe44YoaM7dSCM

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49758	152.195.19.97	443	7316	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-18 20:57:33 UTC	614	OUT	GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1721941035&P2=404&P3=2&P4=M7A1OzH62S9Lk3UHKN5cCSEzeUZ01KVvQkb3YBsYyAsZEb3jWqQ4rtBDc42rk4GP3zd%2b0DfERo9Q01hcvKyUew%3d%3d HTTP/1.1 Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com Connection: keep-alive MS-CV: 1jOZtoZB8Px9C8siZ9XR9i Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-07-18 20:57:33 UTC	632	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Age: 1262784 Cache-Control: public, max-age=17280000 Content-Type: application/x-chrome-extension Date: Thu, 18 Jul 2024 20:57:33 GMT Etag: "Gv3jDkaZdFLRHkoq2781zOehQE8=" Last-Modified: Wed, 24 Jan 2024 00:25:37 GMT MS-CorrelationId: b4b4aabf-4d02-4629-96b1-a382405b6a31 MS-CV: 642I+iNy0Qp5KFcIV/sUKh.0 MS-RequestId: 5245ac9e-0afd-43ce-8780-5c7d0bedf1d4 Server: ECAcc (nyd/D11E) X-AspNet-Version: 4.0.30319 X-AspNetMvc-Version: 5.3 X-Cache: HIT X-CCC: US X-CID: 11 X-Powered-By: ASP.NET X-Powered-By: ARR/3.0 X-Powered-By: ASP.NET Content-Length: 11185 Connection: close
2024-07-18 20:57:33 UTC	11185	IN	Data Raw: 43 72 32 34 03 00 00 00 1d 05 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 bb 4e a9 d8 c8 e8 cb ac 89 0d 45 23 09 ef 07 9e ab ed 9a 39 65 ef 75 ea 71 bc a5 c4 56 59 59 ef 8c 08 40 04 2b ed 43 d0 dc 6b a7 4f 88 b9 62 4b d3 60 94 de 36 ee 47 92 ab 25 8a 1e cc 0d fa 33 5a 12 19 8e 65 20 5f fd 36 15 d6 13 1e 46 ae 8b 31 70 18 f1 a8 4b 1d 5a ff de 0e 83 8e 11 b2 2f 20 ed 33 88 cb fb 4f 54 94 9e 60 00 d3 bc 30 ab c0 d7 59 8b b0 96 46 54 fc f0 34 33 1c 74 68 d6 79 f9 0c 8c 7d 8a 91 98 ca 70 c6 4c 0f 1b c8 32 53 b9 26 69 cc 60 09 8d 6f ec f9 a6 66 8d 6f 48 81 0e 05 8a f1 97 4e b8 c3 94 3a b3 f7 69 6a 54 89 33 da 9e 46 7b d1 30 bb 2c cc 66 3f 27 66 e3 43 51 74 3b 62 5f 22 50 63 08 e5 20 Data Ascii: Cr240"0*H0NE#9euqVYY@+CkObK`6G%3Ze _6F1pKZ/ 3OT`0YFT43thy}pL2S&i`ofoHN:ijT3F{0,f?'fCQt;b_"Pc

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49771	3.164.160.102	443	8464	C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-18 20:57:48 UTC	182	OUT	GET /rest-api?edns_client_subnet=0.0.0.0%2F0&name=nit.crash1ytics.com.&type=1 HTTP/1.1 Host: d1dmgcawtbm6l9.cloudfront.net User-Agent: Go-http-client/1.1 Accept-Encoding: gzip
2024-07-18 20:57:49 UTC	676	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=UTF-8 Transfer-Encoding: chunked Connection: close Server: nginx/1.16.0 Date: Thu, 18 Jul 2024 20:57:49 GMT X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Expires: Thu, 18 Jul 2024 20:57:49 GMT Cache-Control: private, max-age=1 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Accept-Ranges: none Vary: Accept-Encoding X-Cache: Miss from cloudfront Via: 1.1 ff7010ce6a43809a9e2df5e6441e868e.cloudfront.net (CloudFront) X-Amz-Cf-Pop: CDG55-P3 X-Amz-Cf-Id: Gn2tqql0E8kN9a0npb6VVMVpDuRyxlTmukVR5ROVpApupFm-9esm4Q==
2024-07-18 20:57:49 UTC	458	IN	Data Raw: 31 63 33 0d 0a 7b 22 53 74 61 74 75 73 22 3a 30 2c 22 54 43 22 3a 66 61 6c 73 65 2c 22 52 44 22 3a 74 72 75 65 2c 22 52 41 22 3a 74 72 75 65 2c 22 41 44 22 3a 66 61 6c 73 65 2c 22 43 44 22 3a 66 61 6c 73 65 2c 22 51 75 65 73 74 69 6f 6e 22 3a 5b 7b 22 6e 61 6d 65 22 3a 22 6e 69 74 2e 63 72 61 73 68 31 79 74 69 63 73 2e 63 6f 6d 2e 22 2c 22 74 79 70 65 22 3a 31 7d 5d 2c 22 41 6e 73 77 65 72 22 3a 5b 7b 22 6e 61 6d 65 22 3a 22 6e 69 74 2e 63 72 61 73 68 31 79 74 69 63 73 2e 63 6f 6d 2e 22 2c 22 74 79 70 65 22 3a 31 2c 22 54 54 4c 22 3a 31 2c 22 64 61 74 61 22 3a 22 36 37 2e 31 33 37 2e 31 37 34 2e 32 35 34 22 7d 2c 7b 22 6e 61 6d 65 22 3a 22 6e 69 74 2e 63 72 61 73 68 31 79 74 69 63 73 2e 63 6f 6d 2e 22 2c 22 74 79 70 65 22 3a 31 2c 22 54 54 4c 22 3a 31 2c Data Ascii: 1c3{"Status":0,"TC":false,"RD":true,"RA":true,"AD":false,"CD":false,"Question":[{"name":"nit.crash1ytics.com.","type":1}],"Answer":[{"name":"nit.crash1ytics.com.","type":1,"TTL":1,"data":"67.137.174.254"},{"name":"nit.crash1ytics.com.","type":1,"TTL":1,
2024-07-18 20:57:49 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49772	3.164.160.102	443	8464	C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-18 20:57:48 UTC	180	OUT	GET /rest-api?edns_client_subnet=0.0.0.0%2F0&name=nal.fqoqehwib.com.&type=1 HTTP/1.1 Host: d1dmgcawtbm6l9.cloudfront.net User-Agent: Go-http-client/1.1 Accept-Encoding: gzip
2024-07-18 20:57:49 UTC	676	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=UTF-8 Transfer-Encoding: chunked Connection: close Server: nginx/1.16.0 Date: Thu, 18 Jul 2024 20:57:49 GMT X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Expires: Thu, 18 Jul 2024 20:57:49 GMT Cache-Control: private, max-age=6 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Accept-Ranges: none Vary: Accept-Encoding X-Cache: Miss from cloudfront Via: 1.1 39e519d65c07d4d8d73d1f22f04f931a.cloudfront.net (CloudFront) X-Amz-Cf-Pop: CDG55-P3 X-Amz-Cf-Id: GQ1QwTeJlIaBx0wgaWJPE6RJ_lYkcMRUZMwE2p6wkx9wzLwsjKTWFw==
2024-07-18 20:57:49 UTC	557	IN	Data Raw: 32 32 36 0d 0a 7b 22 53 74 61 74 75 73 22 3a 30 2c 22 54 43 22 3a 66 61 6c 73 65 2c 22 52 44 22 3a 74 72 75 65 2c 22 52 41 22 3a 74 72 75 65 2c 22 41 44 22 3a 66 61 6c 73 65 2c 22 43 44 22 3a 66 61 6c 73 65 2c 22 51 75 65 73 74 69 6f 6e 22 3a 5b 7b 22 6e 61 6d 65 22 3a 22 6e 61 6c 2e 66 71 6f 71 65 68 77 69 62 2e 63 6f 6d 2e 22 2c 22 74 79 70 65 22 3a 31 7d 5d 2c 22 41 6e 73 77 65 72 22 3a 5b 7b 22 6e 61 6d 65 22 3a 22 6e 61 6c 2e 66 71 6f 71 65 68 77 69 62 2e 63 6f 6d 2e 22 2c 22 74 79 70 65 22 3a 31 2c 22 54 54 4c 22 3a 36 2c 22 64 61 74 61 22 3a 22 31 30 34 2e 31 31 32 2e 31 37 32 2e 32 34 35 22 7d 2c 7b 22 6e 61 6d 65 22 3a 22 6e 61 6c 2e 66 71 6f 71 65 68 77 69 62 2e 63 6f 6d 2e 22 2c 22 74 79 70 65 22 3a 31 2c 22 54 54 4c 22 3a 36 2c 22 64 61 74 61 Data Ascii: 226{"Status":0,"TC":false,"RD":true,"RA":true,"AD":false,"CD":false,"Question":[{"name":"nal.fqoqehwib.com.","type":1}],"Answer":[{"name":"nal.fqoqehwib.com.","type":1,"TTL":6,"data":"104.112.172.245"},{"name":"nal.fqoqehwib.com.","type":1,"TTL":6,"data
2024-07-18 20:57:49 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49770	3.164.160.102	443	8464	C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-18 20:57:48 UTC	183	OUT	GET /rest-api?edns_client_subnet=0.0.0.0%2F0&name=chr.alipayassets.com.&type=1 HTTP/1.1 Host: d1dmgcawtbm6l9.cloudfront.net User-Agent: Go-http-client/1.1 Accept-Encoding: gzip
2024-07-18 20:57:49 UTC	676	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=UTF-8 Transfer-Encoding: chunked Connection: close Server: nginx/1.16.0 Date: Thu, 18 Jul 2024 20:57:49 GMT X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Expires: Thu, 18 Jul 2024 20:57:49 GMT Cache-Control: private, max-age=1 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Accept-Ranges: none Vary: Accept-Encoding X-Cache: Miss from cloudfront Via: 1.1 19dc33c288e93eab17f860a762901768.cloudfront.net (CloudFront) X-Amz-Cf-Pop: CDG55-P3 X-Amz-Cf-Id: RD4f1V4bd_eulIcH6RFtwgZqLAcsIgwnxUS9TPl0c60YTuKqzJFoQw==
2024-07-18 20:57:49 UTC	390	IN	Data Raw: 31 37 66 0d 0a 7b 22 53 74 61 74 75 73 22 3a 30 2c 22 54 43 22 3a 66 61 6c 73 65 2c 22 52 44 22 3a 74 72 75 65 2c 22 52 41 22 3a 74 72 75 65 2c 22 41 44 22 3a 66 61 6c 73 65 2c 22 43 44 22 3a 66 61 6c 73 65 2c 22 51 75 65 73 74 69 6f 6e 22 3a 5b 7b 22 6e 61 6d 65 22 3a 22 63 68 72 2e 61 6c 69 70 61 79 61 73 73 65 74 73 2e 63 6f 6d 2e 22 2c 22 74 79 70 65 22 3a 31 7d 5d 2c 22 41 6e 73 77 65 72 22 3a 5b 7b 22 6e 61 6d 65 22 3a 22 63 68 72 2e 61 6c 69 70 61 79 61 73 73 65 74 73 2e 63 6f 6d 2e 22 2c 22 74 79 70 65 22 3a 31 2c 22 54 54 4c 22 3a 31 2c 22 64 61 74 61 22 3a 22 38 35 2e 32 32 32 2e 37 39 2e 35 37 22 7d 2c 7b 22 6e 61 6d 65 22 3a 22 63 68 72 2e 61 6c 69 70 61 79 61 73 73 65 74 73 2e 63 6f 6d 2e 22 2c 22 74 79 70 65 22 3a 31 2c 22 54 54 4c 22 3a 31 Data Ascii: 17f{"Status":0,"TC":false,"RD":true,"RA":true,"AD":false,"CD":false,"Question":[{"name":"chr.alipayassets.com.","type":1}],"Answer":[{"name":"chr.alipayassets.com.","type":1,"TTL":1,"data":"85.222.79.57"},{"name":"chr.alipayassets.com.","type":1,"TTL":1
2024-07-18 20:57:49 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49793	108.138.24.13	443	8464	C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-18 20:58:09 UTC	182	OUT	GET /rest-api?edns_client_subnet=0.0.0.0%2F0&name=nit.crash1ytics.com.&type=1 HTTP/1.1 Host: d1dmgcawtbm6l9.cloudfront.net User-Agent: Go-http-client/1.1 Accept-Encoding: gzip
2024-07-18 20:58:09 UTC	676	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=UTF-8 Transfer-Encoding: chunked Connection: close Server: nginx/1.16.0 Date: Thu, 18 Jul 2024 20:58:09 GMT X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Expires: Thu, 18 Jul 2024 20:58:09 GMT Cache-Control: private, max-age=3 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Accept-Ranges: none Vary: Accept-Encoding X-Cache: Miss from cloudfront Via: 1.1 62e7b24ca032b612bb93fa7f3437469c.cloudfront.net (CloudFront) X-Amz-Cf-Pop: FRA56-P7 X-Amz-Cf-Id: zP3tyRuRR1ZfhEfc04c1P3Ww8-Ixjc0cgxiuoPf_KEdyaymF4pNokQ==
2024-07-18 20:58:09 UTC	458	IN	Data Raw: 31 63 33 0d 0a 7b 22 53 74 61 74 75 73 22 3a 30 2c 22 54 43 22 3a 66 61 6c 73 65 2c 22 52 44 22 3a 74 72 75 65 2c 22 52 41 22 3a 74 72 75 65 2c 22 41 44 22 3a 66 61 6c 73 65 2c 22 43 44 22 3a 66 61 6c 73 65 2c 22 51 75 65 73 74 69 6f 6e 22 3a 5b 7b 22 6e 61 6d 65 22 3a 22 6e 69 74 2e 63 72 61 73 68 31 79 74 69 63 73 2e 63 6f 6d 2e 22 2c 22 74 79 70 65 22 3a 31 7d 5d 2c 22 41 6e 73 77 65 72 22 3a 5b 7b 22 6e 61 6d 65 22 3a 22 6e 69 74 2e 63 72 61 73 68 31 79 74 69 63 73 2e 63 6f 6d 2e 22 2c 22 74 79 70 65 22 3a 31 2c 22 54 54 4c 22 3a 33 2c 22 64 61 74 61 22 3a 22 36 37 2e 31 33 37 2e 31 37 34 2e 32 35 34 22 7d 2c 7b 22 6e 61 6d 65 22 3a 22 6e 69 74 2e 63 72 61 73 68 31 79 74 69 63 73 2e 63 6f 6d 2e 22 2c 22 74 79 70 65 22 3a 31 2c 22 54 54 4c 22 3a 33 2c Data Ascii: 1c3{"Status":0,"TC":false,"RD":true,"RA":true,"AD":false,"CD":false,"Question":[{"name":"nit.crash1ytics.com.","type":1}],"Answer":[{"name":"nit.crash1ytics.com.","type":1,"TTL":3,"data":"67.137.174.254"},{"name":"nit.crash1ytics.com.","type":1,"TTL":3,
2024-07-18 20:58:09 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	16:57:04
Start date:	18/07/2024
Path:	C:\Windows\System32\msiexec.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\lets-test.msi"
Imagebase:	0x7ff7ea810000
File size:	69'632 bytes
MD5 hash:	E5DA170027542E25EDE42FC54C929077
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	16:57:04
Start date:	18/07/2024
Path:	C:\Windows\System32\msiexec.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\msiexec.exe /V
Imagebase:	0x7ff7ea810000
File size:	69'632 bytes
MD5 hash:	E5DA170027542E25EDE42FC54C929077
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	16:57:07
Start date:	18/07/2024
Path:	C:\Windows\SysWOW64\msiexec.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\syswow64\MsiExec.exe -Embedding A5D05F387DF25EBE7AE8DA514E37EF3C
Imagebase:	0xf90000
File size:	59'904 bytes
MD5 hash:	9D09DC1EDA745A5F87553048E57620CF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	16:57:09
Start date:	18/07/2024
Path:	C:\Program Files (x86)\haxGhXjmBFM\LetsPRO.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\haxGhXjmBFM\LetsPRO.exe"
Imagebase:	0xbc0000
File size:	245'880 bytes
MD5 hash:	EA9E2F517B1CC2DBE7F78302DD7FB593
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	16:57:09
Start date:	18/07/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	16:57:09
Start date:	18/07/2024
Path:	C:\Program Files (x86)\haxGhXjmBFM\app-3.8.0\LetsPRO.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\haxGhXjmBFM\app-3.8.0\LetsPRO.exe"
Imagebase:	0x400000
File size:	361'472 bytes
MD5 hash:	2D822C8477099A4F8D149F19836312D1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	16:57:09
Start date:	18/07/2024
Path:	C:\Program Files (x86)\Common Files\wegame.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Common Files\wegame.exe"
Imagebase:	0x400000
File size:	1'427'336 bytes
MD5 hash:	063AF51C19F29BCDFD26C1BEBDC9ACE6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	16:57:09
Start date:	18/07/2024
Path:	C:\Program Files (x86)\haxGhXjmBFM\LetsPRO.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\haxGhXjmBFM\LetsPRO.exe"
Imagebase:	0xbc0000
File size:	245'880 bytes
MD5 hash:	EA9E2F517B1CC2DBE7F78302DD7FB593
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	16:57:09
Start date:	18/07/2024
Path:	C:\Program Files (x86)\haxGhXjmBFM.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\haxGhXjmBFM.exe"
Imagebase:	0x400000
File size:	15'186'952 bytes
MD5 hash:	9C44BE4CEAC0C983A812FD8459511FD0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	16:57:09
Start date:	18/07/2024
Path:	C:\Program Files (x86)\haxGhXjmBFM\LetsPRO.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\haxGhXjmBFM\LetsPRO.exe"
Imagebase:	0xbc0000
File size:	245'880 bytes
MD5 hash:	EA9E2F517B1CC2DBE7F78302DD7FB593
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	16:57:09
Start date:	18/07/2024
Path:	C:\Program Files (x86)\haxGhXjmBFM\app-3.8.0\LetsPRO.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\haxGhXjmBFM\app-3.8.0\LetsPRO.exe"
Imagebase:	0x400000
File size:	361'472 bytes
MD5 hash:	2D822C8477099A4F8D149F19836312D1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	16:57:09
Start date:	18/07/2024
Path:	C:\Program Files (x86)\haxGhXjmBFM\app-3.8.0\LetsPRO.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\haxGhXjmBFM\app-3.8.0\LetsPRO.exe"
Imagebase:	0x400000
File size:	361'472 bytes
MD5 hash:	2D822C8477099A4F8D149F19836312D1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	16:57:09
Start date:	18/07/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	powershell.exe -inputformat none -ExecutionPolicy Bypass -Command "If ($env:PROCESSOR_ARCHITEW6432) { $env:PROCESSOR_ARCHITEW6432 } Else { $env:PROCESSOR_ARCHITECTURE }"
Imagebase:	0x760000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	16:57:09
Start date:	18/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	16:57:10
Start date:	18/07/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	15
Start time:	16:57:10
Start date:	18/07/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	16
Start time:	16:57:11
Start date:	18/07/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2116 --field-trial-handle=1900,i,16840921317244570798,13407743960639991352,262144 /prefetch:3
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	16:57:11
Start date:	18/07/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2076 --field-trial-handle=2052,i,15600672359767385931,12955159692457146143,262144 /prefetch:3
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	18
Start time:	16:57:12
Start date:	18/07/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=4204 --field-trial-handle=2052,i,15600672359767385931,12955159692457146143,262144 /prefetch:8
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	16:57:16
Start date:	18/07/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=5976 --field-trial-handle=2052,i,15600672359767385931,12955159692457146143,262144 /prefetch:8
Imagebase:	0x7ff7100b0000
File size:	1'255'976 bytes
MD5 hash:	76C58E5BABFE4ACF0308AA646FC0F416
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	16:57:16
Start date:	18/07/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=5976 --field-trial-handle=2052,i,15600672359767385931,12955159692457146143,262144 /prefetch:8
Imagebase:	0x7ff7100b0000
File size:	1'255'976 bytes
MD5 hash:	76C58E5BABFE4ACF0308AA646FC0F416
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	16:57:24
Start date:	18/07/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	powershell -inputformat none -ExecutionPolicy Bypass -File "C:\Program Files (x86)\letsvpn\AddWindowsSecurityExclusion.ps1"
Imagebase:	0x760000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	16:57:24
Start date:	18/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	16:57:28
Start date:	18/07/2024
Path:	C:\Program Files (x86)\letsvpn\driver\tapinstall.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\letsvpn\driver\tapinstall.exe" findall tap0901
Imagebase:	0x7ff7beed0000
File size:	101'536 bytes
MD5 hash:	1E3CF83B17891AEE98C3E30012F0B034
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	16:57:28
Start date:	18/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	16:57:29
Start date:	18/07/2024
Path:	C:\Program Files (x86)\letsvpn\driver\tapinstall.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\letsvpn\driver\tapinstall.exe" install "C:\Program Files (x86)\letsvpn\driver\OemVista.inf" tap0901
Imagebase:	0x7ff7beed0000
File size:	101'536 bytes
MD5 hash:	1E3CF83B17891AEE98C3E30012F0B034
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	16:57:29
Start date:	18/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	16:57:30
Start date:	18/07/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	16:57:30
Start date:	18/07/2024
Path:	C:\Windows\System32\drvinst.exe
Wow64 process (32bit):	false
Commandline:	DrvInst.exe "4" "0" "C:\Users\user\AppData\Local\Temp\{99f02b5e-0c7c-d542-ad44-27ce9be55c97}\oemvista.inf" "9" "4d14a44ff" "0000000000000158" "WinSta0\Default" "0000000000000164" "208" "c:\program files (x86)\letsvpn\driver"
Imagebase:	0x7ff69fe90000
File size:	337'920 bytes
MD5 hash:	294990C88B9D1FE0A54A1FA8BF4324D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	16:57:31
Start date:	18/07/2024
Path:	C:\Windows\System32\drvinst.exe
Wow64 process (32bit):	false
Commandline:	DrvInst.exe "2" "211" "ROOT\NET\0000" "C:\Windows\INF\oem4.inf" "oem4.inf:3beb73aff103cc24:tap0901.ndi:9.24.6.601:tap0901," "4d14a44ff" "0000000000000158"
Imagebase:	0x7ff69fe90000
File size:	337'920 bytes
MD5 hash:	294990C88B9D1FE0A54A1FA8BF4324D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	16:57:32
Start date:	18/07/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s NetSetupSvc
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	16:57:33
Start date:	18/07/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c netsh advfirewall firewall Delete rule name=lets
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	16:57:33
Start date:	18/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	16:57:33
Start date:	18/07/2024
Path:	C:\Windows\SysWOW64\netsh.exe
Wow64 process (32bit):	true
Commandline:	netsh advfirewall firewall Delete rule name=lets
Imagebase:	0x1560000
File size:	82'432 bytes
MD5 hash:	4E89A1A088BE715D6C946E55AB07C7DF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	16:57:33
Start date:	18/07/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c netsh advfirewall firewall Delete rule name=lets.exe
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	42
Start time:	16:57:33
Start date:	18/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	43
Start time:	16:57:33
Start date:	18/07/2024
Path:	C:\Windows\SysWOW64\netsh.exe
Wow64 process (32bit):	true
Commandline:	netsh advfirewall firewall Delete rule name=lets.exe
Imagebase:	0x1560000
File size:	82'432 bytes
MD5 hash:	4E89A1A088BE715D6C946E55AB07C7DF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	44
Start time:	16:57:33
Start date:	18/07/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c netsh advfirewall firewall Delete rule name=LetsPRO.exe
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	45
Start time:	16:57:33
Start date:	18/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	46
Start time:	16:57:33
Start date:	18/07/2024
Path:	C:\Windows\SysWOW64\netsh.exe
Wow64 process (32bit):	true
Commandline:	netsh advfirewall firewall Delete rule name=LetsPRO.exe
Imagebase:	0x1560000
File size:	82'432 bytes
MD5 hash:	4E89A1A088BE715D6C946E55AB07C7DF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	47
Start time:	16:57:34
Start date:	18/07/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c netsh advfirewall firewall Delete rule name=LetsPRO
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	48
Start time:	16:57:34
Start date:	18/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	49
Start time:	16:57:34
Start date:	18/07/2024
Path:	C:\Windows\SysWOW64\netsh.exe
Wow64 process (32bit):	true
Commandline:	netsh advfirewall firewall Delete rule name=LetsPRO
Imagebase:	0x1560000
File size:	82'432 bytes
MD5 hash:	4E89A1A088BE715D6C946E55AB07C7DF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	50
Start time:	16:57:34
Start date:	18/07/2024
Path:	C:\Program Files (x86)\letsvpn\driver\tapinstall.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\letsvpn\driver\tapinstall.exe" findall tap0901
Imagebase:	0x7ff7beed0000
File size:	101'536 bytes
MD5 hash:	1E3CF83B17891AEE98C3E30012F0B034
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	51
Start time:	16:57:34
Start date:	18/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	52
Start time:	16:57:36
Start date:	18/07/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	53
Start time:	16:57:37
Start date:	18/07/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2128 --field-trial-handle=2084,i,12025234242823261480,2093702470493136090,262144 /prefetch:3
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	54
Start time:	16:57:40
Start date:	18/07/2024
Path:	C:\Program Files (x86)\letsvpn\LetsPRO.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\letsvpn\LetsPRO.exe"
Imagebase:	0x490000
File size:	245'880 bytes
MD5 hash:	EA9E2F517B1CC2DBE7F78302DD7FB593
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	55
Start time:	16:57:40
Start date:	18/07/2024
Path:	C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe"
Imagebase:	0xe60000
File size:	1'481'848 bytes
MD5 hash:	38973DBBFAD9619FDE39FAB919EB9A04
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 3%, ReversingLabs
Has exited:	false

Show Windows behavior

Target ID:	56
Start time:	16:57:44
Start date:	18/07/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s Netman
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	57
Start time:	16:57:44
Start date:	18/07/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s NetSetupSvc
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	58
Start time:	16:57:45
Start date:	18/07/2024
Path:	C:\Windows\System32\wbem\WmiApSrv.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wbem\WmiApSrv.exe
Imagebase:	0x7ff7b95c0000
File size:	209'920 bytes
MD5 hash:	9A48D32D7DBA794A40BF030DA500603B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	59
Start time:	16:57:47
Start date:	18/07/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"cmd.exe" /C ipconfig /all
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	60
Start time:	16:57:47
Start date:	18/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	61
Start time:	16:57:48
Start date:	18/07/2024
Path:	C:\Windows\SysWOW64\ipconfig.exe
Wow64 process (32bit):	true
Commandline:	ipconfig /all
Imagebase:	0x3b0000
File size:	29'184 bytes
MD5 hash:	3A3B9A5E00EF6A3F83BF300E2B6B67BB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	62
Start time:	16:57:48
Start date:	18/07/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"cmd.exe" /C route print
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	63
Start time:	16:57:48
Start date:	18/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	4.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	2.4%
Total number of Nodes:	1039
Total number of Limit Nodes:	21

Executed Functions

Function 00BC4318 Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 271
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3_GS.LIBCMT ref: 00BC4322

Part of subcall function 00BC42D2: GetModuleHandleW.KERNEL32(00000000,00000000,00000208,00000000,00BC434F,000003D4,00BC481F,00000000), ref: 00BC42E9
Part of subcall function 00BC42D2: GetModuleFileNameW.KERNEL32(00000000), ref: 00BC42F0
Part of subcall function 00BC42D2: _wcsrchr.LIBVCRUNTIME ref: 00BC42F9

FindFirstFileW.KERNELBASE(?,?), ref: 00BC438F
FindNextFileW.KERNELBASE(?,00000010,?,00000000,?,00000000,?), ref: 00BC45D4

Part of subcall function 00BC6FD4: _Deallocate.LIBCONCRT ref: 00BC6FE9

Strings

0.0.0, xrefs: 00BC43C2, 00BC45E8
\app-*, xrefs: 00BC435A

Memory Dump Source

Source File: 00000003.00000002.1723702490.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000003.00000002.1723587742.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1724304213.0000000000BDD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1724352252.0000000000BED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1724391802.0000000000BF0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_bc0000_LetsPRO.jbxd

Similarity

API ID: File$FindModule$DeallocateFirstH_prolog3_HandleNameNext_wcsrchr
String ID: 0.0.0$\app-*
API String ID: 2169317967-1017646277
Opcode ID: 5cf762c1643386a33f7c265fc8e64bbac033df70e9c79c960f16ed273f132f18
Instruction ID: 2c0cdcb593a19ec58b4781b0ce7d6dd38585eaa50bb41dbe5208dac076176784
Opcode Fuzzy Hash: 5cf762c1643386a33f7c265fc8e64bbac033df70e9c79c960f16ed273f132f18
Instruction Fuzzy Hash: F5C1F571900258DACF25EBA4C895FDDBBF8AF18314F5445EDE105A2182DB746B89CF20

Function 00BCEDE2 Relevance: 4.5, APIs: 3, Instructions: 20
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(?,?,00BCEDE1,?,00000000,?,?,?,00BCD624), ref: 00BCEE04
TerminateProcess.KERNEL32(00000000,?,00BCEDE1,?,00000000,?,?,?,00BCD624), ref: 00BCEE0B
ExitProcess.KERNEL32 ref: 00BCEE1D

Memory Dump Source

Source File: 00000003.00000002.1723702490.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000003.00000002.1723587742.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1724304213.0000000000BDD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1724352252.0000000000BED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1724391802.0000000000BF0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_bc0000_LetsPRO.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 5173dd8a91f2420264851eef601430c5ba0e08e38616efe82ca346578f03b967
Instruction ID: f3e622a97c0d6eccc6375fcb698f7e5a55dd6a79685d70b6b8a5d9f2a31b9729
Opcode Fuzzy Hash: 5173dd8a91f2420264851eef601430c5ba0e08e38616efe82ca346578f03b967
Instruction Fuzzy Hash: 0EE04632041548EBCF212F24DC28E097BA9FB84381F044059F8148B132EF35EC92CB50

Function 00BD5217 Relevance: .0, Instructions: 23
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000003.00000002.1723702490.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000003.00000002.1723587742.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1724304213.0000000000BDD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1724352252.0000000000BED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1724391802.0000000000BF0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_bc0000_LetsPRO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e89b6706afbc40c3721c8b860d8f4302f0c235f5563ec4a2a795c1c095ad78e4
Instruction ID: e823cf67bc2f4c41186e13c541c0a7c4aef00d5b9bc0eb75884eb938ecc248ec
Opcode Fuzzy Hash: e89b6706afbc40c3721c8b860d8f4302f0c235f5563ec4a2a795c1c095ad78e4
Instruction Fuzzy Hash: F6E04632921268EBC724DB88CA0499AF3ECEB09B51B1101EBB908D3200D270AE44C7D0

Function 00BD1EBC Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 78
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

api-ms-, xrefs: 00BD1F13
ext-ms-, xrefs: 00BD1F27

Memory Dump Source

Source File: 00000003.00000002.1723702490.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000003.00000002.1723587742.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1724304213.0000000000BDD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1724352252.0000000000BED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1724391802.0000000000BF0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_bc0000_LetsPRO.jbxd

Similarity

API ID:
String ID: api-ms-$ext-ms-
API String ID: 0-537541572
Opcode ID: db726ccb8b5e840e0d47dea00c00973bb16f0dd69f45cde14f12474abaa7c857
Instruction ID: fc9d571aeb3876a56492b7a64194d1c613b531e77643f5cc5361a2980d97ba3f
Opcode Fuzzy Hash: db726ccb8b5e840e0d47dea00c00973bb16f0dd69f45cde14f12474abaa7c857
Instruction Fuzzy Hash: B221A131A05225BBDB319B299CC0A2AF7D9DB41B70F2509A3ED55AB390FB30DD0086E0

Function 00BC477D Relevance: 9.2, APIs: 6, Instructions: 153
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(00000000,00000000), ref: 00BC47D4
GetModuleFileNameW.KERNEL32(00000000), ref: 00BC47DB
_wcsrchr.LIBVCRUNTIME ref: 00BC47E4
CreateProcessW.KERNELBASE(00000000,00000000,00000000,00000000,00000001,00000000,00000000,00000000,?,?,?,00BE9A0C,00000002,?,00BE9A08), ref: 00BC492B
AllowSetForegroundWindow.USER32(?), ref: 00BC493E
WaitForInputIdle.USER32(?,00001388), ref: 00BC494D

Part of subcall function 00BC6FD4: _Deallocate.LIBCONCRT ref: 00BC6FE9

Memory Dump Source

Source File: 00000003.00000002.1723702490.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000003.00000002.1723587742.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1724304213.0000000000BDD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1724352252.0000000000BED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1724391802.0000000000BF0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_bc0000_LetsPRO.jbxd

Similarity

API ID: Module$AllowCreateDeallocateFileForegroundHandleIdleInputNameProcessWaitWindow_wcsrchr
String ID:
API String ID: 2344006830-0
Opcode ID: e09dd4d5f8faee33b3f8463ee681970ad4acfd281c235df8afc97b3945b311b3
Instruction ID: a5cb3e635064ad1316ca94c617e8abd0095094551276dad150cdee9e6e6cceb2
Opcode Fuzzy Hash: e09dd4d5f8faee33b3f8463ee681970ad4acfd281c235df8afc97b3945b311b3
Instruction Fuzzy Hash: 67513D715083849FD324EF64DC96F9BB7E8EF94314F00496EF59982191EF70A909CB62

Function 00BD1F85 Relevance: 3.1, APIs: 2, Instructions: 57
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000003.00000002.1723702490.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000003.00000002.1723587742.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1724304213.0000000000BDD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1724352252.0000000000BED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1724391802.0000000000BF0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_bc0000_LetsPRO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9346f377f63c221536b49ceff3bbd296ea491a4cf615085b75f282364c8ad7a9
Instruction ID: e47487301c9aa021fefd0e785950e5d0ec735254df293e9118c9e40298442a3c
Opcode Fuzzy Hash: 9346f377f63c221536b49ceff3bbd296ea491a4cf615085b75f282364c8ad7a9
Instruction Fuzzy Hash: A701F1336042516BAB1ACF6DEDA095AB3E6EBC0720B248566F915CF294EF30C842C680

Function 00BD64DE Relevance: 1.6, APIs: 1, Instructions: 53
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00BD1676: RtlAllocateHeap.NTDLL(00000008,?,00000000,?,00BD14E4,00000001,00000364,00000005,000000FF,?,00BC9734,5A413932,5A413930,?,00000000), ref: 00BD16B7

_free.LIBCMT ref: 00BD654D

Memory Dump Source

Source File: 00000003.00000002.1723702490.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000003.00000002.1723587742.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1724304213.0000000000BDD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1724352252.0000000000BED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1724391802.0000000000BF0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_bc0000_LetsPRO.jbxd

Similarity

API ID: AllocateHeap_free
String ID:
API String ID: 614378929-0
Opcode ID: 9904d5407535d0d78bfafd2e59d70786fda79d465fa18a0c814be741a9d63877
Instruction ID: 9868502fbbaf30ed062d09665a17d17d1e620f6cc0f0bf2a361c5fa41888e0ee
Opcode Fuzzy Hash: 9904d5407535d0d78bfafd2e59d70786fda79d465fa18a0c814be741a9d63877
Instruction Fuzzy Hash: FC012B7260435A6BD331CF58D881999FBD8EB55370F1406AAE945A7780F7706D10CBA0

Function 00BD1676 Relevance: 1.5, APIs: 1, Instructions: 39
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,00BD14E4,00000001,00000364,00000005,000000FF,?,00BC9734,5A413932,5A413930,?,00000000), ref: 00BD16B7

Memory Dump Source

Source File: 00000003.00000002.1723702490.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000003.00000002.1723587742.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1724304213.0000000000BDD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1724352252.0000000000BED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1724391802.0000000000BF0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_bc0000_LetsPRO.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 14d3054877345e00cbf4e9297eafe814f472b1dd6d70f3b6aaa7f14f933a153a
Instruction ID: 485ec22cd44382746a5cc44a11149de78f90e38e305c18a891e808092b0e3a5f
Opcode Fuzzy Hash: 14d3054877345e00cbf4e9297eafe814f472b1dd6d70f3b6aaa7f14f933a153a
Instruction Fuzzy Hash: 05F05435645125779B216E6A9C05F6AFBDAEF81B60B1D45F3F808A7390FE20DC0186E4

Non-executed Functions

Function 00BD8584 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 86COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,?,00000002), ref: 00BD861D
GetLocaleInfoW.KERNEL32(?,20001004,?,00000002), ref: 00BD8646
GetACP.KERNEL32 ref: 00BD865B

Strings

OCP, xrefs: 00BD85D8
ACP, xrefs: 00BD85A2

Memory Dump Source

Source File: 00000003.00000002.1723702490.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000003.00000002.1723587742.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1724304213.0000000000BDD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1724352252.0000000000BED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1724391802.0000000000BF0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_bc0000_LetsPRO.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: a29fd379e73281475ff4c3f2b42ca328d36d650c5f4e79890e87b9885231c4d9
Instruction ID: a9b9d82af185b936e6f30057f5e05d998ef3b8447b824587aebbd1c1d2bf8747
Opcode Fuzzy Hash: a29fd379e73281475ff4c3f2b42ca328d36d650c5f4e79890e87b9885231c4d9
Instruction Fuzzy Hash: 4121B322A00100AADB309F25D945AA7F7E6EB64F76B5684E7E90AC7300FF32DD41C750

Function 00BD875F Relevance: 7.7, APIs: 5, Instructions: 184COMMON

Download Yara Rule

APIs

Part of subcall function 00BD1342: GetLastError.KERNEL32(?,?,?,00BCD8AC,?,00000000,?,?,00BCD624,00BCDA3F,00000000,?), ref: 00BD1347
Part of subcall function 00BD1342: SetLastError.KERNEL32(00000000,00000005,000000FF,?,?,00BCD624,00BCDA3F,00000000,?), ref: 00BD13E5

Part of subcall function 00BD1342: _free.LIBCMT ref: 00BD13A4
Part of subcall function 00BD1342: _free.LIBCMT ref: 00BD13DA

GetUserDefaultLCID.KERNEL32 ref: 00BD886B
IsValidCodePage.KERNEL32(00000000), ref: 00BD88B6
IsValidLocale.KERNEL32(?,00000001), ref: 00BD88C5
GetLocaleInfoW.KERNEL32(?,00001001,?,00000040,?,?,00000055,00000000,?,?,00000055,00000000), ref: 00BD890D
GetLocaleInfoW.KERNEL32(?,00001002,?,00000040), ref: 00BD892C

Memory Dump Source

Source File: 00000003.00000002.1723702490.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000003.00000002.1723587742.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1724304213.0000000000BDD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1724352252.0000000000BED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1724391802.0000000000BF0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_bc0000_LetsPRO.jbxd

Similarity

API ID: Locale$ErrorInfoLastValid_free$CodeDefaultPageUser
String ID:
API String ID: 949163717-0
Opcode ID: 8ede1ef5d4c4bf48828d230e41bde006ecace550d160a1c5f06c62da2d5f02df
Instruction ID: 93fee388ef394d5977421242d90254caa3d16e873e0e2eb164a7340f70f821fa
Opcode Fuzzy Hash: 8ede1ef5d4c4bf48828d230e41bde006ecace550d160a1c5f06c62da2d5f02df
Instruction Fuzzy Hash: 4C516D72900209AADB10EFA5CC41ABAF7F9FF58702F5444AAA914EB250FF7199049B60

Function 00BD8207 Relevance: 4.7, APIs: 3, Instructions: 206COMMON

Download Yara Rule

APIs

Part of subcall function 00BD1342: GetLastError.KERNEL32(?,?,?,00BCD8AC,?,00000000,?,?,00BCD624,00BCDA3F,00000000,?), ref: 00BD1347
Part of subcall function 00BD1342: SetLastError.KERNEL32(00000000,00000005,000000FF,?,?,00BCD624,00BCDA3F,00000000,?), ref: 00BD13E5

Part of subcall function 00BD1342: _free.LIBCMT ref: 00BD13A4
Part of subcall function 00BD1342: _free.LIBCMT ref: 00BD13DA

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00BD825B
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00BD82A5
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00BD836B

Memory Dump Source

Source File: 00000003.00000002.1723702490.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000003.00000002.1723587742.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1724304213.0000000000BDD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1724352252.0000000000BED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1724391802.0000000000BF0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_bc0000_LetsPRO.jbxd

Similarity

API ID: InfoLocale$ErrorLast_free
String ID:
API String ID: 3140898709-0
Opcode ID: dbe1782a53723498f56f3d70639c0bdee5e3d6a282d6498b277949c43103a4b5
Instruction ID: 13d7709c978d3daf34e3df9dc8993179edca40dc7293f4fe02afb36aeca388ff
Opcode Fuzzy Hash: dbe1782a53723498f56f3d70639c0bdee5e3d6a282d6498b277949c43103a4b5
Instruction Fuzzy Hash: DD617C715406079BDB689F28CC82BAAF7E8EF04752F1041EBE919C6781FB34D985CB54

Function 00BCDAD2 Relevance: 4.6, APIs: 3, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,00BC717D), ref: 00BCDBCA
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,00BC717D), ref: 00BCDBD4
UnhandledExceptionFilter.KERNEL32(5A413608,?,?,?,?,?,00BC717D), ref: 00BCDBE1

Memory Dump Source

Source File: 00000003.00000002.1723702490.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000003.00000002.1723587742.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1724304213.0000000000BDD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1724352252.0000000000BED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1724391802.0000000000BF0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_bc0000_LetsPRO.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: b654df345dfda31cfc33523c32a1a972db622ddb005a69e3dbb86e39d8449342
Instruction ID: aac554afd597243906bf948218b3cea5af01e3a28d8e5d1e8dcd696ad909d8a9
Opcode Fuzzy Hash: b654df345dfda31cfc33523c32a1a972db622ddb005a69e3dbb86e39d8449342
Instruction Fuzzy Hash: 5B31B27490121CABCB21DF68D989B9DBBF8EF48310F5041EAE81CA7250EB749F858F45

Function 00BD2D55 Relevance: 1.8, APIs: 1, Instructions: 274COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,?,?,?,00BD2D50,?,?,?,?,?,?,00000000), ref: 00BD2F82

Memory Dump Source

Source File: 00000003.00000002.1723702490.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000003.00000002.1723587742.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1724304213.0000000000BDD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1724352252.0000000000BED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1724391802.0000000000BF0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_bc0000_LetsPRO.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: be1a933b0f33982e37a3eb428a31faba8f2129868ce24aa20ce0b12fcf552a60
Instruction ID: e2c15dbd98e02471c4e89104728b2fe50bf6d669497b72f9ca1ad0976636ef82
Opcode Fuzzy Hash: be1a933b0f33982e37a3eb428a31faba8f2129868ce24aa20ce0b12fcf552a60
Instruction Fuzzy Hash: 3DB15D35610644CFD719CF28C486B64BBE0FF55364F258699E899CF3A2D335EA82CB40

Function 00BD845C Relevance: 1.6, APIs: 1, Instructions: 84COMMON

Download Yara Rule

APIs

Part of subcall function 00BD1342: GetLastError.KERNEL32(?,?,?,00BCD8AC,?,00000000,?,?,00BCD624,00BCDA3F,00000000,?), ref: 00BD1347
Part of subcall function 00BD1342: SetLastError.KERNEL32(00000000,00000005,000000FF,?,?,00BCD624,00BCDA3F,00000000,?), ref: 00BD13E5

Part of subcall function 00BD1342: _free.LIBCMT ref: 00BD13A4
Part of subcall function 00BD1342: _free.LIBCMT ref: 00BD13DA

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00BD84B0

Memory Dump Source

Source File: 00000003.00000002.1723702490.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000003.00000002.1723587742.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1724304213.0000000000BDD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1724352252.0000000000BED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1724391802.0000000000BF0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_bc0000_LetsPRO.jbxd

Similarity

API ID: ErrorLast_free$InfoLocale
String ID:
API String ID: 2003897158-0
Opcode ID: ab7cbb55bded6cb534ad7c60229798da56c3c44f0badde0c3fa167ab9dcc205c
Instruction ID: 21bd835ec81c044745cb46a54c2b5b52c0c067c079c0257bd3f34bd2d5c0e9c5
Opcode Fuzzy Hash: ab7cbb55bded6cb534ad7c60229798da56c3c44f0badde0c3fa167ab9dcc205c
Instruction Fuzzy Hash: 7A218E72615206ABDB289A25EC52ABAB3E8EF54315F1001FBFD05DB341FF34AD418B50

Function 00BD80E1 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

Part of subcall function 00BD1342: GetLastError.KERNEL32(?,?,?,00BCD8AC,?,00000000,?,?,00BCD624,00BCDA3F,00000000,?), ref: 00BD1347
Part of subcall function 00BD1342: SetLastError.KERNEL32(00000000,00000005,000000FF,?,?,00BCD624,00BCDA3F,00000000,?), ref: 00BD13E5

EnumSystemLocalesW.KERNEL32(00BD8207,00000001), ref: 00BD8153

Memory Dump Source

Source File: 00000003.00000002.1723702490.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000003.00000002.1723587742.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1724304213.0000000000BDD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1724352252.0000000000BED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1724391802.0000000000BF0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_bc0000_LetsPRO.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: ec3e5f6d08d95c2d632363c296cd21c7a3cb60b0b0e480cd4e7dd0dfe9a115ba
Instruction ID: dca15bcc649311302be04546299099f75fb5a98fa10c590e7dcd38dd428a5f5c
Opcode Fuzzy Hash: ec3e5f6d08d95c2d632363c296cd21c7a3cb60b0b0e480cd4e7dd0dfe9a115ba
Instruction Fuzzy Hash: 8111293A2007019FDB189F38C8A16BAF7D1FF84369B15442EE98697B40E7717807C740

Function 00BD868C Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

APIs

Part of subcall function 00BD1342: GetLastError.KERNEL32(?,?,?,00BCD8AC,?,00000000,?,?,00BCD624,00BCDA3F,00000000,?), ref: 00BD1347
Part of subcall function 00BD1342: SetLastError.KERNEL32(00000000,00000005,000000FF,?,?,00BCD624,00BCDA3F,00000000,?), ref: 00BD13E5

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,00BD8423,00000000,00000000,?), ref: 00BD86B8

Memory Dump Source

Source File: 00000003.00000002.1723702490.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000003.00000002.1723587742.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1724304213.0000000000BDD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1724352252.0000000000BED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1724391802.0000000000BF0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_bc0000_LetsPRO.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 3a7a891c25593539c871bbb92a3012c0fcac4b82dd8a00d313d269c892c9f953
Instruction ID: 9905c25b5f0d58a84873edc170dd9fda428cd4fd6f1dc2a86a7caaee1a64afac
Opcode Fuzzy Hash: 3a7a891c25593539c871bbb92a3012c0fcac4b82dd8a00d313d269c892c9f953
Instruction Fuzzy Hash: EEF0D632500115BBDB245A64C805ABBBB98EB40775F0544AAEC05A3640FE70ED01C694

Function 00BD817C Relevance: 1.5, APIs: 1, Instructions: 41COMMON

Download Yara Rule

APIs

Part of subcall function 00BD1342: GetLastError.KERNEL32(?,?,?,00BCD8AC,?,00000000,?,?,00BCD624,00BCDA3F,00000000,?), ref: 00BD1347
Part of subcall function 00BD1342: SetLastError.KERNEL32(00000000,00000005,000000FF,?,?,00BCD624,00BCDA3F,00000000,?), ref: 00BD13E5

EnumSystemLocalesW.KERNEL32(00BD845C,00000001), ref: 00BD81C6

Memory Dump Source

Source File: 00000003.00000002.1723702490.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000003.00000002.1723587742.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1724304213.0000000000BDD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1724352252.0000000000BED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1724391802.0000000000BF0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_bc0000_LetsPRO.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 1741f3bf8a6fb99de3259756b0b00a47249ce11c2813c620c968dfbd5f90f6ba
Instruction ID: d18a71e76db5a79a506751e12508e1f11b7ec6c3a5d6a4e2db42e88780d5672c
Opcode Fuzzy Hash: 1741f3bf8a6fb99de3259756b0b00a47249ce11c2813c620c968dfbd5f90f6ba
Instruction Fuzzy Hash: 45F0C8362003056FD7145F35988166ABBD1FF85769F0544AEF94957B50EA715C02C650

Function 00BD808C Relevance: 1.5, APIs: 1, Instructions: 32COMMON

Download Yara Rule

APIs

Part of subcall function 00BD1342: GetLastError.KERNEL32(?,?,?,00BCD8AC,?,00000000,?,?,00BCD624,00BCDA3F,00000000,?), ref: 00BD1347
Part of subcall function 00BD1342: SetLastError.KERNEL32(00000000,00000005,000000FF,?,?,00BCD624,00BCDA3F,00000000,?), ref: 00BD13E5

EnumSystemLocalesW.KERNEL32(00BD7FED,00000001), ref: 00BD80CD

Memory Dump Source

Source File: 00000003.00000002.1723702490.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000003.00000002.1723587742.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1724304213.0000000000BDD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1724352252.0000000000BED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1724391802.0000000000BF0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_bc0000_LetsPRO.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: e691a504568baf0af6de15e0d0e599f630490b60b78a5fb49d214ae027521db1
Instruction ID: f007f6cb45f4f456a06a038241da16c18d685aeb82ced7428dfa451acb058847
Opcode Fuzzy Hash: e691a504568baf0af6de15e0d0e599f630490b60b78a5fb49d214ae027521db1
Instruction Fuzzy Hash: 6DF0273538424597CB049F38E8586AAFBA0EFC1310F0A80DBEE09CBA91EA758842C750

Function 00BD8096 Relevance: 1.5, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 00BD1342: GetLastError.KERNEL32(?,?,?,00BCD8AC,?,00000000,?,?,00BCD624,00BCDA3F,00000000,?), ref: 00BD1347
Part of subcall function 00BD1342: SetLastError.KERNEL32(00000000,00000005,000000FF,?,?,00BCD624,00BCDA3F,00000000,?), ref: 00BD13E5

EnumSystemLocalesW.KERNEL32(00BD7FED,00000001), ref: 00BD80CD

Memory Dump Source

Source File: 00000003.00000002.1723702490.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000003.00000002.1723587742.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1724304213.0000000000BDD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1724352252.0000000000BED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1724391802.0000000000BF0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_bc0000_LetsPRO.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 0caf64b22e42f7735e8b67e303c70054414a48de6ac41de445df241218b3774e
Instruction ID: 7424a2ab81859612f34344b5ad10d0200ecf230a0dfd300111f175a0f79c516b
Opcode Fuzzy Hash: 0caf64b22e42f7735e8b67e303c70054414a48de6ac41de445df241218b3774e
Instruction Fuzzy Hash: FAF0E53634020967CB14AF39D855A6AFFD4EFC1721F06409AEA09CBB50EA719842C794

Function 00BD1CFD Relevance: 1.5, APIs: 1, Instructions: 27COMMON

Download Yara Rule

APIs

Part of subcall function 00BCE073: EnterCriticalSection.KERNEL32(-00027A33,?,00BCF91F,00000000,00BEC000,0000000C,00BCF8E6,?,?,00BD16A9,?,?,00BD14E4,00000001,00000364,00000005), ref: 00BCE082

EnumSystemLocalesW.KERNEL32(Function_00011CF0,00000001,00BEC128,0000000C,00BD2097,?), ref: 00BD1D35

Memory Dump Source

Source File: 00000003.00000002.1723702490.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000003.00000002.1723587742.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1724304213.0000000000BDD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1724352252.0000000000BED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1724391802.0000000000BF0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_bc0000_LetsPRO.jbxd

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: fc44cdfcdae697fec3866b5656758e233c0e75030c412e0a053b3985e31fa255
Instruction ID: 5927f3d028db0eadcca597259648a5b7ed13e91a8cfa78ca73cbf44e4af5d1a0
Opcode Fuzzy Hash: fc44cdfcdae697fec3866b5656758e233c0e75030c412e0a053b3985e31fa255
Instruction Fuzzy Hash: 79F0FE75951204EFD710EFA8D886F5D7BF1EB04720F10819AF418EF2A2DBB84A458F91

Function 00BD219D Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,00000002,00000000,?,20001004,?,?,?,00BD02E9,?,20001004,?,00000002,00000000,?,?), ref: 00BD21D1

Memory Dump Source

Source File: 00000003.00000002.1723702490.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000003.00000002.1723587742.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1724304213.0000000000BDD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1724352252.0000000000BED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1724391802.0000000000BF0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_bc0000_LetsPRO.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 19f53cbf3ad20a93d048b4ea22a7848198a280339eba53f14f0716998b8adc98
Instruction ID: 51d671e23194765deb3622b2ee4f40cea7af593b889db88a57a201b3adae440b
Opcode Fuzzy Hash: 19f53cbf3ad20a93d048b4ea22a7848198a280339eba53f14f0716998b8adc98
Instruction Fuzzy Hash: 55E04F36501158FBCF122F61DC05AAEFF6AEF547A0F008052FE4566321EB328921AAE4

Function 00BC8FC5 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_00008FD1,00BC86A2), ref: 00BC8FCA

Memory Dump Source

Source File: 00000003.00000002.1723702490.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000003.00000002.1723587742.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1724304213.0000000000BDD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1724352252.0000000000BED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1724391802.0000000000BF0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_bc0000_LetsPRO.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 7b52e851a7c3df3486bfeb0f388cdb9e885c9ee71b2e6d24bbdafbcd06d7f239
Instruction ID: 62de194e440e867df3388183c2d172f5e099122cf28be2c75ab5921bfacee3bd
Opcode Fuzzy Hash: 7b52e851a7c3df3486bfeb0f388cdb9e885c9ee71b2e6d24bbdafbcd06d7f239
Instruction Fuzzy Hash:

Function 00BD605E Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00BD605E

Memory Dump Source

Source File: 00000003.00000002.1723702490.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000003.00000002.1723587742.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1724304213.0000000000BDD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1724352252.0000000000BED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1724391802.0000000000BF0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_bc0000_LetsPRO.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 4fbc5789933b447e622bc059eb9326661b42749fcf17f2c8340666f0d89788a9
Instruction ID: 1c4d34015791910d74e19e38cb328290e1dcaa93db8b97ba741a77d7357329ed
Opcode Fuzzy Hash: 4fbc5789933b447e622bc059eb9326661b42749fcf17f2c8340666f0d89788a9
Instruction Fuzzy Hash: D3A00270502142CB57404F355D5561976A9758559171541656445C6160FF2444515619

Function 00BD3929 Relevance: .6, Instructions: 637COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1723702490.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000003.00000002.1723587742.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1724304213.0000000000BDD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1724352252.0000000000BED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1724391802.0000000000BF0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_bc0000_LetsPRO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d965f36b930b61ae05da8586c8ddd54c61401145913bb2f120d591bfded164eb
Instruction ID: c4b55fe2e82e315535c0b94aafdfda28e422dc16618572a52b6e76094b067ec3
Opcode Fuzzy Hash: d965f36b930b61ae05da8586c8ddd54c61401145913bb2f120d591bfded164eb
Instruction Fuzzy Hash: D2320422D29F814ED7239634C962335A2DCAFB73D4F15D737E819B5AA6EF29C4834101

Function 00BCAED0 Relevance: .3, Instructions: 254COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1723702490.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000003.00000002.1723587742.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1724304213.0000000000BDD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1724352252.0000000000BED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1724391802.0000000000BF0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_bc0000_LetsPRO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93657a121f16255c59120ad0d08fdbba6372c273009ad596b4ecdf6e8f3c6909
Instruction ID: 827b9e9a7a20bcfa374f47cc19b157ab02e7c91d5cbbea0bc2fe4c354a653313
Opcode Fuzzy Hash: 93657a121f16255c59120ad0d08fdbba6372c273009ad596b4ecdf6e8f3c6909
Instruction Fuzzy Hash: 6F9175722080A74ADB2D463A8475E3EFFE1DA513A571A07DDE4F3CB1C1EE24D964E620

Function 00BCB18B Relevance: .2, Instructions: 244COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1723702490.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000003.00000002.1723587742.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1724304213.0000000000BDD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1724352252.0000000000BED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1724391802.0000000000BF0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_bc0000_LetsPRO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05e0b846b00456d0f1e87463b9d189974beed2fe63262d4392584e128a114ea2
Instruction ID: 1accb7d963a0d0e863c19874a1a253bb2aa4934e8d5ad66b312e6963e1a3cc82
Opcode Fuzzy Hash: 05e0b846b00456d0f1e87463b9d189974beed2fe63262d4392584e128a114ea2
Instruction Fuzzy Hash: DE9164722080E34ADB2D467A8475E3EFFE19A923A171A07DDD4F2CE1C5EF14D954E620

Function 00BCAC09 Relevance: .2, Instructions: 240COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1723702490.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000003.00000002.1723587742.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1724304213.0000000000BDD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1724352252.0000000000BED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1724391802.0000000000BF0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_bc0000_LetsPRO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40101273f58913c3cb3bc7eb54df01d47b4121c3e67d19f11ec2cb23d33ea445
Instruction ID: 52337e03c79b0818a01af0c51f41a2f84bf20c392d497fe92ef947491e5fc619
Opcode Fuzzy Hash: 40101273f58913c3cb3bc7eb54df01d47b4121c3e67d19f11ec2cb23d33ea445
Instruction Fuzzy Hash: FE9186722090A74ADB2D823D8974A3EFFE1DB513AA31A07EDD4F3CA1C1ED14D954E621

Function 00BCA95F Relevance: .2, Instructions: 232COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1723702490.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000003.00000002.1723587742.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1724304213.0000000000BDD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1724352252.0000000000BED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1724391802.0000000000BF0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_bc0000_LetsPRO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70da388f96bbbf26b230a155b4728740b34f0d100ea60ab2bbadb9d7d0befbf0
Instruction ID: 561a0d2177b3596264776f4d6844183f1c6628e9ac00c13850aa91dfc55712a5
Opcode Fuzzy Hash: 70da388f96bbbf26b230a155b4728740b34f0d100ea60ab2bbadb9d7d0befbf0
Instruction Fuzzy Hash: 038199722090AB4EDB2D42398574A3EFFE1DA513A931A07DDE4F3CB1C1ED20D954E621

Function 00BCA540 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1723702490.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000003.00000002.1723587742.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1724304213.0000000000BDD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1724352252.0000000000BED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1724391802.0000000000BF0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_bc0000_LetsPRO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: 05c88f9dd5d19c085e4df82f4b06a730326cdf08cc8ddce21eaf45e82960eb6f
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: 9411387764008943D6058A3DC4F8FBAF3D5EBF932972DC3EED0524F658D522E942A602

Function 00BCE160 Relevance: 22.8, APIs: 15, Instructions: 343COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00BCE1D0
_free.LIBCMT ref: 00BCE1E5
_free.LIBCMT ref: 00BCE1FA
_free.LIBCMT ref: 00BCE20F
_free.LIBCMT ref: 00BCE224
GetCPInfo.KERNEL32(?,?), ref: 00BCE26E

Part of subcall function 00BD24EC: _free.LIBCMT ref: 00BD2557

_free.LIBCMT ref: 00BCE4B2
_free.LIBCMT ref: 00BCE4C5
_free.LIBCMT ref: 00BCE4D3
_free.LIBCMT ref: 00BCE4DE
_free.LIBCMT ref: 00BCE520
_free.LIBCMT ref: 00BCE528
_free.LIBCMT ref: 00BCE530
_free.LIBCMT ref: 00BCE538
_free.LIBCMT ref: 00BCE546

Memory Dump Source

Source File: 00000003.00000002.1723702490.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000003.00000002.1723587742.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1724304213.0000000000BDD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1724352252.0000000000BED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1724391802.0000000000BF0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_bc0000_LetsPRO.jbxd

Similarity

API ID: _free$Info
String ID:
API String ID: 2509303402-0
Opcode ID: b0f3c7a6e1a5c9702099b1a9dec59ba8f16c73d3e0415576bdbce1eb29890fe7
Instruction ID: b03352949e7819ff2a400c7ba4ffc77c34fc1ad20e8778f2fc43a8c96925d571
Opcode Fuzzy Hash: b0f3c7a6e1a5c9702099b1a9dec59ba8f16c73d3e0415576bdbce1eb29890fe7
Instruction Fuzzy Hash: 1CD17D71E00245DFDB21DFA8C881BAEBBF5FF18300F1444ADE965AB342E674A945CB60

Function 00BD73D1 Relevance: 19.6, APIs: 13, Instructions: 114COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 00BD7415

Part of subcall function 00BD6765: _free.LIBCMT ref: 00BD6782
Part of subcall function 00BD6765: _free.LIBCMT ref: 00BD6794
Part of subcall function 00BD6765: _free.LIBCMT ref: 00BD67A6
Part of subcall function 00BD6765: _free.LIBCMT ref: 00BD67B8
Part of subcall function 00BD6765: _free.LIBCMT ref: 00BD67CA
Part of subcall function 00BD6765: _free.LIBCMT ref: 00BD67DC
Part of subcall function 00BD6765: _free.LIBCMT ref: 00BD67EE
Part of subcall function 00BD6765: _free.LIBCMT ref: 00BD6800
Part of subcall function 00BD6765: _free.LIBCMT ref: 00BD6812
Part of subcall function 00BD6765: _free.LIBCMT ref: 00BD6824
Part of subcall function 00BD6765: _free.LIBCMT ref: 00BD6836
Part of subcall function 00BD6765: _free.LIBCMT ref: 00BD6848
Part of subcall function 00BD6765: _free.LIBCMT ref: 00BD685A

_free.LIBCMT ref: 00BD740A

Part of subcall function 00BD15EE: HeapFree.KERNEL32(00000000,00000000,?,00BD6EC0,?,00000000,?,5A413932,?,00BD7165,?,00000007,?,?,00BD756A,?), ref: 00BD1604
Part of subcall function 00BD15EE: GetLastError.KERNEL32(?,?,00BD6EC0,?,00000000,?,5A413932,?,00BD7165,?,00000007,?,?,00BD756A,?,?), ref: 00BD1616

_free.LIBCMT ref: 00BD742C
_free.LIBCMT ref: 00BD7441
_free.LIBCMT ref: 00BD744C
_free.LIBCMT ref: 00BD746E
_free.LIBCMT ref: 00BD7481
_free.LIBCMT ref: 00BD748F
_free.LIBCMT ref: 00BD749A
_free.LIBCMT ref: 00BD74D2
_free.LIBCMT ref: 00BD74D9
_free.LIBCMT ref: 00BD74F6
_free.LIBCMT ref: 00BD750E

Memory Dump Source

Source File: 00000003.00000002.1723702490.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000003.00000002.1723587742.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1724304213.0000000000BDD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1724352252.0000000000BED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1724391802.0000000000BF0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_bc0000_LetsPRO.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: 5fe7699fd2e126df5450ec80d3efee873485b5a210cd827932f7af19d170af91
Instruction ID: 31c7924e273fa86a7fb94c4062fbf4f41f70f3e4cef85a62bd10dc1f9e30f6fd
Opcode Fuzzy Hash: 5fe7699fd2e126df5450ec80d3efee873485b5a210cd827932f7af19d170af91
Instruction Fuzzy Hash: 42317E31A88204AFDB22AA79E905B96FBE9FF50314F14489BE859D7351FF34AD50CB10

Function 00BD6863 Relevance: 18.4, APIs: 12, Instructions: 375COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00BD68AB
_free.LIBCMT ref: 00BD68CF
_free.LIBCMT ref: 00BD68DC
_free.LIBCMT ref: 00BD6901
_free.LIBCMT ref: 00BD690E
_free.LIBCMT ref: 00BD6917
_free.LIBCMT ref: 00BD6BF2
_free.LIBCMT ref: 00BD6BFA

Memory Dump Source

Source File: 00000003.00000002.1723702490.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000003.00000002.1723587742.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1724304213.0000000000BDD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1724352252.0000000000BED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1724391802.0000000000BF0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_bc0000_LetsPRO.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 11f127590a888b02d0ed88f498cf23ce1325a26783ca6080d01218755d0750d4
Instruction ID: 7957e423d2a1b19845b2ca7ae375cd9278c3204c812c093d960238e34cf3924d
Opcode Fuzzy Hash: 11f127590a888b02d0ed88f498cf23ce1325a26783ca6080d01218755d0750d4
Instruction Fuzzy Hash: 81C10871D40204ABEB20DB98CD82FDEB7FCEB54704F144596FE05EB382E5709A419B60

Function 00BD1228 Relevance: 15.1, APIs: 10, Instructions: 70COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00BD123E

Part of subcall function 00BD15EE: HeapFree.KERNEL32(00000000,00000000,?,00BD6EC0,?,00000000,?,5A413932,?,00BD7165,?,00000007,?,?,00BD756A,?), ref: 00BD1604
Part of subcall function 00BD15EE: GetLastError.KERNEL32(?,?,00BD6EC0,?,00000000,?,5A413932,?,00BD7165,?,00000007,?,?,00BD756A,?,?), ref: 00BD1616

_free.LIBCMT ref: 00BD124A
_free.LIBCMT ref: 00BD1255
_free.LIBCMT ref: 00BD1260
_free.LIBCMT ref: 00BD126B
_free.LIBCMT ref: 00BD1276
_free.LIBCMT ref: 00BD1281
_free.LIBCMT ref: 00BD128C
_free.LIBCMT ref: 00BD1297
_free.LIBCMT ref: 00BD12A5

Memory Dump Source

Source File: 00000003.00000002.1723702490.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000003.00000002.1723587742.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1724304213.0000000000BDD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1724352252.0000000000BED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1724391802.0000000000BF0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_bc0000_LetsPRO.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: e85ec4e3b7b675ed3ac6cb3767fa01cbcbf97d24a17cc213812e8abeed8cf9be
Instruction ID: 8f24a61fe451ed957d2320b9725d69e09f959f10fb27c900867eedbfc092e36c
Opcode Fuzzy Hash: e85ec4e3b7b675ed3ac6cb3767fa01cbcbf97d24a17cc213812e8abeed8cf9be
Instruction Fuzzy Hash: AE21A676950108BFCB11EF98D841DDDBBF8FF58340B0045A6B91ADB221EB35EA94CB80

Function 00BD6C85 Relevance: 13.7, APIs: 9, Instructions: 201COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00BD6CF3
_free.LIBCMT ref: 00BD6CFF
_free.LIBCMT ref: 00BD6E28
_free.LIBCMT ref: 00BD6E33

Memory Dump Source

Source File: 00000003.00000002.1723702490.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000003.00000002.1723587742.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1724304213.0000000000BDD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1724352252.0000000000BED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1724391802.0000000000BF0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_bc0000_LetsPRO.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: f7f243aeaf26746c57b2f57db7ca2d2ef4fb641a98ab35bb40d61ba0cc3ae4f5
Instruction ID: 2c9ca606284888de96708ff2fd64c5d59f2f12e35debd8c506259e29b024b76f
Opcode Fuzzy Hash: f7f243aeaf26746c57b2f57db7ca2d2ef4fb641a98ab35bb40d61ba0cc3ae4f5
Instruction Fuzzy Hash: 4861B476A10305AFDB20DF68D881BAAF7E9EB54710F1445ABE946EB341FB70DD408B50

Function 00BD0945 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 265COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00BD1342: GetLastError.KERNEL32(?,?,?,00BCD8AC,?,00000000,?,?,00BCD624,00BCDA3F,00000000,?), ref: 00BD1347
Part of subcall function 00BD1342: SetLastError.KERNEL32(00000000,00000005,000000FF,?,?,00BCD624,00BCDA3F,00000000,?), ref: 00BD13E5

_memcmp.LIBVCRUNTIME ref: 00BD0BDE
_free.LIBCMT ref: 00BD0C52
_free.LIBCMT ref: 00BD0C6B
_free.LIBCMT ref: 00BD0CAB
_free.LIBCMT ref: 00BD0CB4
_free.LIBCMT ref: 00BD0CC0

Strings

C, xrefs: 00BD0AA1

Memory Dump Source

Source File: 00000003.00000002.1723702490.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000003.00000002.1723587742.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1724304213.0000000000BDD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1724352252.0000000000BED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1724391802.0000000000BF0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_bc0000_LetsPRO.jbxd

Similarity

API ID: _free$ErrorLast$_memcmp
String ID: C
API String ID: 4275183328-1037565863
Opcode ID: d121f3ad74408c2a372564641695d9175ae166bbe30da2bbf366e90b3173071b
Instruction ID: 508b363ba41622cd349f595959b2b3d849475e3dcee18ca572d140d2166643d6
Opcode Fuzzy Hash: d121f3ad74408c2a372564641695d9175ae166bbe30da2bbf366e90b3173071b
Instruction Fuzzy Hash: 21B10675A1121A9BDB24EF18C884BADF7F5FB58314F1445EAE80AA7350E771AE90CF40

Function 00BC2148 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00BC214F
Concurrency::cancel_current_task.LIBCPMT ref: 00BC21DD
__EH_prolog3_GS.LIBCMT ref: 00BC21EA
std::bad_exception::bad_exception.LIBCMT ref: 00BC2247

Part of subcall function 00BC985F: RaiseException.KERNEL32(?,?,00BC718B,5A413930,00000000,5A413930,?,?,?,?,?,00BC718B,5A413930,00BEBC40,?,5A413930), ref: 00BC98BF

Strings

leading 0 not allowed, xrefs: 00BC225C

Memory Dump Source

Source File: 00000003.00000002.1723702490.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000003.00000002.1723587742.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1724304213.0000000000BDD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1724352252.0000000000BED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1724391802.0000000000BF0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_bc0000_LetsPRO.jbxd

Similarity

API ID: Concurrency::cancel_current_taskExceptionH_prolog3H_prolog3_Raisestd::bad_exception::bad_exception
String ID: leading 0 not allowed
API String ID: 2170660814-1506445829
Opcode ID: 166ce9f75478901a0f4c96fc3f1ebf3020db5da27c3ce96db25ce0c95c1225c9
Instruction ID: 71dcf10559edbb49c2d0be441bab42daf39d3eaf74b8a64d2bf79ef075f02a25
Opcode Fuzzy Hash: 166ce9f75478901a0f4c96fc3f1ebf3020db5da27c3ce96db25ce0c95c1225c9
Instruction Fuzzy Hash: B7418A30A0020ADFDF18DFA4C885FAEBBF5EF45311F58409DE945AB291DB70AA41DB91

Function 00BD714C Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00BD6E96: _free.LIBCMT ref: 00BD6EBB

_free.LIBCMT ref: 00BD719A

Part of subcall function 00BD15EE: HeapFree.KERNEL32(00000000,00000000,?,00BD6EC0,?,00000000,?,5A413932,?,00BD7165,?,00000007,?,?,00BD756A,?), ref: 00BD1604
Part of subcall function 00BD15EE: GetLastError.KERNEL32(?,?,00BD6EC0,?,00000000,?,5A413932,?,00BD7165,?,00000007,?,?,00BD756A,?,?), ref: 00BD1616

_free.LIBCMT ref: 00BD71A5
_free.LIBCMT ref: 00BD71B0
_free.LIBCMT ref: 00BD7204
_free.LIBCMT ref: 00BD720F
_free.LIBCMT ref: 00BD721A
_free.LIBCMT ref: 00BD7225

Memory Dump Source

Source File: 00000003.00000002.1723702490.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000003.00000002.1723587742.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1724304213.0000000000BDD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1724352252.0000000000BED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1724391802.0000000000BF0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_bc0000_LetsPRO.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 37c7715f21742ac2474c35aae158c0e69b95db0e44448e6092e770af74b03686
Instruction ID: ac42c7c1fb9d5d5b426e573c0001dad1962aa7805e2e7454eafbebf14ae52fc2
Opcode Fuzzy Hash: 37c7715f21742ac2474c35aae158c0e69b95db0e44448e6092e770af74b03686
Instruction Fuzzy Hash: FC112C71A80B08FBE631BBB0CD06FCBF7DDAF44700F400957B69AA6252EA79B5144650

Function 00BD9E89 Relevance: 9.3, APIs: 6, Instructions: 319fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(?,00000001,00000000), ref: 00BD9ED1
__fassign.LIBCMT ref: 00BDA0B0
__fassign.LIBCMT ref: 00BDA0CD
WriteFile.KERNEL32(?,00BD620E,00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00BDA115
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 00BDA155
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000), ref: 00BDA201

Memory Dump Source

Source File: 00000003.00000002.1723702490.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000003.00000002.1723587742.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1724304213.0000000000BDD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1724352252.0000000000BED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1724391802.0000000000BF0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_bc0000_LetsPRO.jbxd

Similarity

API ID: FileWrite__fassign$ConsoleErrorLast
String ID:
API String ID: 4031098158-0
Opcode ID: 2384d52925135eed018f8fe9b13845c99c80acd6c9f241b2c722f9c27ecbce1e
Instruction ID: f9735782fec98f5cca2acf31803ac41e706d9a8e2ad11eec962cb5d2bfe0c901
Opcode Fuzzy Hash: 2384d52925135eed018f8fe9b13845c99c80acd6c9f241b2c722f9c27ecbce1e
Instruction Fuzzy Hash: 93D18671D002589FCB15CFA8C8809EDFBF5EF49314F2841AAE855FB342E631AA06CB55

Function 00BCB7E5 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00BCB7DC,00BC938B), ref: 00BCB7F3
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00BCB801
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00BCB81A
SetLastError.KERNEL32(00000000,?,00BCB7DC,00BC938B), ref: 00BCB86C

Memory Dump Source

Source File: 00000003.00000002.1723702490.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000003.00000002.1723587742.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1724304213.0000000000BDD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1724352252.0000000000BED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1724391802.0000000000BF0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_bc0000_LetsPRO.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 4fc2f609145a06fa994e3de89b4efa082f20c71213d548c66a3d58288ace6517
Instruction ID: 69d150967a9583f64e86bd987deede6486eb0e6decee7a5967f3b9cc155a7037
Opcode Fuzzy Hash: 4fc2f609145a06fa994e3de89b4efa082f20c71213d548c66a3d58288ace6517
Instruction Fuzzy Hash: A001FC376096119EA62467B97CE7F6E2BD8DB11B75F2002BEF124861F1FF918D025144

Function 00BC5AB4 Relevance: 9.1, APIs: 6, Instructions: 51COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00BC5ABB
std::_Lockit::_Lockit.LIBCPMT ref: 00BC5AC5
int.LIBCPMT ref: 00BC5ADC

Part of subcall function 00BC67C2: std::_Lockit::_Lockit.LIBCPMT ref: 00BC67D3
Part of subcall function 00BC67C2: std::_Lockit::~_Lockit.LIBCPMT ref: 00BC67ED

std::locale::_Getfacet.LIBCPMT ref: 00BC5AE5
std::_Facet_Register.LIBCPMT ref: 00BC5B16
std::_Lockit::~_Lockit.LIBCPMT ref: 00BC5B2C

Memory Dump Source

Source File: 00000003.00000002.1723702490.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000003.00000002.1723587742.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1724304213.0000000000BDD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1724352252.0000000000BED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1724391802.0000000000BF0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_bc0000_LetsPRO.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_GetfacetH_prolog3Registerstd::locale::_
String ID:
API String ID: 95072400-0
Opcode ID: 3921fb1f3af2eca6dd6563c956464788123215cade5cf6292a8254f9cade85fc
Instruction ID: 4712a4761371e176caa24bddf14259cbbd09b842eb18c606fd9e7c9a98066427
Opcode Fuzzy Hash: 3921fb1f3af2eca6dd6563c956464788123215cade5cf6292a8254f9cade85fc
Instruction Fuzzy Hash: 2C118E7290012A9BCB15EBA4CC85FED7BE4EF44310F10059DF824AB291DF709E41CBA0

Function 00BCEE24 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 31libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,00BCEE19,?,?,00BCEDE1,?,00000000,?), ref: 00BCEE39
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00BCEE4C
FreeLibrary.KERNEL32(00000000,?,?,00BCEE19,?,?,00BCEDE1,?,00000000,?), ref: 00BCEE6F

Strings

CorExitProcess, xrefs: 00BCEE44
mscoree.dll, xrefs: 00BCEE32

Memory Dump Source

Source File: 00000003.00000002.1723702490.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000003.00000002.1723587742.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1724304213.0000000000BDD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1724352252.0000000000BED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1724391802.0000000000BF0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_bc0000_LetsPRO.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 8b9d40d4ec78d9dff922fdfa18073b3189b6ba3c1346630fa32990e2e31d36b4
Instruction ID: e847a0a35ecc3182dda912c935117c6f94966295ff4607c71e82e9932de95891
Opcode Fuzzy Hash: 8b9d40d4ec78d9dff922fdfa18073b3189b6ba3c1346630fa32990e2e31d36b4
Instruction Fuzzy Hash: 5CF08231A01219FBCB219B91DC19B9EBFB9EB40755F100095F805A2160EF318F04DB90

Function 00BD27A3 Relevance: 7.7, APIs: 5, Instructions: 200COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 00BD2827
__alloca_probe_16.LIBCMT ref: 00BD28ED
__freea.LIBCMT ref: 00BD2959

Part of subcall function 00BD1628: HeapAlloc.KERNEL32(00000000,00BC717D,5A413930,?,00BC9734,5A413932,5A413930,?,00000000,?,00BC410A,00BC717D,5A413934,5A413930,5A413930,5A413930), ref: 00BD165A

__freea.LIBCMT ref: 00BD2962
__freea.LIBCMT ref: 00BD2987

Memory Dump Source

Source File: 00000003.00000002.1723702490.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000003.00000002.1723587742.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1724304213.0000000000BDD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1724352252.0000000000BED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1724391802.0000000000BF0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_bc0000_LetsPRO.jbxd

Similarity

API ID: __freea$__alloca_probe_16$AllocHeap
String ID:
API String ID: 1096550386-0
Opcode ID: 99ec342cfeca5dce35d6bc8b1f6d901cef619478b6d9e30a71162f530269893c
Instruction ID: dfdd4954e83e589b7b646b1bdcc0984c7e8d458a37e61c1fb5c57be8ae2b559b
Opcode Fuzzy Hash: 99ec342cfeca5dce35d6bc8b1f6d901cef619478b6d9e30a71162f530269893c
Instruction Fuzzy Hash: 9851F37260028AABDB205F50CC91FBBBAE9EF65310F1501AAFC18A7340F735DD5197A0

Function 00BD04BC Relevance: 7.7, APIs: 5, Instructions: 188COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00BD1628: HeapAlloc.KERNEL32(00000000,00BC717D,5A413930,?,00BC9734,5A413932,5A413930,?,00000000,?,00BC410A,00BC717D,5A413934,5A413930,5A413930,5A413930), ref: 00BD165A

_free.LIBCMT ref: 00BD05CB
_free.LIBCMT ref: 00BD05E2
_free.LIBCMT ref: 00BD0601
_free.LIBCMT ref: 00BD061C
_free.LIBCMT ref: 00BD0633

Memory Dump Source

Source File: 00000003.00000002.1723702490.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000003.00000002.1723587742.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1724304213.0000000000BDD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1724352252.0000000000BED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1724391802.0000000000BF0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_bc0000_LetsPRO.jbxd

Similarity

API ID: _free$AllocHeap
String ID:
API String ID: 1835388192-0
Opcode ID: 97a0cdd39631d0678bed4dd4a5297f51053d2fe0f7ea0830ffca4c382f4403d4
Instruction ID: eb4cb14615ba453a01f00c46abd8905666b3c8e81093acb582a95771e701094c
Opcode Fuzzy Hash: 97a0cdd39631d0678bed4dd4a5297f51053d2fe0f7ea0830ffca4c382f4403d4
Instruction Fuzzy Hash: 1651BF72A10205AFDB21EF69D881B6AB7F4FB68724F1405AAE809DB351F735DE108B40

Function 00BCF4E3 Relevance: 7.6, APIs: 5, Instructions: 120COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00BCF551
_free.LIBCMT ref: 00BCF571
__crt_fast_encode_pointer.LIBVCRUNTIME ref: 00BCF5D2
__crt_fast_encode_pointer.LIBVCRUNTIME ref: 00BCF5E4
__crt_fast_encode_pointer.LIBVCRUNTIME ref: 00BCF5F1

Memory Dump Source

Source File: 00000003.00000002.1723702490.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000003.00000002.1723587742.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1724304213.0000000000BDD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1724352252.0000000000BED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1724391802.0000000000BF0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_bc0000_LetsPRO.jbxd

Similarity

API ID: __crt_fast_encode_pointer$_free
String ID:
API String ID: 366466260-0
Opcode ID: 14b5f06338d404a2e3c6ec4547470c029a9dec2571847fe4f25a106d2e616206
Instruction ID: 28bd2c86eaad08d25e68bde993e0e8d344277fdfb3f550a2d96e03d2625967ee
Opcode Fuzzy Hash: 14b5f06338d404a2e3c6ec4547470c029a9dec2571847fe4f25a106d2e616206
Instruction Fuzzy Hash: 2241B032A002059BCB24DF68C880A6DB3F6EF88714F1545EDE516EB351EB31ED01CB80

Function 00BD6C1C Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00BD6C34

Part of subcall function 00BD15EE: HeapFree.KERNEL32(00000000,00000000,?,00BD6EC0,?,00000000,?,5A413932,?,00BD7165,?,00000007,?,?,00BD756A,?), ref: 00BD1604
Part of subcall function 00BD15EE: GetLastError.KERNEL32(?,?,00BD6EC0,?,00000000,?,5A413932,?,00BD7165,?,00000007,?,?,00BD756A,?,?), ref: 00BD1616

_free.LIBCMT ref: 00BD6C46
_free.LIBCMT ref: 00BD6C58
_free.LIBCMT ref: 00BD6C6A
_free.LIBCMT ref: 00BD6C7C

Memory Dump Source

Source File: 00000003.00000002.1723702490.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000003.00000002.1723587742.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1724304213.0000000000BDD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1724352252.0000000000BED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1724391802.0000000000BF0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_bc0000_LetsPRO.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: a08af9fd663702c2e980ba0ea4086852661ca8004523d4ccf70444678e951dca
Instruction ID: 96c79a814adc3958033f9dcd8bcdc8d4846ba1115927802edb564a1fc0e2c7bf
Opcode Fuzzy Hash: a08af9fd663702c2e980ba0ea4086852661ca8004523d4ccf70444678e951dca
Instruction Fuzzy Hash: A7F068326141407B8565EF98FAC5D06F7DAFA4031475C0C47F449DB711DB34FD914650

Function 00BC2461 Relevance: 7.5, APIs: 2, Strings: 2, Instructions: 493COMMON

Download Yara Rule

APIs

__EH_prolog3_catch_GS.LIBCMT ref: 00BC246B

Part of subcall function 00BC207D: __EH_prolog3_GS.LIBCMT ref: 00BC2084

Part of subcall function 00BC3286: __EH_prolog3.LIBCMT ref: 00BC328D

Part of subcall function 00BC374A: __EH_prolog3.LIBCMT ref: 00BC3751

Part of subcall function 00BC2F05: _Deallocate.LIBCONCRT ref: 00BC2F43

Part of subcall function 00BC3ADD: __EH_prolog3_catch.LIBCMT ref: 00BC3AE4

Part of subcall function 00BC3B2C: __EH_prolog3_catch.LIBCMT ref: 00BC3B33

Part of subcall function 00BC2FA0: _Deallocate.LIBCONCRT ref: 00BC2FDE

Part of subcall function 00BC303B: _Deallocate.LIBCONCRT ref: 00BC3079

Part of subcall function 00BC30D6: __EH_prolog3.LIBCMT ref: 00BC30DD

_Deallocate.LIBCONCRT ref: 00BC2AC4

Part of subcall function 00BC417E: _Deallocate.LIBCONCRT ref: 00BC418D

Strings

invalid map<K, T> key, xrefs: 00BC2BD6
#, xrefs: 00BC29FC

Memory Dump Source

Source File: 00000003.00000002.1723702490.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000003.00000002.1723587742.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1724304213.0000000000BDD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1724352252.0000000000BED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1724391802.0000000000BF0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_bc0000_LetsPRO.jbxd

Similarity

API ID: Deallocate$H_prolog3$H_prolog3_catch$H_prolog3_H_prolog3_catch_
String ID: #$invalid map<K, T> key
API String ID: 3652989694-3229782413
Opcode ID: ab28750b89e202d8fe9412391a4d5a0105e72b051822bb02cb4ad5924dde11d9
Instruction ID: ae39766129e9ecf4ecd535ee818b1b15f3ac0979507bcdc34daf72f26b465c4b
Opcode Fuzzy Hash: ab28750b89e202d8fe9412391a4d5a0105e72b051822bb02cb4ad5924dde11d9
Instruction Fuzzy Hash: C132D6B18016689EDB25DF64DD95BDEBBF4AF19301F1080EEE409A7242DB709B88CF51

Function 00BCEEF8 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 122COMMON

Download Yara Rule

Strings

C:\Program Files (x86)\haxGhXjmBFM\LetsPRO.exe, xrefs: 00BCEF36, 00BCEF3D, 00BCEF71

Memory Dump Source

Source File: 00000003.00000002.1723702490.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000003.00000002.1723587742.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1724304213.0000000000BDD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1724352252.0000000000BED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1724391802.0000000000BF0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_bc0000_LetsPRO.jbxd

Similarity

API ID:
String ID: C:\Program Files (x86)\haxGhXjmBFM\LetsPRO.exe
API String ID: 0-3760138938
Opcode ID: f1456f33e925cfdfec7bb30e8e69d410bb9f4a756b1340a9ae186510b5ec6b6b
Instruction ID: edb7c565aea8561f77bb598dfebefa8106ea46a3dda42215385d811a92eab88d
Opcode Fuzzy Hash: f1456f33e925cfdfec7bb30e8e69d410bb9f4a756b1340a9ae186510b5ec6b6b
Instruction Fuzzy Hash: 35417071A00655EBDB21DF99DC85EAEBBF8EB88710B1440FEF814D7251D6708E40DBA0

Function 00BC2385 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00BC238C
std::bad_exception::bad_exception.LIBCMT ref: 00BC2448

Strings

version identifier cannot be empty, xrefs: 00BC2440
numeric identifiers cannot have leading 0, xrefs: 00BC23DB

Memory Dump Source

Source File: 00000003.00000002.1723702490.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000003.00000002.1723587742.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1724304213.0000000000BDD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1724352252.0000000000BED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1724391802.0000000000BF0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_bc0000_LetsPRO.jbxd

Similarity

API ID: H_prolog3_std::bad_exception::bad_exception
String ID: numeric identifiers cannot have leading 0$version identifier cannot be empty
API String ID: 3895006615-1248292147
Opcode ID: 7ab4c72abefd2db17975654eb66b122cde190c97035a7a94f4da0678db1014dd
Instruction ID: 103d51d09854be9f62820346b9fa5c4403c7d6a90e08a3d1a8148ddad1aed38f
Opcode Fuzzy Hash: 7ab4c72abefd2db17975654eb66b122cde190c97035a7a94f4da0678db1014dd
Instruction Fuzzy Hash: D6218B71E103449FDB28EFA8D8C1FADB6F4BF18300F5089AEE16263291D7749A44CB51

Function 00BD1342 Relevance: 6.1, APIs: 4, Instructions: 72COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00BCD8AC,?,00000000,?,?,00BCD624,00BCDA3F,00000000,?), ref: 00BD1347
_free.LIBCMT ref: 00BD13A4
_free.LIBCMT ref: 00BD13DA
SetLastError.KERNEL32(00000000,00000005,000000FF,?,?,00BCD624,00BCDA3F,00000000,?), ref: 00BD13E5

Memory Dump Source

Source File: 00000003.00000002.1723702490.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000003.00000002.1723587742.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1724304213.0000000000BDD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1724352252.0000000000BED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1724391802.0000000000BF0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_bc0000_LetsPRO.jbxd

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: b775f90e5e7dd9c3dde52b3ee079163e402702ed2f0e7b0ab296400a1b70a5b1
Instruction ID: 8606994588538d8902959cf7f83b72e7360c30d6cd43f15aff9047ac9a1271d6
Opcode Fuzzy Hash: b775f90e5e7dd9c3dde52b3ee079163e402702ed2f0e7b0ab296400a1b70a5b1
Instruction Fuzzy Hash: F311E9322016807BD61177BDACC5D2BA6E9EBD5374B240BEBF221A77E1FE61CC019125

Function 00BD1499 Relevance: 6.1, APIs: 4, Instructions: 69COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(00BC717D,00BC717D,5A413932,00BCDAC4,00BD166B,5A413930,?,00BC9734,5A413932,5A413930,?,00000000,?,00BC410A,00BC717D,5A413934), ref: 00BD149E
_free.LIBCMT ref: 00BD14FB
_free.LIBCMT ref: 00BD1531
SetLastError.KERNEL32(00000000,00000005,000000FF,?,00BC9734,5A413932,5A413930,?,00000000,?,00BC410A,00BC717D,5A413934,5A413930,5A413930,5A413930), ref: 00BD153C

Memory Dump Source

Source File: 00000003.00000002.1723702490.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000003.00000002.1723587742.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1724304213.0000000000BDD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1724352252.0000000000BED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1724391802.0000000000BF0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_bc0000_LetsPRO.jbxd

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: 5191f73081f58bc9c49970b2a4f2830e6052df4b27c7a4afb7aea41bbb8597d2
Instruction ID: 6e628e88d328da0bd8466d9fa1d9df3fecae97ae720e0c6c16f5b148e138b39a
Opcode Fuzzy Hash: 5191f73081f58bc9c49970b2a4f2830e6052df4b27c7a4afb7aea41bbb8597d2
Instruction Fuzzy Hash: C71108332045403BD61127BCBCC1D2BAAEAEBD5374B244AEBF615A73E1FE65CC015521

Function 00BCBAD4 Relevance: 6.1, APIs: 4, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBVCRUNTIME ref: 00BCBAEE

Part of subcall function 00BCBA3B: BuildCatchObjectHelperInternal.LIBVCRUNTIME ref: 00BCBA6A
Part of subcall function 00BCBA3B: ___AdjustPointer.LIBCMT ref: 00BCBA85

_UnwindNestedFrames.LIBCMT ref: 00BCBB03
__FrameHandler3::FrameUnwindToState.LIBVCRUNTIME ref: 00BCBB14
CallCatchBlock.LIBVCRUNTIME ref: 00BCBB3C

Memory Dump Source

Source File: 00000003.00000002.1723702490.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000003.00000002.1723587742.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1724304213.0000000000BDD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1724352252.0000000000BED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1724391802.0000000000BF0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_bc0000_LetsPRO.jbxd

Similarity

API ID: Catch$BuildFrameObjectUnwind$AdjustBlockCallFramesHandler3::HelperInternalNestedPointerState
String ID:
API String ID: 737400349-0
Opcode ID: 6198aef855a8b508d80c0a31230aed7f4f1b065c2bd3a96532a696443327439a
Instruction ID: c717f8ce69ee3e551192c50270f1e3dca43192dde7122ce458e7afa2499dd096
Opcode Fuzzy Hash: 6198aef855a8b508d80c0a31230aed7f4f1b065c2bd3a96532a696443327439a
Instruction Fuzzy Hash: 46010C32100149BBDF126F95CC46EEF7FAAEF98754F444098FE48A6121C736E861DBA0

Function 00BC6726 Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00BC672D
std::_Locinfo::_Locinfo.LIBCPMT ref: 00BC675B

Part of subcall function 00BC65CF: __EH_prolog3.LIBCMT ref: 00BC65D6
Part of subcall function 00BC65CF: std::_Lockit::_Lockit.LIBCPMT ref: 00BC65E3
Part of subcall function 00BC65CF: std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00BC6620

ctype.LIBCPMT ref: 00BC676D

Part of subcall function 00BC6596: __Getctype.LIBCPMT ref: 00BC65A5
Part of subcall function 00BC6596: __Getcvt.LIBCPMT ref: 00BC65B7

std::_Locinfo::~_Locinfo.LIBCPMT ref: 00BC6777

Part of subcall function 00BC667A: std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 00BC66A1
Part of subcall function 00BC667A: std::_Lockit::~_Lockit.LIBCPMT ref: 00BC6712

Memory Dump Source

Source File: 00000003.00000002.1723702490.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000003.00000002.1723587742.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1724304213.0000000000BDD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1724352252.0000000000BED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1724391802.0000000000BF0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_bc0000_LetsPRO.jbxd

Similarity

API ID: std::_$Locinfo::_$H_prolog3LocinfoLockit$GetctypeGetcvtLocinfo::~_Locinfo_ctorLocinfo_dtorLockit::_Lockit::~_ctype
String ID:
API String ID: 1262428101-0
Opcode ID: 9873ff76a586b9c35be20d563062c2b95d94abf65933a7892055bb8fa16b6f1e
Instruction ID: 47f0963b27c2c38571b63968df5b5b4063a46dab77071e5d7800188cf071c8d2
Opcode Fuzzy Hash: 9873ff76a586b9c35be20d563062c2b95d94abf65933a7892055bb8fa16b6f1e
Instruction Fuzzy Hash: 57F05E71900205DFDB15AF64C452FADB7F0AF54B51F61448EF509AB281DF755900CB54

Function 00BDB856 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(?,?,00BD6275,00000000,?,?,00BDB253,?,00000001,?,00000001,?,00BDA260,00000000,?,00000001), ref: 00BDB86D
GetLastError.KERNEL32(?,00BDB253,?,00000001,?,00000001,?,00BDA260,00000000,?,00000001,00000000,00000001,?,00BDA7B4,00BD620E), ref: 00BDB879

Part of subcall function 00BDB83F: CloseHandle.KERNEL32(FFFFFFFE,00BDB889,?,00BDB253,?,00000001,?,00000001,?,00BDA260,00000000,?,00000001,00000000,00000001), ref: 00BDB84F

___initconout.LIBCMT ref: 00BDB889

Part of subcall function 00BDB801: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,00BDB830,00BDB240,00000001,?,00BDA260,00000000,?,00000001,00000000), ref: 00BDB814

WriteConsoleW.KERNEL32(?,?,00BD6275,00000000,?,00BDB253,?,00000001,?,00000001,?,00BDA260,00000000,?,00000001,00000000), ref: 00BDB89E

Memory Dump Source

Source File: 00000003.00000002.1723702490.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000003.00000002.1723587742.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1724304213.0000000000BDD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1724352252.0000000000BED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1724391802.0000000000BF0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_bc0000_LetsPRO.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: b6c78a609b06233c8cc882afbae72755c63bd6580b32483c0dcc4c59efc921f2
Instruction ID: f98b5e310e1d9c10efef5701f11ce672e65a7cbb3429dc983f9339585ebb2f63
Opcode Fuzzy Hash: b6c78a609b06233c8cc882afbae72755c63bd6580b32483c0dcc4c59efc921f2
Instruction Fuzzy Hash: 97F01C36401155BBCF222F91DC49D89BF6AFB083B1B114061FA1996220EB328820EBA0

Function 00BCF80C Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00BCF815

Part of subcall function 00BD15EE: HeapFree.KERNEL32(00000000,00000000,?,00BD6EC0,?,00000000,?,5A413932,?,00BD7165,?,00000007,?,?,00BD756A,?), ref: 00BD1604
Part of subcall function 00BD15EE: GetLastError.KERNEL32(?,?,00BD6EC0,?,00000000,?,5A413932,?,00BD7165,?,00000007,?,?,00BD756A,?,?), ref: 00BD1616

_free.LIBCMT ref: 00BCF828
_free.LIBCMT ref: 00BCF839
_free.LIBCMT ref: 00BCF84A

Memory Dump Source

Source File: 00000003.00000002.1723702490.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000003.00000002.1723587742.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1724304213.0000000000BDD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1724352252.0000000000BED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1724391802.0000000000BF0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_bc0000_LetsPRO.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: ea06cd2ebadc34d4da5ed01296cfbcab83c76a6ed5fd8de534b3e764b94e8f91
Instruction ID: b65d936f6b09689dd94425de0b0eb63de5a42decda81fb2c46ba4b2ccbd778bb
Opcode Fuzzy Hash: ea06cd2ebadc34d4da5ed01296cfbcab83c76a6ed5fd8de534b3e764b94e8f91
Instruction Fuzzy Hash: E4E04F70C502A6EB8652EF98BD814257BA2F7D47043024467F8118B333DF350221DB84

Function 00BCD5C4 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 264COMMON

Download Yara Rule

APIs

__aulldvrm.LIBCMT ref: 00BCD731

Strings

-, xrefs: 00BCD65F
+, xrefs: 00BCD66C

Memory Dump Source

Source File: 00000003.00000002.1723702490.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000003.00000002.1723587742.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1724304213.0000000000BDD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1724352252.0000000000BED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1724391802.0000000000BF0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_bc0000_LetsPRO.jbxd

Similarity

API ID: __aulldvrm
String ID: +$-
API String ID: 1302938615-2137968064
Opcode ID: c4c9a82c8cce3aa90b3528319e1a22c8a81cc373e58f51098a2af74849860b94
Instruction ID: d5c03fd55405c31215a6230b83dede56a4d03d8acc0d51d6b45747bac5e4b263
Opcode Fuzzy Hash: c4c9a82c8cce3aa90b3528319e1a22c8a81cc373e58f51098a2af74849860b94
Instruction Fuzzy Hash: 6891C278900249AEDF249E68C890FFDBBF1EF55324F1482FEE865AB291D6349D01CB51

Function 00BC1CEA Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 205COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 00BC1E37
_Deallocate.LIBCONCRT ref: 00BC1F1E

Strings

map/set<T> too long, xrefs: 00BC1E25

Memory Dump Source

Source File: 00000003.00000002.1723702490.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000003.00000002.1723587742.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1724304213.0000000000BDD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1724352252.0000000000BED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1724391802.0000000000BF0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_bc0000_LetsPRO.jbxd

Similarity

API ID: DeallocateH_prolog3_catch
String ID: map/set<T> too long
API String ID: 20358830-1285458680
Opcode ID: aa4739010d0aa4cbe3b6c3793ea3a932dce9ede43dd1a14a8348001f7db30400
Instruction ID: 95cb2a649e3a1039bf3074b4d8cb322b871a2a723608eaca599eba5fd525d3f1
Opcode Fuzzy Hash: aa4739010d0aa4cbe3b6c3793ea3a932dce9ede43dd1a14a8348001f7db30400
Instruction Fuzzy Hash: 8D8116706042869FDB11CB1DC484F65BBE1EB86314F19C8ECE85AAB6A3C775EC45CB50

Function 00BCE67D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 194COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 00BCE70D

Strings

pow, xrefs: 00BCE6E5, 00BCE702

Memory Dump Source

Source File: 00000003.00000002.1723702490.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000003.00000002.1723587742.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1724304213.0000000000BDD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1724352252.0000000000BED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1724391802.0000000000BF0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_bc0000_LetsPRO.jbxd

Similarity

API ID: ErrorHandling__start
String ID: pow
API String ID: 3213639722-2276729525
Opcode ID: d67b05e55409d749c2f86ee40f509becbf2ef105c7348749f2956b3ee4fde2b6
Instruction ID: a8c64c7688229fd86584bb1874a317a1c05ca29286ebe24f1411348a0e298368
Opcode Fuzzy Hash: d67b05e55409d749c2f86ee40f509becbf2ef105c7348749f2956b3ee4fde2b6
Instruction Fuzzy Hash: 36519D61A08202CBDB117B14C99176ABBD4DB50751F204DEFE0E5863E8FF39CC959A46

Function 00BC3D21 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 193COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 00BC3E48
_Deallocate.LIBCONCRT ref: 00BC3F15

Strings

map/set<T> too long, xrefs: 00BC3E36

Memory Dump Source

Source File: 00000003.00000002.1723702490.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000003.00000002.1723587742.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1724304213.0000000000BDD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1724352252.0000000000BED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1724391802.0000000000BF0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_bc0000_LetsPRO.jbxd

Similarity

API ID: DeallocateH_prolog3_catch
String ID: map/set<T> too long
API String ID: 20358830-1285458680
Opcode ID: 7425cc60e64740c18ca6f252853f9c4ce1ec5e0fb989fd83863b720f03387a5a
Instruction ID: 47791dd370b9f0d7a21063f477921228f988750c06199ab8fa94c0e55508e27c
Opcode Fuzzy Hash: 7425cc60e64740c18ca6f252853f9c4ce1ec5e0fb989fd83863b720f03387a5a
Instruction Fuzzy Hash: 5D8123706046859FDB12CF18C088F55BBE1EF56B14F59C5DCE8499B2A2C3B5ED80CBA0

Function 00BCB5E0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 117COMMON

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 00BCB613
__IsNonwritableInCurrentImage.LIBCMT ref: 00BCB6CC

Strings

csm, xrefs: 00BCB6B6

Memory Dump Source

Source File: 00000003.00000002.1723702490.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000003.00000002.1723587742.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1724304213.0000000000BDD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1724352252.0000000000BED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1724391802.0000000000BF0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_bc0000_LetsPRO.jbxd

Similarity

API ID: CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 3480331319-1018135373
Opcode ID: 717e1c53b37742e51eb0e6c102e94e5b5e82b08389bb94b7a5f81526db93b3fd
Instruction ID: 361305044b0eeb067d0895baf5db383f3a83b3948bab411f4975d9bae1b007e6
Opcode Fuzzy Hash: 717e1c53b37742e51eb0e6c102e94e5b5e82b08389bb94b7a5f81526db93b3fd
Instruction Fuzzy Hash: 66419234E002199BCF10DF69C896F9EBBE5EF45314F1481EAE819AB392D7719A05CB90

Function 00BC1392 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00BC1399
Concurrency::cancel_current_task.LIBCPMT ref: 00BC1463

Strings

invalid map<K, T> key, xrefs: 00BC1459

Memory Dump Source

Source File: 00000003.00000002.1723702490.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000003.00000002.1723587742.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1724304213.0000000000BDD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1724352252.0000000000BED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1724391802.0000000000BF0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_bc0000_LetsPRO.jbxd

Similarity

API ID: Concurrency::cancel_current_taskH_prolog3_
String ID: invalid map<K, T> key
API String ID: 2179034322-1394099236
Opcode ID: 7c3247aa34900e2adf34fb94bb5274cddf6589945e8ea0d44037bc2fc13cf626
Instruction ID: 63b613b5657f205356718e3e8ad0ad64094b6818d7bd1b5d37a63f7e645c3434
Opcode Fuzzy Hash: 7c3247aa34900e2adf34fb94bb5274cddf6589945e8ea0d44037bc2fc13cf626
Instruction Fuzzy Hash: 65312B71A00209ABCB18DFA8D444EADB7F9EF49314F5888ADE846E7752D730AD45CB50

Analysis Process: LetsPRO.exePID: 7784, Parent PID: 7752COMMON

Execution Graph

Execution Coverage:	1.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	6.6%
Total number of Nodes:	351
Total number of Limit Nodes:	42

Executed Functions

Function 00405B0B Relevance: 45.7, APIs: 21, Strings: 5, Instructions: 230
registrylibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3.LIBCMT ref: 00405B2A
GetModuleHandleW.KERNEL32(kernel32.dll,0000005C), ref: 00405B54
GetProcAddress.KERNEL32(00000000,GetUserDefaultUILanguage), ref: 00405B65
ConvertDefaultLocale.KERNELBASE(?), ref: 00405B9B
ConvertDefaultLocale.KERNELBASE(?), ref: 00405BA3
GetProcAddress.KERNEL32(?,GetSystemDefaultUILanguage), ref: 00405BB7
ConvertDefaultLocale.KERNEL32(?), ref: 00405BDB
ConvertDefaultLocale.KERNEL32(74DEF550), ref: 00405BE1
GetModuleFileNameW.KERNEL32(00400000,00000000,00000105), ref: 00405C18
GetVersion.KERNEL32 ref: 00405C2D
RegOpenKeyExW.ADVAPI32(80000001,Control Panel\Desktop\ResourceLocale,00000000,00020019,?), ref: 00405C52
RegQueryValueExW.ADVAPI32(?,00000000,00000000,?,?,?), ref: 00405C77
_sscanf.LIBCMT ref: 00405C97
ConvertDefaultLocale.KERNEL32(?), ref: 00405CCC
ConvertDefaultLocale.KERNEL32(74DEF550), ref: 00405CD2
RegCloseKey.ADVAPI32(?), ref: 00405CE1
GetModuleHandleW.KERNEL32(ntdll.dll), ref: 00405CF1
EnumResourceLanguagesW.KERNEL32(00000000,00000010,00000001,00405408,?), ref: 00405D0C
ConvertDefaultLocale.KERNEL32(?), ref: 00405D3D
ConvertDefaultLocale.KERNEL32(74DEF550), ref: 00405D43
_memset.LIBCMT ref: 00405D5B

Strings

Control Panel\Desktop\ResourceLocale, xrefs: 00405C45
GetUserDefaultUILanguage, xrefs: 00405B5C
ntdll.dll, xrefs: 00405CEC
kernel32.dll, xrefs: 00405B46
GetSystemDefaultUILanguage, xrefs: 00405BA5

Memory Dump Source

Source File: 00000005.00000002.1722456807.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1722022141.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723561398.0000000000436000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000444000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000448000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1724304481.000000000044B000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_LetsPRO.jbxd

Similarity

API ID: ConvertDefaultLocale$Module$AddressHandleProc$CloseEnumFileH_prolog3LanguagesNameOpenQueryResourceValueVersion_memset_sscanf
String ID: Control Panel\Desktop\ResourceLocale$GetSystemDefaultUILanguage$GetUserDefaultUILanguage$kernel32.dll$ntdll.dll
API String ID: 434808117-483790700
Opcode ID: 9b1fe0f06ad8a38e0800d9e26f99f23d44b7cadcbb79ebc19ebac5fff3ddaf8f
Instruction ID: 53e63af6d6decaf002d3876b7785f85ad4150c84098333e682b5df1b2cb23216
Opcode Fuzzy Hash: 9b1fe0f06ad8a38e0800d9e26f99f23d44b7cadcbb79ebc19ebac5fff3ddaf8f
Instruction Fuzzy Hash: 91812BB1D00219ABDB10DFA5DC85AAFBAB8EF48304F11453BE915E7280D7789A45CF68

Function 004058F3 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 72
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_wcscpy_s.LIBCMT ref: 00405920
GetLocaleInfoW.KERNELBASE(00000800,00000003,?,00000004), ref: 00405938
__snprintf_s.LIBCMT ref: 0040596A
LoadLibraryW.KERNELBASE(?), ref: 004059A5

Strings

LOC, xrefs: 00405918

Memory Dump Source

Source File: 00000005.00000002.1722456807.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1722022141.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723561398.0000000000436000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000444000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000448000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1724304481.000000000044B000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_LetsPRO.jbxd

Similarity

API ID: InfoLibraryLoadLocale__snprintf_s_wcscpy_s
String ID: LOC
API String ID: 1815201894-519433814
Opcode ID: 2469043128c706d9756399b711457dbd5989f121ac39e50a3251f77e00c00871
Instruction ID: 50c330cc87dee92b5d300d0fd10e4b57e8fa70ce08f9cbd85c7c96daeb0ef500
Opcode Fuzzy Hash: 2469043128c706d9756399b711457dbd5989f121ac39e50a3251f77e00c00871
Instruction Fuzzy Hash: AF1196B5600218ABDB11BB65DC46BBB72A8EF05328F500077B601E71E1DA7C5A01CA69

Function 00410D74 Relevance: 10.6, APIs: 7, Instructions: 52
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalAlloc.KERNELBASE(00000002), ref: 00410D82
GlobalHandle.KERNEL32(?), ref: 00410DBD
GlobalLock.KERNEL32(00000000), ref: 00410DC4
LeaveCriticalSection.KERNEL32(?), ref: 00410DCE
GlobalLock.KERNEL32(00000000), ref: 00410DDA
_memset.LIBCMT ref: 00410DF3
LeaveCriticalSection.KERNEL32(?), ref: 00410E1F

Memory Dump Source

Source File: 00000005.00000002.1722456807.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1722022141.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723561398.0000000000436000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000444000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000448000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1724304481.000000000044B000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_LetsPRO.jbxd

Similarity

API ID: Global$CriticalLeaveLockSection$AllocHandle_memset
String ID:
API String ID: 2347636318-0
Opcode ID: 02dfab95c2b3593a2ba91e285649ad8ec6e219a3230dd7e4ea3abe0dd4f8d6c5
Instruction ID: b5ea5cd749b0b9d19a44b59eb55604a91111983ef0ef945ada0e154262dcc80e
Opcode Fuzzy Hash: 02dfab95c2b3593a2ba91e285649ad8ec6e219a3230dd7e4ea3abe0dd4f8d6c5
Instruction Fuzzy Hash: 11118B75600706AFC7209FA5E888A56B7E8FB44301B028A7EE557C3660D739F8548B98

Function 004117C1 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 40
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(00000000), ref: 004117CA
SetErrorMode.KERNELBASE(00000000), ref: 004117D2

Part of subcall function 0040FD10: GetModuleFileNameW.KERNEL32(?,?,00000105), ref: 0040FD51
Part of subcall function 0040FD10: SetLastError.KERNEL32(0000006F), ref: 0040FD6B

GetModuleHandleW.KERNEL32(user32.dll), ref: 00411824
GetProcAddress.KERNEL32(00000000,NotifyWinEvent), ref: 00411834

Part of subcall function 00411634: GetModuleFileNameW.KERNEL32(?,?,00000104), ref: 00411677
Part of subcall function 00411634: PathFindExtensionW.SHLWAPI(?), ref: 00411691
Part of subcall function 00411634: __wcsdup.LIBCMT ref: 004116D4

Strings

user32.dll, xrefs: 0041181F
NotifyWinEvent, xrefs: 0041182E

Memory Dump Source

Source File: 00000005.00000002.1722456807.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1722022141.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723561398.0000000000436000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000444000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000448000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1724304481.000000000044B000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_LetsPRO.jbxd

Similarity

API ID: ErrorModule$FileModeName$AddressExtensionFindHandleLastPathProc__wcsdup
String ID: NotifyWinEvent$user32.dll
API String ID: 1671896705-597752486
Opcode ID: 97424b0c36b3e8536f86366b4eb5e795bd36fdcc98f74516eb7ddc2a5cc949f3
Instruction ID: 940dae8703a6e23d1131894f9d7955a3176dcada420b4fb1af9f844b411d852f
Opcode Fuzzy Hash: 97424b0c36b3e8536f86366b4eb5e795bd36fdcc98f74516eb7ddc2a5cc949f3
Instruction Fuzzy Hash: 32017C70A103115FC760BF659845A9A7AD5AF44300F06846FF644973A2CB7CC880CBAE

Function 004068A6 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 89
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3_GS.LIBCMT ref: 004068B0

Part of subcall function 00410C11: __EH_prolog3_catch.LIBCMT ref: 00410C18

WSAStartup.WS2_32(00000101,?), ref: 004068F0

Part of subcall function 004047D4: __CxxThrowException@8.LIBCMT ref: 004047E8
Part of subcall function 004047D4: __EH_prolog3.LIBCMT ref: 004047F5

WSACleanup.WS2_32 ref: 0040693F
WSASetLastError.WS2_32(0000276C), ref: 0040694A

Strings

7M, xrefs: 004068BD

Memory Dump Source

Source File: 00000005.00000002.1722456807.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1722022141.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723561398.0000000000436000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000444000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000448000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1724304481.000000000044B000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_LetsPRO.jbxd

Similarity

API ID: CleanupErrorException@8H_prolog3H_prolog3_H_prolog3_catchLastStartupThrow
String ID: 7M
API String ID: 1416897528-2086340997
Opcode ID: 641ac9f3156d5c3cc21a23541b054e9ebb485166c6045f018c5bb96424fdb03f
Instruction ID: 485a1ae47345b818e95de846cb9984c36a6365ee8d7ec5715c23eddbe7844215
Opcode Fuzzy Hash: 641ac9f3156d5c3cc21a23541b054e9ebb485166c6045f018c5bb96424fdb03f
Instruction Fuzzy Hash: EF3144B1A01311AFDB24BFB58A8539E76E06F04314F12843FE247B7AC0D67C99D08B0A

Function 004111C2 Relevance: 7.5, APIs: 5, Instructions: 35
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

TlsFree.KERNELBASE(?), ref: 004111E8
GlobalHandle.KERNEL32(?), ref: 004111F6
GlobalUnlock.KERNEL32(00000000), ref: 004111FF
GlobalFree.KERNEL32(00000000), ref: 00411206
DeleteCriticalSection.KERNEL32 ref: 00411210

Part of subcall function 0041101A: EnterCriticalSection.KERNEL32(?), ref: 00411077
Part of subcall function 0041101A: LeaveCriticalSection.KERNEL32(?,?), ref: 00411087
Part of subcall function 0041101A: LocalFree.KERNEL32(?), ref: 00411090
Part of subcall function 0041101A: TlsSetValue.KERNEL32(?,00000000), ref: 004110A2

Memory Dump Source

Source File: 00000005.00000002.1722456807.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1722022141.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723561398.0000000000436000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000444000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000448000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1724304481.000000000044B000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_LetsPRO.jbxd

Similarity

API ID: CriticalFreeGlobalSection$DeleteEnterHandleLeaveLocalUnlockValue
String ID:
API String ID: 1549993015-0
Opcode ID: f06a1c096767275d8964a179fd06d210d1f424b075d902da62e5dd7f4fd609c9
Instruction ID: c45c13ca1a3e4edf317983e0ddc392ae8553f40cfda033fc17c0c00dd65d97c2
Opcode Fuzzy Hash: f06a1c096767275d8964a179fd06d210d1f424b075d902da62e5dd7f4fd609c9
Instruction Fuzzy Hash: 44F089313005107BDB216F78AC48A6B77EDAF8976171B4659FA15D3361CB38DC418668

Function 00405557 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 69
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNELBASE(80000001,0jC,00000000,00000001,?), ref: 0040559A
RegQueryValueExW.ADVAPI32(?,00000000,00000000,?,?,00000004), ref: 004055BA
RegCloseKey.ADVAPI32(?), ref: 004055FE

Strings

0jC, xrefs: 00405567, 00405580, 00405593

Memory Dump Source

Source File: 00000005.00000002.1722456807.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1722022141.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723561398.0000000000436000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000444000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000448000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1724304481.000000000044B000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_LetsPRO.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: 0jC
API String ID: 3677997916-2884480901
Opcode ID: 8f1a4d465daf125c34f7dd5965e6b4c2a60bcd817b9ac7d1c52aeed11aff5183
Instruction ID: 4d1229bb306718ce64e666aa057c165f511234742bf3473bf0d091a2d0912916
Opcode Fuzzy Hash: 8f1a4d465daf125c34f7dd5965e6b4c2a60bcd817b9ac7d1c52aeed11aff5183
Instruction Fuzzy Hash: 192123B1E00208FFDB14CF85CC45AAFBBB9EF91304F1080BAE412A6250D3755A00DF69

Function 0042063E Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 65
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__lock.LIBCMT ref: 0042064C

Part of subcall function 00425238: __mtinitlocknum.LIBCMT ref: 0042524C
Part of subcall function 00425238: __amsg_exit.LIBCMT ref: 00425258
Part of subcall function 00425238: EnterCriticalSection.KERNEL32(-0000000F,-0000000F,?,0041FC1F,00000004,00441010,0000000C,0042635F,00000004,00000004,00000000,00000000,00000000,00424C6E,00000001,00000214), ref: 00425260

Part of subcall function 00424AA0: TlsGetValue.KERNEL32(00000000,0042527E,00420190,004053D2,?,004044B2,00000000,?,00000000,00404563,0000000C,00000004,004010F6,00000000,004053D2,00000000), ref: 00424AAD
Part of subcall function 00424AA0: TlsGetValue.KERNEL32(00000005,?,004044B2,00000000,?,00000000,00404563,0000000C,00000004,004010F6,00000000,004053D2,00000000,?,1A1A596F), ref: 00424AC4

Part of subcall function 00424AA0: GetModuleHandleA.KERNEL32(KERNEL32.DLL,?,004044B2,00000000,?,00000000,00404563,0000000C,00000004,004010F6,00000000,004053D2,00000000,?,1A1A596F), ref: 00424AD9
Part of subcall function 00424AA0: GetProcAddress.KERNEL32(00000000,DecodePointer), ref: 00424AF4

Strings

TfC, xrefs: 004206D5
DfC, xrefs: 004206C5

Memory Dump Source

Source File: 00000005.00000002.1722456807.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1722022141.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723561398.0000000000436000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000444000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000448000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1724304481.000000000044B000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_LetsPRO.jbxd

Similarity

API ID: Value$AddressCriticalEnterHandleModuleProcSection__amsg_exit__lock__mtinitlocknum
String ID: DfC$TfC
API String ID: 669183598-1950425796
Opcode ID: dd3be0559614c35c3b20205e641e9fbf03c7590fcd9d69106e8d08cabb47e667
Instruction ID: 06adc8c9def15b567b2330e98a4e3d071255f1a1e8fb0f43d26731c77b1c0979
Opcode Fuzzy Hash: dd3be0559614c35c3b20205e641e9fbf03c7590fcd9d69106e8d08cabb47e667
Instruction Fuzzy Hash: 8D11DFB1B40269AEDB10AFA6B84326D76E0EBD4354F90802FF051661D2CE7C19918F6D

Function 0040FD10 Relevance: 3.1, APIs: 2, Instructions: 60
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0040FC33: GetModuleHandleW.KERNEL32(KERNEL32), ref: 0040FC41

GetModuleFileNameW.KERNEL32(?,?,00000105), ref: 0040FD51
SetLastError.KERNEL32(0000006F), ref: 0040FD6B

Memory Dump Source

Source File: 00000005.00000002.1722456807.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1722022141.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723561398.0000000000436000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000444000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000448000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1724304481.000000000044B000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_LetsPRO.jbxd

Similarity

API ID: Module$ErrorFileHandleLastName
String ID:
API String ID: 613274587-0
Opcode ID: 65ed23ca440658b0ad49e718b291a10808b6ca3ec5b18b8afa8d8e8d808b2352
Instruction ID: 77ee2d507c66aa31a4a665efb8b39859b60845e81c749aaa7fc655533e3b2d9d
Opcode Fuzzy Hash: 65ed23ca440658b0ad49e718b291a10808b6ca3ec5b18b8afa8d8e8d808b2352
Instruction Fuzzy Hash: 3D216A719007088EEB70EFA5D8457EEB7B8BF05318F10423EE4A9AA1C1DB789508CF55

Function 00424FD4 Relevance: 3.0, APIs: 2, Instructions: 28
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HeapCreate.KERNELBASE(00000000,00001000,00000000,0041FA8B,00000001), ref: 00424FE5
HeapDestroy.KERNEL32 ref: 0042501B

Memory Dump Source

Source File: 00000005.00000002.1722456807.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1722022141.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723561398.0000000000436000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000444000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000448000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1724304481.000000000044B000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_LetsPRO.jbxd

Similarity

API ID: Heap$CreateDestroy
String ID:
API String ID: 3296620671-0
Opcode ID: 595dfed17f045a8a441f46f2c2be5ba778fa331a0dac69aa86606b3b2e74cb94
Instruction ID: e64aef92a3dbf438a7023a228bfdfc26d721052645ab0bb2db5616e148696602
Opcode Fuzzy Hash: 595dfed17f045a8a441f46f2c2be5ba778fa331a0dac69aa86606b3b2e74cb94
Instruction Fuzzy Hash: 33E06D34750721EBEF50AB36BD057273AE4FBD5346F51883AF401C51A4FBB88944AA2D

Function 00409056 Relevance: 3.0, APIs: 2, Instructions: 15
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 00409069
SetWindowsHookExW.USER32(000000FF,Function_00008EC2,00000000,00000000), ref: 00409079

Memory Dump Source

Source File: 00000005.00000002.1722456807.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1722022141.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723561398.0000000000436000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000444000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000448000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1724304481.000000000044B000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_LetsPRO.jbxd

Similarity

API ID: CurrentHookThreadWindows
String ID:
API String ID: 1904029216-0
Opcode ID: 024d4471fd8181e5a2c57d063590507b305d4f545cbecc9e134e09d29b7988a8
Instruction ID: 354c5b5a9b001557930799becf6b0d12e405add7ac89294fe36053dec998702d
Opcode Fuzzy Hash: 024d4471fd8181e5a2c57d063590507b305d4f545cbecc9e134e09d29b7988a8
Instruction Fuzzy Hash: 73D0A771D043117EEB602770BC09B463A544B05324F12437FF560A61D2C6BC48814BBD

Function 004204DA Relevance: 3.0, APIs: 2, Instructions: 5
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___crtCorExitProcess.LIBCMT ref: 004204DE

Part of subcall function 004204B4: GetModuleHandleA.KERNEL32(mscoree.dll,004204E3,00000000,004251A7,000000FF,0000001E,00441178,0000000C,00425251,004053D2,-0000000F,?,0041FC1F,00000004,00441010,0000000C), ref: 004204B9
Part of subcall function 004204B4: GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 004204C9

ExitProcess.KERNEL32 ref: 004204E8

Memory Dump Source

Source File: 00000005.00000002.1722456807.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1722022141.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723561398.0000000000436000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000444000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000448000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1724304481.000000000044B000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_LetsPRO.jbxd

Similarity

API ID: ExitProcess$AddressHandleModuleProc___crt
String ID:
API String ID: 2427264223-0
Opcode ID: 92f71e574d4e3fbd076e3e8d7a2e50c53bb2444d7484fb681c77b0706eb30e26
Instruction ID: e5ca64b4e5e8b8738065c3c2a9266df68a28fb58d485e6e25ea3d9b60c739235
Opcode Fuzzy Hash: 92f71e574d4e3fbd076e3e8d7a2e50c53bb2444d7484fb681c77b0706eb30e26
Instruction Fuzzy Hash: FBB01230004210BFC6053B10ED0B40D7BB1EF80700F40C42DF048000728B354C50FA05

Function 00401510 Relevance: 1.6, APIs: 1, Instructions: 67
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitCommonControlsEx.COMCTL32 ref: 00401557

Part of subcall function 004059E2: InterlockedExchange.KERNEL32(004496F8,?), ref: 00405A0E

Part of subcall function 004068A6: __EH_prolog3_GS.LIBCMT ref: 004068B0
Part of subcall function 004068A6: WSAStartup.WS2_32(00000101,?), ref: 004068F0

Part of subcall function 00406CEE: __EH_prolog3.LIBCMT ref: 00406CF5

Memory Dump Source

Source File: 00000005.00000002.1722456807.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1722022141.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723561398.0000000000436000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000444000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000448000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1724304481.000000000044B000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_LetsPRO.jbxd

Similarity

API ID: CommonControlsExchangeH_prolog3H_prolog3_InitInterlockedStartup
String ID:
API String ID: 2039091985-0
Opcode ID: e264019b1814ba8f0215453b0d325eed12bccbdca54c6880dbeb5b14b6554f97
Instruction ID: df3836d50ca4370d26f1935f4349aa28044b7a2ab5492c5a7451bd89be6f0177
Opcode Fuzzy Hash: e264019b1814ba8f0215453b0d325eed12bccbdca54c6880dbeb5b14b6554f97
Instruction Fuzzy Hash: 1221C6755187809BD724EF25DC02B9E73E8EB88724F004B3FF859A22C0EB795504879B

Function 0040FFA5 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3.LIBCMT ref: 0040FFAC

Memory Dump Source

Source File: 00000005.00000002.1722456807.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1722022141.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723561398.0000000000436000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000444000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000448000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1724304481.000000000044B000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_LetsPRO.jbxd

Similarity

API ID: H_prolog3
String ID:
API String ID: 431132790-0
Opcode ID: 5932a3573ed2ca64cf6263dc5e735047bd454bfb0f3423a530595b26039affd5
Instruction ID: 1914279d4fd583725337102e6c69a5aead525933282f4196064371125082acc7
Opcode Fuzzy Hash: 5932a3573ed2ca64cf6263dc5e735047bd454bfb0f3423a530595b26039affd5
Instruction Fuzzy Hash: 3E218E34201B018FD729DF79C484A2AB7F0BF8A7147144A6EF562DBBA0CB39A841CB14

Function 00402800 Relevance: 1.5, APIs: 1, Instructions: 25
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindResourceW.KERNELBASE(?,?,00000006,00435578,00000000,80070057,?,?,?,?,000000FF,004029FE,?), ref: 00402819

Memory Dump Source

Source File: 00000005.00000002.1722456807.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1722022141.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723561398.0000000000436000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000444000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000448000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1724304481.000000000044B000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_LetsPRO.jbxd

Similarity

API ID: FindResource
String ID:
API String ID: 1635176832-0
Opcode ID: 3e3e05637382e72d6fe57cc56152368f23495bbbe5be4583c85de39174aebdcf
Instruction ID: 6210cb1e04e0ba84fcbfb62e88a571e93e23bd2997e000e2ab13705adc0ee2f9
Opcode Fuzzy Hash: 3e3e05637382e72d6fe57cc56152368f23495bbbe5be4583c85de39174aebdcf
Instruction Fuzzy Hash: 32D0127B7041203BD550260ABC05ABB635CDFC1639F06817BF945E6290D274AC5661B5

Function 004054CE Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1722456807.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1722022141.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723561398.0000000000436000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000444000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000448000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1724304481.000000000044B000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_LetsPRO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b46b6d24853f286a4105bbd7cdee77db56c655e180a5b6f9059e0e7e543b9df4
Instruction ID: b80d73f3ac0f8b50ed50a03830aa83e45003adebf813a6a2b17c9e5730fcceb8
Opcode Fuzzy Hash: b46b6d24853f286a4105bbd7cdee77db56c655e180a5b6f9059e0e7e543b9df4
Instruction Fuzzy Hash: 0FE04F75108611ABCA304E3498003EB73D4DB12331F20573BE0A5E22E0E23488D2AE16

Non-executed Functions

Function 0042C3DA Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 164libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(USER32.DLL,00000000,00000000,00000314,?,?,?,00448B50,00424048,00448B50,Microsoft Visual C++ Runtime Library,00012010), ref: 0042C407
GetProcAddress.KERNEL32(00000000,MessageBoxA), ref: 0042C423

Part of subcall function 00424A29: TlsGetValue.KERNEL32(00426847,004268C7,00426847,00000014,004251F2,00000000,00000FA0,00441178,0000000C,00425251,004053D2,-0000000F,?,0041FC1F,00000004,00441010), ref: 00424A36
Part of subcall function 00424A29: TlsGetValue.KERNEL32(00000005,?,0041FC1F,00000004,00441010,0000000C,0042635F,00000004,00000004,00000000,00000000,00000000,00424C6E,00000001,00000214), ref: 00424A4D

GetProcAddress.KERNEL32(00000000,00000000), ref: 0042C440

Part of subcall function 00424A29: GetModuleHandleA.KERNEL32(KERNEL32.DLL,?,0041FC1F,00000004,00441010,0000000C,0042635F,00000004,00000004,00000000,00000000,00000000,00424C6E,00000001,00000214), ref: 00424A62
Part of subcall function 00424A29: GetProcAddress.KERNEL32(00000000,EncodePointer), ref: 00424A7D

GetProcAddress.KERNEL32(00000000,00000000), ref: 0042C455
__invoke_watson.LIBCMT ref: 0042C476

Part of subcall function 00420965: _memset.LIBCMT ref: 004209F1
Part of subcall function 00420965: IsDebuggerPresent.KERNEL32(?,?,00000000), ref: 00420A0F
Part of subcall function 00420965: SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,00000000), ref: 00420A19
Part of subcall function 00420965: UnhandledExceptionFilter.KERNEL32(?,?,?,00000000), ref: 00420A23
Part of subcall function 00420965: GetCurrentProcess.KERNEL32(C000000D,?,?,00000000), ref: 00420A3E
Part of subcall function 00420965: TerminateProcess.KERNEL32(00000000,?,?,00000000), ref: 00420A45

Part of subcall function 00424AA0: TlsGetValue.KERNEL32(00000000,0042527E,00420190,004053D2,?,004044B2,00000000,?,00000000,00404563,0000000C,00000004,004010F6,00000000,004053D2,00000000), ref: 00424AAD
Part of subcall function 00424AA0: TlsGetValue.KERNEL32(00000005,?,004044B2,00000000,?,00000000,00404563,0000000C,00000004,004010F6,00000000,004053D2,00000000,?,1A1A596F), ref: 00424AC4

Part of subcall function 00424AA0: GetModuleHandleA.KERNEL32(KERNEL32.DLL,?,004044B2,00000000,?,00000000,00404563,0000000C,00000004,004010F6,00000000,004053D2,00000000,?,1A1A596F), ref: 00424AD9
Part of subcall function 00424AA0: GetProcAddress.KERNEL32(00000000,DecodePointer), ref: 00424AF4

GetProcAddress.KERNEL32(00000000,GetUserObjectInformationA), ref: 0042C48A
GetProcAddress.KERNEL32(00000000,GetProcessWindowStation), ref: 0042C4A2
__invoke_watson.LIBCMT ref: 0042C515

Strings

USER32.DLL, xrefs: 0042C402
GetUserObjectInformationA, xrefs: 0042C484
GetProcessWindowStation, xrefs: 0042C49C
MessageBoxA, xrefs: 0042C41D

Memory Dump Source

Source File: 00000005.00000002.1722456807.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1722022141.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723561398.0000000000436000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000444000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000448000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1724304481.000000000044B000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_LetsPRO.jbxd

Similarity

API ID: AddressProc$Value$ExceptionFilterHandleModuleProcessUnhandled__invoke_watson$CurrentDebuggerLibraryLoadPresentTerminate_memset
String ID: GetProcessWindowStation$GetUserObjectInformationA$MessageBoxA$USER32.DLL
API String ID: 2940365033-1046234306
Opcode ID: a6a97b64ffa82abdea825ab4e44fefc05e251efecba4a408d7e694b2cfaf6a00
Instruction ID: a97d1c535c1a980ba924a1e48148f3827e8f8d09f0f1bcf6205f62281a70bf33
Opcode Fuzzy Hash: a6a97b64ffa82abdea825ab4e44fefc05e251efecba4a408d7e694b2cfaf6a00
Instruction Fuzzy Hash: 04418371F44235BACF10AFF1BCC696F7BA8AF49314B90046FE401D2251DA3CE9849A9D

Function 00404F4D Relevance: 12.1, APIs: 8, Instructions: 144filestringCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00404F6C
GetFullPathNameW.KERNEL32(00000000,00000104,?,?,00000014), ref: 00404FAD

Part of subcall function 004047D4: __CxxThrowException@8.LIBCMT ref: 004047E8
Part of subcall function 004047D4: __EH_prolog3.LIBCMT ref: 004047F5

PathIsUNCW.SHLWAPI(?,?,?,00000000), ref: 00405011
GetVolumeInformationW.KERNEL32(?,00000000,00000000,00000000,?,?,00000000,00000000), ref: 0040502F
CharUpperW.USER32(?), ref: 00405056
FindFirstFileW.KERNEL32(?,00000000), ref: 00405069
FindClose.KERNEL32(00000000), ref: 00405075
lstrlenW.KERNEL32(?), ref: 0040508A

Memory Dump Source

Source File: 00000005.00000002.1722456807.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1722022141.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723561398.0000000000436000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000444000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000448000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1724304481.000000000044B000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_LetsPRO.jbxd

Similarity

API ID: FindH_prolog3Path$CharCloseException@8FileFirstFullInformationNameThrowUpperVolumelstrlen
String ID:
API String ID: 4099955704-0
Opcode ID: 214c2089ce664e1ef4448a191ddb716942b6cb7bf37a21aaaf9e619263e29be1
Instruction ID: 91ad94d70d70b4dd36de2ebbb5cf289c8e85bb9b59863c3dd82648d311f341b0
Opcode Fuzzy Hash: 214c2089ce664e1ef4448a191ddb716942b6cb7bf37a21aaaf9e619263e29be1
Instruction Fuzzy Hash: A05193B190050BABDF14AFA5CC85ABF7778EF54318F10453EFA12B22D1DB389904CA69

Function 004019A0 Relevance: 9.1, APIs: 6, Instructions: 81windowCOMMON

Download Yara Rule

APIs

IsIconic.USER32(?), ref: 004019BD

Part of subcall function 00409E1B: __EH_prolog3.LIBCMT ref: 00409E22
Part of subcall function 00409E1B: BeginPaint.USER32(?,?,00000004,00407E16,?,00000058,00401A60), ref: 00409E4E

SendMessageW.USER32(?,00000027,?,00000000), ref: 004019E2
GetSystemMetrics.USER32(0000000B), ref: 004019F0
GetSystemMetrics.USER32(0000000C), ref: 004019F6
GetClientRect.USER32(?,?), ref: 00401A03
DrawIcon.USER32(?,?,?,?), ref: 00401A38

Part of subcall function 00409E6F: __EH_prolog3.LIBCMT ref: 00409E76
Part of subcall function 00409E6F: EndPaint.USER32(?,?,00000004,00407E3C,?,?,00000058,00401A60), ref: 00409E91

Memory Dump Source

Source File: 00000005.00000002.1722456807.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1722022141.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723561398.0000000000436000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000444000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000448000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1724304481.000000000044B000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_LetsPRO.jbxd

Similarity

API ID: H_prolog3MetricsPaintSystem$BeginClientDrawIconIconicMessageRectSend
String ID:
API String ID: 2914073315-0
Opcode ID: c3ce0db39e275e5d27d10002e1ea6948956b4412282004e4b1f241a2e44f1f5d
Instruction ID: a4affff3d414cb31efce955e27f83c9d36ee98e45a859567ad660ec17a097684
Opcode Fuzzy Hash: c3ce0db39e275e5d27d10002e1ea6948956b4412282004e4b1f241a2e44f1f5d
Instruction Fuzzy Hash: 962171727046019BC710EF78EC45D6BB7E9FBC8614F054A2DF585D7291DA34F8008B9A

Function 00420004 Relevance: 7.6, APIs: 5, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 004262C1
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 004262D6
UnhandledExceptionFilter.KERNEL32(0043A268), ref: 004262E1
GetCurrentProcess.KERNEL32(C0000409), ref: 004262FD
TerminateProcess.KERNEL32(00000000), ref: 00426304

Memory Dump Source

Source File: 00000005.00000002.1722456807.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1722022141.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723561398.0000000000436000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000444000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000448000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1724304481.000000000044B000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_LetsPRO.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: ecc97f912804438828e1966e43710ec487b56428d17f7004784823b6cc160999
Instruction ID: 864ec7f46cc21acbc383f90c61d2aba910a67569a949a7d628dbb029ce2d5f23
Opcode Fuzzy Hash: ecc97f912804438828e1966e43710ec487b56428d17f7004784823b6cc160999
Instruction Fuzzy Hash: C621F2B8501216EFDB00DF14F8896863BB4BB0A705F5195BAE809832B1E3B45980EF1D

Function 0040F158 Relevance: 6.0, APIs: 4, Instructions: 42COMMON

Download Yara Rule

APIs

FindResourceW.KERNEL32(?,0040184E,000000F0,?,?,?,?,004081EE,?,?,0040184E,1A1A596F), ref: 0040F17A
LoadResource.KERNEL32(?,00000000,?,?,?,?,004081EE,?,?,0040184E,1A1A596F), ref: 0040F186
LockResource.KERNEL32(00000000,?,?,?,?,004081EE,?,?,0040184E,1A1A596F), ref: 0040F193
FreeResource.KERNEL32(00000000,?,?,?,?,004081EE,?,?,0040184E,1A1A596F), ref: 0040F1AE

Memory Dump Source

Source File: 00000005.00000002.1722456807.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1722022141.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723561398.0000000000436000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000444000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000448000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1724304481.000000000044B000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_LetsPRO.jbxd

Similarity

API ID: Resource$FindFreeLoadLock
String ID:
API String ID: 1078018258-0
Opcode ID: 5a9aab4d71bf535e5b0d5d6aa9d4ee42cdafafc52cd61aed6ad3980aa941e0a6
Instruction ID: de0955fe7dfd3248114d5a17db3ae754cc72c3589112fd0f7a97439cfa078143
Opcode Fuzzy Hash: 5a9aab4d71bf535e5b0d5d6aa9d4ee42cdafafc52cd61aed6ad3980aa941e0a6
Instruction Fuzzy Hash: 72F09036301212ABD3216F669C4493BB6ACAFC566170A407AFD09E6752DE798C0982B9

Function 0040CA14 Relevance: 6.0, APIs: 4, Instructions: 41keyboardwindowCOMMON

Download Yara Rule

APIs

Part of subcall function 0040F274: GetWindowLongW.USER32(?,000000F0), ref: 0040F27F

GetKeyState.USER32(00000010), ref: 0040CA38
GetKeyState.USER32(00000011), ref: 0040CA41
GetKeyState.USER32(00000012), ref: 0040CA4A
SendMessageW.USER32(?,00000111,0000E146,00000000), ref: 0040CA60

Memory Dump Source

Source File: 00000005.00000002.1722456807.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1722022141.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723561398.0000000000436000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000444000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000448000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1724304481.000000000044B000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_LetsPRO.jbxd

Similarity

API ID: State$LongMessageSendWindow
String ID:
API String ID: 1063413437-0
Opcode ID: 62e92483b7e860adb451ebc77d8015100b3f8e89737f71a0c380ab59eb864b94
Instruction ID: 700bcd7e55ea1b02746442fd43853b6d64cbfd95824b4c18e67ba38dd625ac87
Opcode Fuzzy Hash: 62e92483b7e860adb451ebc77d8015100b3f8e89737f71a0c380ab59eb864b94
Instruction Fuzzy Hash: CEF0E977780B4FB7D920B3756C81FAA11149F41FD5F01873AA601FA1D1C978C9022A7C

Function 0040A238 Relevance: 4.5, APIs: 3, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1722456807.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1722022141.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723561398.0000000000436000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000444000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000448000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1724304481.000000000044B000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_LetsPRO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c60e44353c9918fedc69ab482322d10faec8ed902ebc644671f8c29fd74f219
Instruction ID: 3a219da448be22b1b8b061a2c747b84a278857d79077e6777079a01ec7cc6b38
Opcode Fuzzy Hash: 9c60e44353c9918fedc69ab482322d10faec8ed902ebc644671f8c29fd74f219
Instruction Fuzzy Hash: CFF03131500309AACF429F61DD449AE3B68AF14744F04807AFC05E52A1EB3ACB61AB6B

Function 00403E00 Relevance: 56.4, APIs: 23, Strings: 9, Instructions: 442windownetworksleepCOMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 00403E62
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 00403E85
PostMessageW.USER32(?,00000401,00000001,00000000), ref: 00403EA4
gethostbyname.WS2_32(00000000), ref: 00403EB0
PostMessageW.USER32(?,00000401,00000001,00000000), ref: 00403ED5
htons.WS2_32(?), ref: 00403EF3
socket.WS2_32(00000002,00000001,00000000), ref: 00403F0E
connect.WS2_32(00000000,?,00000010), ref: 00403F22
_malloc.LIBCMT ref: 00403F69

Part of subcall function 004200DD: __FF_MSGBANNER.LIBCMT ref: 00420100
Part of subcall function 004200DD: HeapAlloc.KERNEL32(00000000,004053C3,00000000,00000000,00000000,?,004044B2,00000000,?,00000000,00404563,0000000C,00000004,004010F6,00000000,004053D2), ref: 00420155

Part of subcall function 00404C2E: CloseHandle.KERNEL32(000000FF,00000000,?,00404E3E,00000010), ref: 00404C3D
Part of subcall function 00404C2E: GetLastError.KERNEL32(?,00000000,?,00404E3E,00000010), ref: 00404C62

Part of subcall function 00405160: CreateFileW.KERNEL32(?,?,00000000,?,00000003,00000080,00000000,?,?,?,?,?,00000104,00000000,?,?), ref: 004052C8

_memset.LIBCMT ref: 00404005
_memset.LIBCMT ref: 00404067
send.WS2_32(?,?,?,00000000), ref: 00404268
PostMessageW.USER32(?,00000401,00000001,00000000), ref: 00404295
__time64.LIBCMT ref: 004042C9
send.WS2_32(?,?,?,00000000), ref: 004042F2
GetLastError.KERNEL32(?,00000000,00000000,00000000), ref: 004042FC
Sleep.KERNEL32(0000000A,?,00000000,00000000,00000000), ref: 0040430B
__time64.LIBCMT ref: 00404319
PostMessageW.USER32(?,00000401,00000000,00000000), ref: 0040434D
__time64.LIBCMT ref: 00404355
closesocket.WS2_32(00000000), ref: 00404390
PostMessageW.USER32(?,00000401,00000000,00000064), ref: 004043A9
PostMessageW.USER32(?,00000401,00000001,?), ref: 004043BF

Part of subcall function 00404B5E: GetFileSize.KERNEL32(?,00000000,?,?,?,?,00402968,?,00000000,00000000,?,?,00000000,?,00000000,?), ref: 00404B6D
Part of subcall function 00404B5E: GetLastError.KERNEL32(00000000,?,?,?,?,00402968,?,00000000,00000000,?,?,00000000,?,00000000,?), ref: 00404B82
Part of subcall function 00404B5E: GetLastError.KERNEL32(?,?,?,?,?,00402968,?,00000000,00000000,?,?,00000000,?,00000000,?), ref: 00404B8B

Strings

#DMPINFO#PluginService_, xrefs: 0040419C
BossmailQ_, xrefs: 004040CB
PluginService_, xrefs: 00404178
#DMPINFO#ABMonitor_, xrefs: 0040414A
ABMonitor_, xrefs: 00404120
BossmailM_, xrefs: 0040406F
\version.txt, xrefs: 00403F8D
#DMPINFO#BossmailM_, xrefs: 0040409A
#DMPINFO#BossmailQ_, xrefs: 004040EF

Memory Dump Source

Source File: 00000005.00000002.1722456807.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1722022141.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723561398.0000000000436000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000444000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000448000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1724304481.000000000044B000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_LetsPRO.jbxd

Similarity

API ID: MessagePost$ErrorLast$__time64$ByteCharFileMultiWide_memsetsend$AllocCloseCreateHandleHeapSizeSleep_mallocclosesocketconnectgethostbynamehtonssocket
String ID: #DMPINFO#ABMonitor_$#DMPINFO#BossmailM_$#DMPINFO#BossmailQ_$#DMPINFO#PluginService_$ABMonitor_$BossmailM_$BossmailQ_$PluginService_$\version.txt
API String ID: 3337524319-53988438
Opcode ID: 5aa52bf2ad4098e9d26b4f8a7390ee34f5039b6e23be8380cdeaef94b91cebf5
Instruction ID: cbd0b3f4dc5de12968cab2350c91ed33f77bd8d90b828ea4c5f91bda8398eb10
Opcode Fuzzy Hash: 5aa52bf2ad4098e9d26b4f8a7390ee34f5039b6e23be8380cdeaef94b91cebf5
Instruction Fuzzy Hash: 7102CDB06043009BC314DF24DC85B6BBBE1AFC8714F14866EFA55AB3E1D775A805CB9A

Function 0041E38C Relevance: 42.0, APIs: 12, Strings: 12, Instructions: 44registryclipboardCOMMON

Download Yara Rule

APIs

RegisterClipboardFormatW.USER32(Native), ref: 0041E39B
RegisterClipboardFormatW.USER32(OwnerLink), ref: 0041E3A4
RegisterClipboardFormatW.USER32(ObjectLink), ref: 0041E3AE
RegisterClipboardFormatW.USER32(Embedded Object), ref: 0041E3B8
RegisterClipboardFormatW.USER32(Embed Source), ref: 0041E3C2
RegisterClipboardFormatW.USER32(Link Source), ref: 0041E3CC
RegisterClipboardFormatW.USER32(Object Descriptor), ref: 0041E3D6
RegisterClipboardFormatW.USER32(Link Source Descriptor), ref: 0041E3E0
RegisterClipboardFormatW.USER32(FileName), ref: 0041E3EA
RegisterClipboardFormatW.USER32(FileNameW), ref: 0041E3F4
RegisterClipboardFormatW.USER32(Rich Text Format), ref: 0041E3FE
RegisterClipboardFormatW.USER32(RichEdit Text and Objects), ref: 0041E408

Strings

Native, xrefs: 0041E394
Object Descriptor, xrefs: 0041E3CE
ObjectLink, xrefs: 0041E3A6
RichEdit Text and Objects, xrefs: 0041E400
Link Source Descriptor, xrefs: 0041E3D8
Link Source, xrefs: 0041E3C4
FileNameW, xrefs: 0041E3EC
Rich Text Format, xrefs: 0041E3F6
FileName, xrefs: 0041E3E2
Embed Source, xrefs: 0041E3BA
Embedded Object, xrefs: 0041E3B0
OwnerLink, xrefs: 0041E39D

Memory Dump Source

Source File: 00000005.00000002.1722456807.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1722022141.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723561398.0000000000436000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000444000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000448000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1724304481.000000000044B000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_LetsPRO.jbxd

Similarity

API ID: ClipboardFormatRegister
String ID: Embed Source$Embedded Object$FileName$FileNameW$Link Source$Link Source Descriptor$Native$Object Descriptor$ObjectLink$OwnerLink$Rich Text Format$RichEdit Text and Objects
API String ID: 1228543026-2889995556
Opcode ID: 2aa311f57bee7e8558e14f0df7a8c78c2ef30371ba570791ec221f684b148d0c
Instruction ID: cba61e2c2d25d188adf163892dfe47ad65edfca8251e31a41d5a604991a99e15
Opcode Fuzzy Hash: 2aa311f57bee7e8558e14f0df7a8c78c2ef30371ba570791ec221f684b148d0c
Instruction Fuzzy Hash: 94018C70A40B456ADB30AFB29C0DD0BBEE0EEC9B107225D6FE08597650D6F8D801CF88

Function 0041DE08 Relevance: 33.6, APIs: 18, Strings: 1, Instructions: 397stringCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0041DE0F
_memset.LIBCMT ref: 0041DE37
lstrlenA.KERNEL32(?), ref: 0041DE47
_memset.LIBCMT ref: 0041DEAE
_memset.LIBCMT ref: 0041E07A
VariantClear.OLEAUT32(?), ref: 0041E0D1
VariantClear.OLEAUT32(?), ref: 0041E0F9
SysStringLen.OLEAUT32(?), ref: 0041E150
SysFreeString.OLEAUT32(?), ref: 0041E16A
SysStringLen.OLEAUT32(?), ref: 0041E16F
SysFreeString.OLEAUT32(?), ref: 0041E183
SysStringLen.OLEAUT32(?), ref: 0041E188
SysFreeString.OLEAUT32(?), ref: 0041E19C
__CxxThrowException@8.LIBCMT ref: 0041E1B6
VariantChangeType.OLEAUT32(?,?,00000000,?), ref: 0041E1D4
VariantClear.OLEAUT32(?), ref: 0041E1E4

Strings

`<uP?<u, xrefs: 0041E164, 0041E24A

Memory Dump Source

Source File: 00000005.00000002.1722456807.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1722022141.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723561398.0000000000436000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000444000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000448000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1724304481.000000000044B000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_LetsPRO.jbxd

Similarity

API ID: String$Variant$ClearFree_memset$ChangeException@8H_prolog3ThrowTypelstrlen
String ID: `<uP?<u
API String ID: 4128688680-1824141693
Opcode ID: 95e1160b718ccaeee56f319c222ea23b218b4d0302c896b97251e63b3d052f93
Instruction ID: abf00313efc73110bfbd66cfb3e690076c869e465613cb9c70d12f9bb633390c
Opcode Fuzzy Hash: 95e1160b718ccaeee56f319c222ea23b218b4d0302c896b97251e63b3d052f93
Instruction Fuzzy Hash: BFF19C74900219DFDF10DFA9C844AEEBBB4FF55300F14416AE901A72A1D7B89D92CF59

Function 00423EE6 Relevance: 33.4, APIs: 15, Strings: 4, Instructions: 156fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

_strcpy_s.LIBCMT ref: 00423F52
__invoke_watson.LIBCMT ref: 00423F63
GetModuleFileNameA.KERNEL32(00000000,00448B69,00000104,00000000,004053D2,00000000,?,1A1A596F), ref: 00423F7F
_strcpy_s.LIBCMT ref: 00423F94
__invoke_watson.LIBCMT ref: 00423FA7
_strlen.LIBCMT ref: 00423FB0
_strlen.LIBCMT ref: 00423FBD
__invoke_watson.LIBCMT ref: 00423FEA
_strcat_s.LIBCMT ref: 00423FFD
__invoke_watson.LIBCMT ref: 0042400E
_strcat_s.LIBCMT ref: 0042401F
__invoke_watson.LIBCMT ref: 00424030
GetStdHandle.KERNEL32(000000F4,?,00000001,-0000000F,00000000,00000003,004240B2,000000FC,00425196,00441178,0000000C,00425251,004053D2,-0000000F,?,0041FC1F), ref: 0042404F
_strlen.LIBCMT ref: 00424070
WriteFile.KERNEL32(00000000,00000000,00000000,00000004,00000000,?,00000001,-0000000F,00000000,00000003,004240B2,000000FC,00425196,00441178,0000000C,00425251), ref: 0042407A

Strings

Runtime Error!Program: , xrefs: 00423F41
..., xrefs: 00423FCE
<program name unknown>, xrefs: 00423F89
Microsoft Visual C++ Runtime Library, xrefs: 0042403D

Memory Dump Source

Source File: 00000005.00000002.1722456807.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1722022141.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723561398.0000000000436000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000444000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000448000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1724304481.000000000044B000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_LetsPRO.jbxd

Similarity

API ID: __invoke_watson$_strlen$File_strcat_s_strcpy_s$HandleModuleNameWrite
String ID: ...$<program name unknown>$Microsoft Visual C++ Runtime Library$Runtime Error!Program:
API String ID: 1879448924-4022980321
Opcode ID: c025305e07b1e569b71321fc5e830d9808e258888d91f81af6f929dafb26c164
Instruction ID: c091abc66d996c3bffc9bc4536fdf1f6eb7cc126505262a47afdde4727225f2e
Opcode Fuzzy Hash: c025305e07b1e569b71321fc5e830d9808e258888d91f81af6f929dafb26c164
Instruction Fuzzy Hash: 893148A2B402317AE92036667D46F2F361CDF16759FC2013BFE46A12C3EA5D9A4040FE

Function 00424DF5 Relevance: 29.9, APIs: 12, Strings: 5, Instructions: 109libraryloadermemoryCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(KERNEL32.DLL,?,0041FA9D), ref: 00424DFB
__mtterm.LIBCMT ref: 00424E07

Part of subcall function 00424B49: TlsFree.KERNEL32(00000015,00424F74), ref: 00424B74
Part of subcall function 00424B49: DeleteCriticalSection.KERNEL32(00000000,00000000,74DEDFB0,00000001,00424F74), ref: 00425126
Part of subcall function 00424B49: DeleteCriticalSection.KERNEL32(00000015,74DEDFB0,00000001,00424F74), ref: 00425150

GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 00424E1D
GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 00424E2A
GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 00424E37
GetProcAddress.KERNEL32(00000000,FlsFree), ref: 00424E44
TlsAlloc.KERNEL32 ref: 00424E94
TlsSetValue.KERNEL32(00000000), ref: 00424EAF
__init_pointers.LIBCMT ref: 00424EB9
__calloc_crt.LIBCMT ref: 00424F2E
GetCurrentThreadId.KERNEL32 ref: 00424F5E

Strings

FlsSetValue, xrefs: 00424E2C
FlsGetValue, xrefs: 00424E1F
FlsFree, xrefs: 00424E39
KERNEL32.DLL, xrefs: 00424DF6
FlsAlloc, xrefs: 00424E17

Memory Dump Source

Source File: 00000005.00000002.1722456807.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1722022141.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723561398.0000000000436000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000444000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000448000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1724304481.000000000044B000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_LetsPRO.jbxd

Similarity

API ID: AddressProc$CriticalDeleteSection$AllocCurrentFreeHandleModuleThreadValue__calloc_crt__init_pointers__mtterm
String ID: FlsAlloc$FlsFree$FlsGetValue$FlsSetValue$KERNEL32.DLL
API String ID: 2125014093-3819984048
Opcode ID: 99755b91fbbc89bed10324034c026314e4cb83dbf85ff60727954ce2e5c46595
Instruction ID: 72108801d5c689150c0cb0402dc67e445b030ea73a22937bc0df6acde684d419
Opcode Fuzzy Hash: 99755b91fbbc89bed10324034c026314e4cb83dbf85ff60727954ce2e5c46595
Instruction Fuzzy Hash: 46316038B406319ADB20EF75BC056473BA4EBCA764B51457BE411D23A1DB798840EF6C

Function 0040A0E4 Relevance: 29.8, APIs: 8, Strings: 9, Instructions: 81libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(USER32,00000000,00000000,75C04A40,0040A243,?,?,?,?,?,?,?,0040C10B,00000000,00000002,00000028), ref: 0040A10D
GetProcAddress.KERNEL32(00000000,GetSystemMetrics), ref: 0040A129
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 0040A13E
GetProcAddress.KERNEL32(00000000,MonitorFromRect), ref: 0040A14F
GetProcAddress.KERNEL32(00000000,MonitorFromPoint), ref: 0040A160
GetProcAddress.KERNEL32(00000000,EnumDisplayMonitors), ref: 0040A171
GetProcAddress.KERNEL32(00000000,EnumDisplayDevicesW), ref: 0040A182
GetProcAddress.KERNEL32(00000000,GetMonitorInfoA), ref: 0040A1A2

Strings

MonitorFromRect, xrefs: 0040A149
GetMonitorInfoW, xrefs: 0040A195
MonitorFromWindow, xrefs: 0040A138
USER32, xrefs: 0040A103
EnumDisplayMonitors, xrefs: 0040A16B
EnumDisplayDevicesW, xrefs: 0040A17C
GetSystemMetrics, xrefs: 0040A123
MonitorFromPoint, xrefs: 0040A15A
GetMonitorInfoA, xrefs: 0040A19C

Memory Dump Source

Source File: 00000005.00000002.1722456807.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1722022141.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723561398.0000000000436000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000444000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000448000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1724304481.000000000044B000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_LetsPRO.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: EnumDisplayDevicesW$EnumDisplayMonitors$GetMonitorInfoA$GetMonitorInfoW$GetSystemMetrics$MonitorFromPoint$MonitorFromRect$MonitorFromWindow$USER32
API String ID: 667068680-2451437823
Opcode ID: 70d64f2f224267f667273c8401b08c30b6b3812b53f9d441994468ffa9b5af4f
Instruction ID: 5ef348c209eeae1d392ad86123653d48c89f150e4ee736b761ce5df204c1df64
Opcode Fuzzy Hash: 70d64f2f224267f667273c8401b08c30b6b3812b53f9d441994468ffa9b5af4f
Instruction Fuzzy Hash: F5218EB8A543559AC7B1AF25ADC142EBAE0B31AB00B26193FD404E66E0CF3C4456DF1E

Function 0040DE1E Relevance: 28.2, APIs: 14, Strings: 2, Instructions: 168COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0040DE3D

Part of subcall function 00411108: __EH_prolog3.LIBCMT ref: 0041110F

CallNextHookEx.USER32(?,00000003,?,?), ref: 0040DE86

Part of subcall function 004047D4: __CxxThrowException@8.LIBCMT ref: 004047E8
Part of subcall function 004047D4: __EH_prolog3.LIBCMT ref: 004047F5

_memset.LIBCMT ref: 0040DED3
GetClassLongW.USER32(?,000000E0), ref: 0040DEFD
SetWindowLongW.USER32(?,000000FC,Function_0000CD5A), ref: 0040DF4C
GetClassNameW.USER32(?,00000000,00000100), ref: 0040DF83
GetWindowLongW.USER32(?,000000FC), ref: 0040DFA8
GetPropW.USER32(?,AfxOldWndProc423), ref: 0040DFBC
SetPropW.USER32(?,AfxOldWndProc423,?), ref: 0040DFCB
GetPropW.USER32(?,AfxOldWndProc423), ref: 0040DFD3
GlobalAddAtomW.KERNEL32(AfxOldWndProc423), ref: 0040DFDF
SetWindowLongW.USER32(?,000000FC,Function_0000DCD4), ref: 0040DFED
CallNextHookEx.USER32(?,00000003,?,00000000), ref: 0040DFFC
UnhookWindowsHookEx.USER32(?), ref: 0040E00D

Strings

#32768, xrefs: 0040DEDF, 0040DEE4, 0040DF98
AfxOldWndProc423, xrefs: 0040DFB5, 0040DFBA, 0040DFC9, 0040DFD1, 0040DFDE

Memory Dump Source

Source File: 00000005.00000002.1722456807.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1722022141.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723561398.0000000000436000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000444000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000448000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1724304481.000000000044B000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_LetsPRO.jbxd

Similarity

API ID: Long$H_prolog3HookPropWindow$CallClassNext$AtomException@8GlobalNameThrowUnhookWindows_memset
String ID: #32768$AfxOldWndProc423
API String ID: 23696134-2141921550
Opcode ID: 45bbe55202f2689ab4ffa26c65348140a6050f58d8ce5073e48cc12f30be8ee1
Instruction ID: 0da77246ae1e96cee53cf25dcb10c1258f696c4c3f2a450413a8fe9e117104a6
Opcode Fuzzy Hash: 45bbe55202f2689ab4ffa26c65348140a6050f58d8ce5073e48cc12f30be8ee1
Instruction Fuzzy Hash: F451CA71900216ABDB24AFA1DC48BAF7BB8FF14315F10453AF516B72D1DB789904CBA8

Function 0041B2F3 Relevance: 26.0, APIs: 17, Instructions: 452windowkeyboardCOMMON

Download Yara Rule

APIs

GetFocus.USER32 ref: 0041B346
IsWindowEnabled.USER32(?), ref: 0041B3A2
__EH_prolog3_catch.LIBCMT ref: 0041B3F0
GetFocus.USER32 ref: 0041B410
GetParent.USER32(?), ref: 0041B45B
GetParent.USER32(?), ref: 0041B46B
GetKeyState.USER32(00000012), ref: 0041B529
IsDialogMessageW.USER32(?,?), ref: 0041B5DD
GetFocus.USER32 ref: 0041B5F0
GetFocus.USER32 ref: 0041B5FD
IsWindow.USER32(?), ref: 0041B615
GetFocus.USER32 ref: 0041B621
IsWindow.USER32(?), ref: 0041B637
GetFocus.USER32 ref: 0041B63D
GetKeyState.USER32(00000010), ref: 0041B666
MessageBeep.USER32(00000000), ref: 0041B75D

Memory Dump Source

Source File: 00000005.00000002.1722456807.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1722022141.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723561398.0000000000436000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000444000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000448000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1724304481.000000000044B000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_LetsPRO.jbxd

Similarity

API ID: Focus$Window$MessageParentState$BeepDialogEnabledH_prolog3_catch
String ID:
API String ID: 656273425-0
Opcode ID: bdfb49dd8e17de085c58ab7f51f393b2a1d55087972fea56ff3560c5419841af
Instruction ID: a0bcb496023687974714ecaaaaa73a26aec1aa27404c21f8d9b56ab8cb2a688d
Opcode Fuzzy Hash: bdfb49dd8e17de085c58ab7f51f393b2a1d55087972fea56ff3560c5419841af
Instruction Fuzzy Hash: 0BF1A031900206ABCF21AF65C984AEF7BA5EF54358F14802BE815A72A1D73DDCD1CBD9

Function 00423338 Relevance: 19.8, APIs: 13, Instructions: 296COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 00423379

Memory Dump Source

Source File: 00000005.00000002.1722456807.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1722022141.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723561398.0000000000436000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000444000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000448000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1724304481.000000000044B000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_LetsPRO.jbxd

Similarity

API ID: _memset
String ID:
API String ID: 2102423945-0
Opcode ID: d6ce05aa68c8d23803b1f46d8d19b4101a0eea411d2323399b93831a58441858
Instruction ID: f94d0d8a690e61cc34fdf1bb9be17fd1232cf63bf2782628261ce6f8fd58d8fc
Opcode Fuzzy Hash: d6ce05aa68c8d23803b1f46d8d19b4101a0eea411d2323399b93831a58441858
Instruction Fuzzy Hash: AF812771B00720ABDB24EE69EC8196FB3FAAF94314B94452FF405D2392E77C9B408759

Function 0040C01D Relevance: 19.7, APIs: 13, Instructions: 176windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0040F274: GetWindowLongW.USER32(?,000000F0), ref: 0040F27F

GetParent.USER32(?), ref: 0040C04A
SendMessageW.USER32(00000000,0000036B,00000000,00000000), ref: 0040C06D
GetWindowRect.USER32(?,?), ref: 0040C087
GetWindowLongW.USER32(00000000,000000F0), ref: 0040C09D
CopyRect.USER32(?,?), ref: 0040C0EA
CopyRect.USER32(?,?), ref: 0040C0F4
GetWindowRect.USER32(00000000,?), ref: 0040C0FD

Part of subcall function 0040A2A3: MultiByteToWideChar.KERNEL32(00000000,00000000,00000028,000000FF,00000028,00000020), ref: 0040A2E1

CopyRect.USER32(?,?), ref: 0040C119

Memory Dump Source

Source File: 00000005.00000002.1722456807.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1722022141.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723561398.0000000000436000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000444000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000448000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1724304481.000000000044B000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_LetsPRO.jbxd

Similarity

API ID: Rect$Window$Copy$Long$ByteCharMessageMultiParentSendWide
String ID:
API String ID: 1385303425-0
Opcode ID: 2c40df8149542d6f152b51ecd4970b752a1b38bfc79a7f299065a998b07216fb
Instruction ID: b54ec6c237fb53b972b7e4ff1fa9104f13b771f7a9ff6de76a547b83242ab6a0
Opcode Fuzzy Hash: 2c40df8149542d6f152b51ecd4970b752a1b38bfc79a7f299065a998b07216fb
Instruction Fuzzy Hash: 37515272900219EBDB10DBA8CC85EEEBBB9AF48314F15423AF905F7291D734E945CB58

Function 00424B86 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 49libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(KERNEL32.DLL,00441130,0000000C,00424C97,00000000,00000000,?,?,004053D2,00424AEA,?,004044B2,00000000,?,00000000,00404563), ref: 00424B97
GetProcAddress.KERNEL32(00404563,EncodePointer), ref: 00424BCB
GetProcAddress.KERNEL32(00404563,DecodePointer), ref: 00424BDB
InterlockedIncrement.KERNEL32(00445BE0), ref: 00424BFD
__lock.LIBCMT ref: 00424C05
___addlocaleref.LIBCMT ref: 00424C24

Strings

DecodePointer, xrefs: 00424BD3
KERNEL32.DLL, xrefs: 00424B92
EncodePointer, xrefs: 00424BBD
XXD, xrefs: 00424BA3
[D, xrefs: 00424BF4

Memory Dump Source

Source File: 00000005.00000002.1722456807.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1722022141.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723561398.0000000000436000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000444000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000448000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1724304481.000000000044B000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_LetsPRO.jbxd

Similarity

API ID: AddressProc$HandleIncrementInterlockedModule___addlocaleref__lock
String ID: DecodePointer$EncodePointer$KERNEL32.DLL$XXD$[D
API String ID: 1036688887-3935122862
Opcode ID: 50a9e9cbf5bdf676f8afd20d08ed7b33ed85a3da10ab2b1b2e79763bc05c892e
Instruction ID: 3f378ec04a5ab17254e90f597d8a4d4f3c9bc145f964c9e79b25297a29119b84
Opcode Fuzzy Hash: 50a9e9cbf5bdf676f8afd20d08ed7b33ed85a3da10ab2b1b2e79763bc05c892e
Instruction Fuzzy Hash: F611B270A44705AFEB10AF76E805B5BBBE0EF44304F50886FE89586391CB79E540CF59

Function 0041D4AC Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 249stringCOMMON

Download Yara Rule

APIs

__EH_prolog3_catch_GS.LIBCMT ref: 0041D4B3
lstrlenA.KERNEL32(00000000,000000FF,00000050,004135E6,00000000,00000001,?,?,000000FF,?,?,?), ref: 0041D4E5
__alloca_probe_16.LIBCMT ref: 0041D52E

Part of subcall function 004013D0: _memcpy_s.LIBCMT ref: 004013E4

__alloca_probe_16.LIBCMT ref: 0041D59C
_memset.LIBCMT ref: 0041D5AC
__alloca_probe_16.LIBCMT ref: 0041D5D5
VariantClear.OLEAUT32(?), ref: 0041D68B

Strings

`<uP?<u, xrefs: 0041D77E

Memory Dump Source

Source File: 00000005.00000002.1722456807.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1722022141.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723561398.0000000000436000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000444000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000448000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1724304481.000000000044B000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_LetsPRO.jbxd

Similarity

API ID: __alloca_probe_16$ClearH_prolog3_catch_Variant_memcpy_s_memsetlstrlen
String ID: `<uP?<u
API String ID: 2586305615-1824141693
Opcode ID: 1907dd1199930f7c91e8d7bca583ff4c2110c184fa798d6f096b50a70a313273
Instruction ID: 211e8c8b7fa695369da498723eb890c4f077bce3850296c15f3a71eabea3e4df
Opcode Fuzzy Hash: 1907dd1199930f7c91e8d7bca583ff4c2110c184fa798d6f096b50a70a313273
Instruction Fuzzy Hash: F9A1AEB1C00209EBCF10DFA5C985AEEBBB1FF04318F24416EE425A72A1D7789D81DB59

Function 00411634 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 126COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000104), ref: 00411677
PathFindExtensionW.SHLWAPI(?), ref: 00411691
__wcsdup.LIBCMT ref: 004116D4
__wcsdup.LIBCMT ref: 0041170D
__wcsdup.LIBCMT ref: 00411759
_wcscat_s.LIBCMT ref: 00411784
__wcsdup.LIBCMT ref: 00411796

Strings

.INI, xrefs: 00411777
.HLP, xrefs: 00411741
.CHM, xrefs: 0041173A

Memory Dump Source

Source File: 00000005.00000002.1722456807.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1722022141.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723561398.0000000000436000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000444000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000448000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1724304481.000000000044B000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_LetsPRO.jbxd

Similarity

API ID: __wcsdup$ExtensionFileFindModuleNamePath_wcscat_s
String ID: .CHM$.HLP$.INI
API String ID: 1106884133-4017452060
Opcode ID: d990e0c870bcc9fc95cb32378da741f39226d6edb413bcdf451e4a62a5f323b4
Instruction ID: 3a230f6d0aec72a1eef9b519d28e9918a3cebb241b4e1343566fd3418b5c470e
Opcode Fuzzy Hash: d990e0c870bcc9fc95cb32378da741f39226d6edb413bcdf451e4a62a5f323b4
Instruction Fuzzy Hash: 9F411C716007089BEB30EFA5DC85ADB77E8AF04304F14492BE956D72A1EB79D944CB28

Function 0040541E Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 56libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KERNEL32,?,?,00000000,00405D8B,000000FF), ref: 00405440
GetProcAddress.KERNEL32(00000000,CreateActCtxW), ref: 0040545E
GetProcAddress.KERNEL32(00000000,ReleaseActCtx), ref: 0040546B
GetProcAddress.KERNEL32(00000000,ActivateActCtx), ref: 00405478
GetProcAddress.KERNEL32(00000000,DeactivateActCtx), ref: 00405485

Strings

ActivateActCtx, xrefs: 0040546D
KERNEL32, xrefs: 0040543B
ReleaseActCtx, xrefs: 00405460
DeactivateActCtx, xrefs: 0040547A
CreateActCtxW, xrefs: 00405458

Memory Dump Source

Source File: 00000005.00000002.1722456807.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1722022141.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723561398.0000000000436000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000444000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000448000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1724304481.000000000044B000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_LetsPRO.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: ActivateActCtx$CreateActCtxW$DeactivateActCtx$KERNEL32$ReleaseActCtx
API String ID: 667068680-2424895508
Opcode ID: 77a9b56e51b66df6debdf479350dc43d8135da1b5650d34216dd255b6e773ecd
Instruction ID: e18f773ecece43aeff38eb2052f18a6c5eca60e460e35fa52d02637193184b33
Opcode Fuzzy Hash: 77a9b56e51b66df6debdf479350dc43d8135da1b5650d34216dd255b6e773ecd
Instruction Fuzzy Hash: B31106B5945761ABCB20EF659CC065B7AA8D617306712803FE100E32A1C2799880CF0F

Function 0040FC34 Relevance: 17.5, APIs: 5, Strings: 5, Instructions: 28libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KERNEL32), ref: 0040FC41
GetProcAddress.KERNEL32(00000000,CreateActCtxW), ref: 0040FC62
GetProcAddress.KERNEL32(ReleaseActCtx), ref: 0040FC74
GetProcAddress.KERNEL32(ActivateActCtx), ref: 0040FC86
GetProcAddress.KERNEL32(DeactivateActCtx), ref: 0040FC98

Strings

ActivateActCtx, xrefs: 0040FC76
KERNEL32, xrefs: 0040FC3C
ReleaseActCtx, xrefs: 0040FC64
DeactivateActCtx, xrefs: 0040FC88
CreateActCtxW, xrefs: 0040FC5C

Memory Dump Source

Source File: 00000005.00000002.1722456807.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1722022141.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723561398.0000000000436000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000444000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000448000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1724304481.000000000044B000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_LetsPRO.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: ActivateActCtx$CreateActCtxW$DeactivateActCtx$KERNEL32$ReleaseActCtx
API String ID: 667068680-2424895508
Opcode ID: 6f72acffc820e7a5d568d10d36ee0d355358134d6a9c711b71a49590c7eb9202
Instruction ID: b2fc7bb7ab2084d6828d9496b718b00426b3aa04ae4f5e3c7fcca26728cc5040
Opcode Fuzzy Hash: 6f72acffc820e7a5d568d10d36ee0d355358134d6a9c711b71a49590c7eb9202
Instruction Fuzzy Hash: 2FF012B8984315BEDB40AF70BD15A5F7FE4EA0B700732947FA500A2675DA7D44009F4C

Function 0040852A Relevance: 16.6, APIs: 11, Instructions: 139COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 00408531
FindResourceW.KERNEL32(?,?,00000005,00000024,004015D6), ref: 00408564
LoadResource.KERNEL32(?,00000000), ref: 0040856C
LockResource.KERNEL32(?,00000024,004015D6), ref: 0040857D
GetDesktopWindow.USER32 ref: 004085B0
IsWindowEnabled.USER32(?), ref: 004085BE
EnableWindow.USER32(?,00000000), ref: 004085CD

Part of subcall function 0040F38D: IsWindowEnabled.USER32(?), ref: 0040F396

Part of subcall function 0040F3A8: EnableWindow.USER32(?,0043BE74), ref: 0040F3B5

EnableWindow.USER32(?,00000001), ref: 004086B1
GetActiveWindow.USER32 ref: 004086BC
SetActiveWindow.USER32(?,?,00000024,004015D6), ref: 004086CA
FreeResource.KERNEL32(?,?,00000024,004015D6), ref: 004086E6

Memory Dump Source

Source File: 00000005.00000002.1722456807.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1722022141.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723561398.0000000000436000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000444000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000448000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1724304481.000000000044B000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_LetsPRO.jbxd

Similarity

API ID: Window$Resource$Enable$ActiveEnabled$DesktopFindFreeH_prolog3_catchLoadLock
String ID:
API String ID: 1509511306-0
Opcode ID: 13c5e878623bf7e8106c243e8fdf20ab7febdb529efa9efb8950c130555874d2
Instruction ID: 1e238546ddfaa2223ac4f33f33f8b7085241461b35130f9d3a7a2165611d5759
Opcode Fuzzy Hash: 13c5e878623bf7e8106c243e8fdf20ab7febdb529efa9efb8950c130555874d2
Instruction Fuzzy Hash: A151BD30A00705DBCF21AFA1CD856AEBAB1AF44705F15583EE581B62D2CF7A4941CB5D

Function 0040DCD4 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 90COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 0040DCDB
GetPropW.USER32(?,AfxOldWndProc423), ref: 0040DCEA
CallWindowProcW.USER32(?,?,00000110,?,00000000), ref: 0040DD44

Part of subcall function 0040CBEB: GetWindowRect.USER32(?,10000000), ref: 0040CC13
Part of subcall function 0040CBEB: GetWindow.USER32(?,00000004), ref: 0040CC30

SetWindowLongW.USER32(?,000000FC,?), ref: 0040DD6B
RemovePropW.USER32(?,AfxOldWndProc423), ref: 0040DD73
GlobalFindAtomW.KERNEL32(AfxOldWndProc423), ref: 0040DD7A
GlobalDeleteAtom.KERNEL32(00000000), ref: 0040DD81

Part of subcall function 0040B352: GetWindowRect.USER32(?,?), ref: 0040B35E

CallWindowProcW.USER32(?,?,?,?,00000000), ref: 0040DDD5

Strings

AfxOldWndProc423, xrefs: 0040DCE3, 0040DCE8, 0040DD71, 0040DD79

Memory Dump Source

Source File: 00000005.00000002.1722456807.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1722022141.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723561398.0000000000436000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000444000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000448000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1724304481.000000000044B000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_LetsPRO.jbxd

Similarity

API ID: Window$AtomCallGlobalProcPropRect$DeleteFindH_prolog3_catchLongRemove
String ID: AfxOldWndProc423
API String ID: 2702501687-1060338832
Opcode ID: 538f550fd712badf9b57780a3a146dc0c62c7650a895da4dbad66f08faaa0d50
Instruction ID: 9c882e1992c9829746089810e3b8a0e72fa70729ee1f7effc38cff115e16d97e
Opcode Fuzzy Hash: 538f550fd712badf9b57780a3a146dc0c62c7650a895da4dbad66f08faaa0d50
Instruction Fuzzy Hash: 3B316F3280011ABBCF11AFE5DD89DBF3A78AF45341F04553AFA01B61A1C73D9914DB69

Function 00407754 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 255memoryCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0040776D
MapDialogRect.USER32(?,00000000), ref: 004077FE
SysAllocStringLen.OLEAUT32(?,?), ref: 0040781D
CLSIDFromString.OLE32(?,?,00000000), ref: 0040790F

Part of subcall function 00404493: _malloc.LIBCMT ref: 004044AD

CLSIDFromProgID.OLE32(?,?,00000000), ref: 00407917
SetWindowPos.USER32(?,00000001,00000000,00000000,00000000,00000000,00000013,00000001,00000000,?,00000000,?,00000000,00000000,0000FC84,00000000), ref: 004079B1
SysFreeString.OLEAUT32(00000000), ref: 00407A03

Strings

`<uP?<u, xrefs: 00407A03

Memory Dump Source

Source File: 00000005.00000002.1722456807.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1722022141.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723561398.0000000000436000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000444000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000448000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1724304481.000000000044B000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_LetsPRO.jbxd

Similarity

API ID: String$From$AllocDialogFreeH_prolog3ProgRectWindow_malloc
String ID: `<uP?<u
API String ID: 2841959276-1824141693
Opcode ID: c3bc9a3493cc8d56aba3b9edf6155d447147d51efc0b91a54d5cfc9a93edffe3
Instruction ID: bc52a4bf5f5b7007ff3a8be8c0adf266826bdacedcd02c3f08d47855cbac024b
Opcode Fuzzy Hash: c3bc9a3493cc8d56aba3b9edf6155d447147d51efc0b91a54d5cfc9a93edffe3
Instruction Fuzzy Hash: CAB107B1904209AFDB04DF69C984AEE77B4FF08344F01812AFC19A7391D778E994CB95

Function 004023C0 Relevance: 14.2, APIs: 4, Strings: 4, Instructions: 173COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00402404
GetCurrentDirectoryW.KERNEL32(00000104,?,?,1A1A596F), ref: 00402416
_wcsrchr.LIBCMT ref: 0040247A
GetPrivateProfileStringW.KERNEL32(LANGUAGESET,language,0043C1DC,?,00000800,?), ref: 00402517

Strings

LANGUAGESET, xrefs: 00402512
language, xrefs: 0040250D
\language\, xrefs: 0040253C
\language\language.ini, xrefs: 004024E1

Memory Dump Source

Source File: 00000005.00000002.1722456807.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1722022141.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723561398.0000000000436000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000444000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000448000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1724304481.000000000044B000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_LetsPRO.jbxd

Similarity

API ID: CurrentDirectoryPrivateProfileString_memset_wcsrchr
String ID: LANGUAGESET$\language\$\language\language.ini$language
API String ID: 368967617-3145506036
Opcode ID: 3d9b2743761eaa3709a8e16261b682577cd3a9e15e3bb60332b9e02cace049bb
Instruction ID: 58e23b6d0db60255a928efeb7a1380ced23a686096516732d5e772b78613dd91
Opcode Fuzzy Hash: 3d9b2743761eaa3709a8e16261b682577cd3a9e15e3bb60332b9e02cace049bb
Instruction Fuzzy Hash: 8C51D1712107019FD310DB6CCD46B57B3E4EF8A714F14862EB909DB2D1EB78A904CB9A

Function 00408332 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 158COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 00408339
GetSystemMetrics.USER32(0000002A), ref: 004083EA
GlobalLock.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?), ref: 00408453
CreateDialogIndirectParamW.USER32(00000000,00000000,?,00407D8E,00000000), ref: 00408482

Strings

MS Shell Dlg, xrefs: 004083F4

Memory Dump Source

Source File: 00000005.00000002.1722456807.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1722022141.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723561398.0000000000436000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000444000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000448000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1724304481.000000000044B000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_LetsPRO.jbxd

Similarity

API ID: CreateDialogGlobalH_prolog3_catchIndirectLockMetricsParamSystem
String ID: MS Shell Dlg
API String ID: 1736106359-76309092
Opcode ID: b4fe3057a793fb7ce401e53bccfd20460f50b3d02370a4a3c6ec6ffe282d8963
Instruction ID: 39c1e0509a6014002f14bf4e4271800465cd50327ac4c286832741a7080f744e
Opcode Fuzzy Hash: b4fe3057a793fb7ce401e53bccfd20460f50b3d02370a4a3c6ec6ffe282d8963
Instruction Fuzzy Hash: 38517F3190021AABCF10AFA0C9859EEBBB4AF04314F14453EF951B72D1DB789E85CB99

Function 0041A840 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0041A847
_memset.LIBCMT ref: 0041A8B3

Part of subcall function 00412533: _memset.LIBCMT ref: 0041253B

VariantClear.OLEAUT32(?), ref: 0041A8F3
SysFreeString.OLEAUT32(00000000), ref: 0041A974
SysFreeString.OLEAUT32(00000000), ref: 0041A983
SysFreeString.OLEAUT32(00000000), ref: 0041A992
VariantClear.OLEAUT32(00000000), ref: 0041A9A7

Part of subcall function 0041A329: __EH_prolog3.LIBCMT ref: 0041A345
Part of subcall function 0041A329: VariantClear.OLEAUT32(?), ref: 0041A3AA

Part of subcall function 00412513: VariantCopy.OLEAUT32(?,?), ref: 00412521

Strings

`<uP?<u, xrefs: 0041A974, 0041A983, 0041A992

Memory Dump Source

Source File: 00000005.00000002.1722456807.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1722022141.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723561398.0000000000436000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000444000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000448000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1724304481.000000000044B000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_LetsPRO.jbxd

Similarity

API ID: Variant$ClearFreeString$H_prolog3_memset$Copy
String ID: `<uP?<u
API String ID: 2905758408-1824141693
Opcode ID: bddaa39f34858816c9d10c6128fea87d7b98dbd37fc914b843fc8acff48d7b8c
Instruction ID: ca3254c034f5afcab1d8f6bf540462dc3f8e59a53b19ac5fc45c7fb798e078d3
Opcode Fuzzy Hash: bddaa39f34858816c9d10c6128fea87d7b98dbd37fc914b843fc8acff48d7b8c
Instruction Fuzzy Hash: 105149B0A00209EFDB10DFA4C884BDEB7B4BF08305F10452AE515E7291D778A994CF65

Function 0041BEF4 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 63COMMON

Download Yara Rule

APIs

GetStockObject.GDI32(00000011), ref: 0041BF1A
GetStockObject.GDI32(0000000D), ref: 0041BF22
GetObjectW.GDI32(00000000,0000005C,?), ref: 0041BF2F
GetDC.USER32(00000000), ref: 0041BF3E
GetDeviceCaps.GDI32(00000000,0000005A), ref: 0041BF52
MulDiv.KERNEL32(00000000,00000048,00000000), ref: 0041BF5E
ReleaseDC.USER32(00000000,00000000), ref: 0041BF6A

Strings

System, xrefs: 0041BF15, 0041BF7F

Memory Dump Source

Source File: 00000005.00000002.1722456807.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1722022141.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723561398.0000000000436000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000444000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000448000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1724304481.000000000044B000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_LetsPRO.jbxd

Similarity

API ID: Object$Stock$CapsDeviceRelease
String ID: System
API String ID: 46613423-3470857405
Opcode ID: e93460c81874e22d53bde71080c390f592df65ccdd13db018a7eb59a8dd431ed
Instruction ID: 364bada5f2a26b61b0d6a85c1fc62b62f30060650a7d4bfd77944c64ba70cb4a
Opcode Fuzzy Hash: e93460c81874e22d53bde71080c390f592df65ccdd13db018a7eb59a8dd431ed
Instruction Fuzzy Hash: 43116071A00319ABEB10DBA1DC49FAF77B8EF15745F01402AFA05DB191DB749D41CBA8

Function 00424735 Relevance: 13.7, APIs: 9, Instructions: 186COMMON

Download Yara Rule

APIs

GetStartupInfoA.KERNEL32(?), ref: 0042474A
__calloc_crt.LIBCMT ref: 0042475D

Part of subcall function 0042634C: __calloc_impl.LIBCMT ref: 0042635A
Part of subcall function 0042634C: Sleep.KERNEL32(00000000,00000000,004053D2,00000000,?,1A1A596F), ref: 00426371

__calloc_crt.LIBCMT ref: 004247E0
GetFileType.KERNEL32(00000038), ref: 00424860
___crtInitCritSecAndSpinCount.LIBCMT ref: 00424894
GetStdHandle.KERNEL32(-000000F6), ref: 004248EA
GetFileType.KERNEL32(00000000), ref: 004248FC
___crtInitCritSecAndSpinCount.LIBCMT ref: 0042492A
SetHandleCount.KERNEL32 ref: 00424954

Memory Dump Source

Source File: 00000005.00000002.1722456807.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1722022141.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723561398.0000000000436000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000444000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000448000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1724304481.000000000044B000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_LetsPRO.jbxd

Similarity

API ID: Count$CritFileHandleInitSpinType___crt__calloc_crt$InfoSleepStartup__calloc_impl
String ID:
API String ID: 1318386821-0
Opcode ID: 1eca59286fa8377bcbfca40d8ec93cbe50eecb4d9e4f30e0b42a6a843f2b977b
Instruction ID: a47fce136a6550d471525324bd1d59ddbeadb93ee19ccf7b801f9d7af728af2d
Opcode Fuzzy Hash: 1eca59286fa8377bcbfca40d8ec93cbe50eecb4d9e4f30e0b42a6a843f2b977b
Instruction Fuzzy Hash: 0A614975A043A18ED720DB78E8447167BE0EF92334F69836AD4A5DB3E1D73C9842CB19

Function 00433F12 Relevance: 13.6, APIs: 9, Instructions: 146librarymemoryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(?), ref: 00433F57
GetLastError.KERNEL32 ref: 00433F63
RaiseException.KERNEL32(C06D007E,00000000,00000001,?), ref: 00433F96
InterlockedExchange.KERNEL32(?,00000000), ref: 00433FA8
LocalAlloc.KERNEL32(00000040,00000008), ref: 00433FBC
FreeLibrary.KERNEL32(00000000), ref: 00433FD9
GetProcAddress.KERNEL32(?,?), ref: 0043402E
GetLastError.KERNEL32(?,?), ref: 0043403A
RaiseException.KERNEL32(C06D007F,00000000,00000001,?,?,?), ref: 0043406C

Memory Dump Source

Source File: 00000005.00000002.1722456807.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1722022141.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723561398.0000000000436000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000444000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000448000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1724304481.000000000044B000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_LetsPRO.jbxd

Similarity

API ID: ErrorExceptionLastLibraryRaise$AddressAllocExchangeFreeInterlockedLoadLocalProc
String ID:
API String ID: 991255547-0
Opcode ID: 656c829db1ec91fd0a5808f21ab56c5bb43d0d5cadb3a991a77936d769852bc5
Instruction ID: 682f8d2613fcbe4da73ea7fcd36dabf6514a088aa5cab634c909475c111ada43
Opcode Fuzzy Hash: 656c829db1ec91fd0a5808f21ab56c5bb43d0d5cadb3a991a77936d769852bc5
Instruction Fuzzy Hash: 53515B74B00206AFDB15DF94C984BAEB7B4EB9C311F11902AE605D7390EB74AE05CF29

Function 00410ECF Relevance: 13.6, APIs: 9, Instructions: 96memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 00410ED6
EnterCriticalSection.KERNEL32(?,00000010,00411188,?,00000000,?,00000004,004104C7,004047EE,00405A03,?,?,00401564), ref: 00410EE7
TlsGetValue.KERNEL32(?,?,00000000,?,00000004,004104C7,004047EE,00405A03,?,?,00401564), ref: 00410F05
LocalAlloc.KERNEL32(00000000,00000000,00000000,00000010,?,?,00000000,?,00000004,004104C7,004047EE,00405A03,?,?,00401564), ref: 00410F39
LeaveCriticalSection.KERNEL32(?,?,?,00000000,?,00000004,004104C7,004047EE,00405A03,?,?,00401564), ref: 00410FA5
_memset.LIBCMT ref: 00410FC4
TlsSetValue.KERNEL32(?,00000000,?,1A1A596F), ref: 00410FD5
LeaveCriticalSection.KERNEL32(?,?,00000000,?,00000004,004104C7,004047EE,00405A03,?,?,00401564), ref: 00410FF6

Memory Dump Source

Source File: 00000005.00000002.1722456807.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1722022141.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723561398.0000000000436000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000444000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000448000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1724304481.000000000044B000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_LetsPRO.jbxd

Similarity

API ID: CriticalSection$LeaveValue$AllocEnterH_prolog3_catchLocal_memset
String ID:
API String ID: 1891723912-0
Opcode ID: 4374d8d4a9edb0bde81c16dda0ca4aa98e1461abafbe34a4e9ebc7ecfd9a285b
Instruction ID: 5f36cfa26c4978479d33db62dffa8bb899f25cca94fd1cc498ffad8b3a06a798
Opcode Fuzzy Hash: 4374d8d4a9edb0bde81c16dda0ca4aa98e1461abafbe34a4e9ebc7ecfd9a285b
Instruction Fuzzy Hash: 3631B071500606AFCB30AF50D8868ABB7B5EF04310B10C52FF916A7661CBB8ADC1CF98

Function 00401A90 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 164COMMON

Download Yara Rule

APIs

Part of subcall function 0040F3A8: EnableWindow.USER32(?,0043BE74), ref: 0040F3B5

Part of subcall function 00404493: _malloc.LIBCMT ref: 004044AD

GetPrivateProfileStringW.KERNEL32(errorreport,host,0043C1A8,?,00000208), ref: 00401BCB

Strings

errorreport, xrefs: 00401BC6, 00401C3E
host, xrefs: 00401BC1
\conf\server.ini, xrefs: 00401B98, 00401C1D
port, xrefs: 00401C39

Memory Dump Source

Source File: 00000005.00000002.1722456807.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1722022141.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723561398.0000000000436000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000444000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000448000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1724304481.000000000044B000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_LetsPRO.jbxd

Similarity

API ID: EnablePrivateProfileStringWindow_malloc
String ID: \conf\server.ini$errorreport$host$port
API String ID: 3483739966-1484723992
Opcode ID: ed0bd7daf9276c579073e802f1774ea4c452a9f76d0a5638ae2a5502a3451cb8
Instruction ID: b0981e852b9871dd659f39fc9afe6ffd2c0585563d07f9b2af406dc725a527d8
Opcode Fuzzy Hash: ed0bd7daf9276c579073e802f1774ea4c452a9f76d0a5638ae2a5502a3451cb8
Instruction Fuzzy Hash: AE519E702407019FD314DB68CC46F57B3E4EF89724F14872DB5699B2E1EB78A805CB99

Function 0042D954 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 162COMMONLIBRARYCODE

Download Yara Rule

APIs

__filbuf.LIBCMT ref: 0042D9BF
__filbuf.LIBCMT ref: 0042D9E6
__filbuf.LIBCMT ref: 0042DA60
__filbuf.LIBCMT ref: 0042DA90
_ungetc.LIBCMT ref: 0042DAA1
__filwbuf.LIBCMT ref: 0042DAF0

Strings

XD, xrefs: 0042D962

Memory Dump Source

Source File: 00000005.00000002.1722456807.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1722022141.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723561398.0000000000436000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000444000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000448000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1724304481.000000000044B000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_LetsPRO.jbxd

Similarity

API ID: __filbuf$__filwbuf_ungetc
String ID: XD
API String ID: 716107490-3890398793
Opcode ID: 3ef7d8f3931c19c1aecc3e0e9b90dcf7a1d4dc0523ed6e41b083303576602fe2
Instruction ID: 35c15fb16bbdd999416d544bebc1f9cdcb27a7ff0f8124886296c9311547ac31
Opcode Fuzzy Hash: 3ef7d8f3931c19c1aecc3e0e9b90dcf7a1d4dc0523ed6e41b083303576602fe2
Instruction Fuzzy Hash: 9B415B71B09671ADC7246F39B8018BA3BA49F433347B4061FF4E1871C2DA7C9582976D

Function 0041661B Relevance: 12.3, APIs: 8, Instructions: 297memoryCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00416622

Part of subcall function 00414DF0: SysStringLen.OLEAUT32(?), ref: 00414DF8
Part of subcall function 00414DF0: CoGetClassObject.OLE32(?,?,00000000,0043B644,?), ref: 00414E16

CreateILockBytesOnHGlobal.OLE32(00000000,00000001,?), ref: 004167AC
StgCreateDocfileOnILockBytes.OLE32(?,00001012,00000000,?), ref: 004167CD
GlobalAlloc.KERNEL32(00000000,00000000), ref: 0041681A
GlobalLock.KERNEL32(00000000), ref: 00416828
GlobalUnlock.KERNEL32(?), ref: 00416840
CreateILockBytesOnHGlobal.OLE32(8007000E,00000001,?), ref: 00416863
StgOpenStorageOnILockBytes.OLE32(?,00000000,00000012,00000000,00000000,?), ref: 0041687F

Memory Dump Source

Source File: 00000005.00000002.1722456807.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1722022141.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723561398.0000000000436000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000444000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000448000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1724304481.000000000044B000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_LetsPRO.jbxd

Similarity

API ID: GlobalLock$Bytes$Create$AllocClassDocfileH_prolog3ObjectOpenStorageStringUnlock
String ID:
API String ID: 317715441-0
Opcode ID: c3132cd44d7f389dfd0458b24f2f73b9e28b4f5a76575bec3d204f32e70daf9a
Instruction ID: 049b0f74ee5dbc78de9f45aaeffaf5dface5723b3c6e58c5c72743c5d13ea762
Opcode Fuzzy Hash: c3132cd44d7f389dfd0458b24f2f73b9e28b4f5a76575bec3d204f32e70daf9a
Instruction Fuzzy Hash: B6C1F8B0A0020AEFDF10DFA4C8889AEB7B9FF48305B11456EF915DB250C779D991CB64

Function 004057EF Relevance: 12.1, APIs: 8, Instructions: 65memorystringCOMMON

Download Yara Rule

APIs

GlobalLock.KERNEL32(?), ref: 0040580C
lstrcmpW.KERNEL32(00000000,?), ref: 00405819
OpenPrinterW.WINSPOOL.DRV(?,?,00000000), ref: 0040582B
DocumentPropertiesW.WINSPOOL.DRV(00000000,?,?,00000000,00000000,00000000,?,?,00000000), ref: 0040584B
GlobalAlloc.KERNEL32(00000042,00000000,00000000,?,?,00000000,00000000,00000000,?,?,00000000), ref: 00405853
GlobalLock.KERNEL32(00000000), ref: 0040585D
DocumentPropertiesW.WINSPOOL.DRV(00000000,?,?,00000000,00000000,00000002), ref: 0040586A
ClosePrinter.WINSPOOL.DRV(?,00000000,?,?,00000000,00000000,00000002), ref: 00405882

Part of subcall function 00412B32: GlobalFlags.KERNEL32(?), ref: 00412B3D
Part of subcall function 00412B32: GlobalUnlock.KERNEL32(?,?,00000000,0040587C,?,00000000,?,?,00000000,00000000,00000002), ref: 00412B4F
Part of subcall function 00412B32: GlobalFree.KERNEL32(?), ref: 00412B5A

Memory Dump Source

Source File: 00000005.00000002.1722456807.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1722022141.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723561398.0000000000436000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000444000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000448000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1724304481.000000000044B000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_LetsPRO.jbxd

Similarity

API ID: Global$DocumentLockProperties$AllocCloseFlagsFreeOpenPrinterPrinter.Unlocklstrcmp
String ID:
API String ID: 168474834-0
Opcode ID: 4d0d7e38b9eb1f04567e45fd8bbacc84491abd0059bc6bd5c9937a18b1aa44d7
Instruction ID: a31a733fe53bfc206e8cdb9ce9e7d28b48aefc1ba52aefbe97da6e59e82ffadc
Opcode Fuzzy Hash: 4d0d7e38b9eb1f04567e45fd8bbacc84491abd0059bc6bd5c9937a18b1aa44d7
Instruction Fuzzy Hash: DA11BCB2500504BECB22AFA6CC49DAF7ABDFF88744B00406AFA05D2160C679DA50DB28

Function 004109EB Relevance: 12.0, APIs: 8, Instructions: 38COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32(0000000B), ref: 004109F8
GetSystemMetrics.USER32(0000000C), ref: 004109FF
GetSystemMetrics.USER32(00000002), ref: 00410A06
GetSystemMetrics.USER32(00000003), ref: 00410A10
GetDC.USER32(00000000), ref: 00410A1A
GetDeviceCaps.GDI32(00000000,00000058), ref: 00410A2B
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00410A33
ReleaseDC.USER32(00000000,00000000), ref: 00410A3B

Memory Dump Source

Source File: 00000005.00000002.1722456807.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1722022141.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723561398.0000000000436000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000444000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000448000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1724304481.000000000044B000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_LetsPRO.jbxd

Similarity

API ID: MetricsSystem$CapsDevice$Release
String ID:
API String ID: 1151147025-0
Opcode ID: 1f8c3abcae24643ecd5833b328aed06a2ef915047b2bb46003fced01461b54e8
Instruction ID: 61b9616601b4ff89a69c4e29c4f4ab3acaa3d874a0739be0f4b2223552b662f5
Opcode Fuzzy Hash: 1f8c3abcae24643ecd5833b328aed06a2ef915047b2bb46003fced01461b54e8
Instruction Fuzzy Hash: 00F03671E40705AFE720AF729C49F2B7BA4EB92711F11843EE7418B2D0DBB598018F58

Function 0042D579 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 188COMMONLIBRARYCODE

Download Yara Rule

APIs

__flsbuf.LIBCMT ref: 0042D647
__flsbuf.LIBCMT ref: 0042D674
_wctomb_s.LIBCMT ref: 0042D6D7
__flsbuf.LIBCMT ref: 0042D70C
__flswbuf.LIBCMT ref: 0042D741

Strings

XD, xrefs: 0042D5A3

Memory Dump Source

Source File: 00000005.00000002.1722456807.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1722022141.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723561398.0000000000436000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000444000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000448000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1724304481.000000000044B000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_LetsPRO.jbxd

Similarity

API ID: __flsbuf$__flswbuf_wctomb_s
String ID: XD
API String ID: 3257920507-3890398793
Opcode ID: f25ac954b5a1f4e9cbbc797ca6a428bb83eb54cc9e847c0b3bcbc42f0c9643dd
Instruction ID: c7b2870deb4318c148524c72433ecab5c21b485562c60c9ac2bf8766f3fa7b2b
Opcode Fuzzy Hash: f25ac954b5a1f4e9cbbc797ca6a428bb83eb54cc9e847c0b3bcbc42f0c9643dd
Instruction Fuzzy Hash: 94512B75B04534AAC7255F38B8858BB77A4DE963283B4060FF0A5CB2D1DE2CD541CB6D

Function 0042BAD1 Relevance: 10.7, APIs: 7, Instructions: 158COMMONLIBRARYCODE

Download Yara Rule

APIs

getSystemCP.LIBCMT ref: 0042BAEA

Part of subcall function 0042BA57: _LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0042BA64
Part of subcall function 0042BA57: GetOEMCP.KERNEL32(00000000), ref: 0042BA7E

setSBCS.LIBCMT ref: 0042BAFC

Part of subcall function 0042B7D4: _memset.LIBCMT ref: 0042B7E7

IsValidCodePage.KERNEL32(-00000030), ref: 0042BB42
GetCPInfo.KERNEL32(00000000,?), ref: 0042BB55
_memset.LIBCMT ref: 0042BB6D
setSBUpLow.LIBCMT ref: 0042BC40

Memory Dump Source

Source File: 00000005.00000002.1722456807.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1722022141.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723561398.0000000000436000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000444000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000448000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1724304481.000000000044B000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_LetsPRO.jbxd

Similarity

API ID: Locale_memset$CodeInfoPageSystemUpdateUpdate::_Valid
String ID:
API String ID: 2658552758-0
Opcode ID: 1850c64382e006846d8dc4eb764dd0d22e9badf9ca4d0b0729caed890ba6b5ed
Instruction ID: 6b0ac20a5e978dc1dcd590305741b872845394093898a2b2a84d42a0656ab36f
Opcode Fuzzy Hash: 1850c64382e006846d8dc4eb764dd0d22e9badf9ca4d0b0729caed890ba6b5ed
Instruction Fuzzy Hash: 5A510430A002698BDF15DF26D8846BEBBB4EF45304F54806FE8869B252C73C9842CBD8

Function 00417346 Relevance: 10.6, APIs: 7, Instructions: 121COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0041734D
VariantClear.OLEAUT32(?), ref: 004173E3
_memset.LIBCMT ref: 0041741C
_memset.LIBCMT ref: 00417428
SysFreeString.OLEAUT32(?), ref: 0041746D
SysFreeString.OLEAUT32(?), ref: 00417477
SysFreeString.OLEAUT32(?), ref: 00417481

Memory Dump Source

Source File: 00000005.00000002.1722456807.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1722022141.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723561398.0000000000436000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000444000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000448000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1724304481.000000000044B000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_LetsPRO.jbxd

Similarity

API ID: FreeString$_memset$ClearH_prolog3Variant
String ID:
API String ID: 3574576181-0
Opcode ID: b2b09945bc0bf90fef0d7093cd6f7735aa9d114048c87f59f0d8805be38800b9
Instruction ID: 0f09f3d3ca93ecd04ce9c50a439c2a3c5894d72590a6c756199768d824689baa
Opcode Fuzzy Hash: b2b09945bc0bf90fef0d7093cd6f7735aa9d114048c87f59f0d8805be38800b9
Instruction Fuzzy Hash: BE415A71A00229EFCF11DFA4C845ADEBB79BF48B14F10851BF415AB291C7789A81CF94

Function 004092B6 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 117registryCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 004092D5
RegOpenKeyW.ADVAPI32(80000001,?,?), ref: 00409391
RegEnumKeyW.ADVAPI32(?,00000000,00000000,00000104), ref: 004093A8
RegCloseKey.ADVAPI32(?,?,?,?,?,Software\,00000018), ref: 004093C2
RegQueryValueW.ADVAPI32(80000001,?,?,?), ref: 004093D4

Strings

Software\, xrefs: 0040932A

Memory Dump Source

Source File: 00000005.00000002.1722456807.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1722022141.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723561398.0000000000436000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000444000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000448000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1724304481.000000000044B000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_LetsPRO.jbxd

Similarity

API ID: CloseEnumH_prolog3OpenQueryValue
String ID: Software\
API String ID: 3878845136-964853688
Opcode ID: 44269ad1867408f801137c7278d00dfa50946c5e7da43327463f9cb6df3bbd53
Instruction ID: a8be22e9d49e8ad306ea3aee515a4114d76492362b4325fbec6ab9ff518d57b1
Opcode Fuzzy Hash: 44269ad1867408f801137c7278d00dfa50946c5e7da43327463f9cb6df3bbd53
Instruction Fuzzy Hash: 64418C71900109ABDB15EBA5CC45AEFB7B8EF48304F10452FF511F22D2DB389A45CB69

Function 0040C1DF Relevance: 10.6, APIs: 7, Instructions: 115windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 0040C20D
PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 0040C234
UpdateWindow.USER32(?), ref: 0040C24E
SendMessageW.USER32(?,00000121,00000000,?), ref: 0040C272
SendMessageW.USER32(?,0000036A,00000000,00000004), ref: 0040C28C
UpdateWindow.USER32(?), ref: 0040C2D2
PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 0040C306

Part of subcall function 0040F274: GetWindowLongW.USER32(?,000000F0), ref: 0040F27F

Memory Dump Source

Source File: 00000005.00000002.1722456807.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1722022141.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723561398.0000000000436000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000444000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000448000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1724304481.000000000044B000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_LetsPRO.jbxd

Similarity

API ID: Message$Window$PeekSendUpdate$LongParent
String ID:
API String ID: 2853195852-0
Opcode ID: 5ef2329cbea99ed92240cd9cf57b20163d3a09105f28c55645ad71531414eb3b
Instruction ID: d31045f22a52feffe7162542cb47672af8f2ea6b6714e8d5e6abf099df3919a7
Opcode Fuzzy Hash: 5ef2329cbea99ed92240cd9cf57b20163d3a09105f28c55645ad71531414eb3b
Instruction Fuzzy Hash: 1941C330A04741EBDB219F65CD84A1BBAE4FFD1754F004B7EF881A15E1D77AC8049A5A

Function 004061A1 Relevance: 10.6, APIs: 7, Instructions: 111windowCOMMON

Download Yara Rule

APIs

GetCapture.USER32 ref: 00412D0E
SendMessageW.USER32(00000000,00000365,00000000,00000000), ref: 00412D27
GetFocus.USER32 ref: 00412D39
SendMessageW.USER32(00000000,00000365,00000000,00000000), ref: 00412D45
GetLastActivePopup.USER32(?), ref: 00412D6C
SendMessageW.USER32(00000000,00000365,00000000,00000000), ref: 00412D77
SendMessageW.USER32(?,00000111,0000E147,00000000), ref: 00412D9B

Memory Dump Source

Source File: 00000005.00000002.1722456807.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1722022141.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723561398.0000000000436000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000444000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000448000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1724304481.000000000044B000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_LetsPRO.jbxd

Similarity

API ID: MessageSend$ActiveCaptureFocusLastPopup
String ID:
API String ID: 3219385341-0
Opcode ID: 585af65767599c69d45c79a587cc6a308bd4a75c8166f8bc1dbdc99b4f9e6b97
Instruction ID: 680dec983692b743a58ece503f63dfa9b1a3e441afb0ae6377531f5756dd2028
Opcode Fuzzy Hash: 585af65767599c69d45c79a587cc6a308bd4a75c8166f8bc1dbdc99b4f9e6b97
Instruction Fuzzy Hash: 38312671700215ABDA117B24ED84EBF36ACEF85784B16007BF401E7390CBBDCC9296A9

Function 004066C9 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 92windowCOMMON

Download Yara Rule

APIs

GetMenuCheckMarkDimensions.USER32 ref: 004066E1
_memset.LIBCMT ref: 00406743
CreateBitmap.GDI32(?,?,00000001,00000001,?), ref: 00406795
LoadBitmapW.USER32(00000000,00007FE3), ref: 004067AD

Strings

oC, xrefs: 0040675D
, xrefs: 00406702

Memory Dump Source

Source File: 00000005.00000002.1722456807.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1722022141.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723561398.0000000000436000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000444000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000448000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1724304481.000000000044B000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_LetsPRO.jbxd

Similarity

API ID: Bitmap$CheckCreateDimensionsLoadMarkMenu_memset
String ID: $ oC
API String ID: 4271682439-491700690
Opcode ID: 53cb38be90b0da2f264c4621533b54d4ea6d9ba512bba62df28d2b011a59c214
Instruction ID: d64d20f76f18704212dd7e7b96af50dfc47f11d3b508a0b9d3dd95b4e7b79329
Opcode Fuzzy Hash: 53cb38be90b0da2f264c4621533b54d4ea6d9ba512bba62df28d2b011a59c214
Instruction Fuzzy Hash: C7310676A002159FEF20DF78DCC6ABE7BB9EB44708F16053BE502EB2D2D63499048B54

Function 00419D57 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 91COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00419D5E

Part of subcall function 004047D4: __CxxThrowException@8.LIBCMT ref: 004047E8
Part of subcall function 004047D4: __EH_prolog3.LIBCMT ref: 004047F5

GetDC.USER32(?), ref: 00419DDC
IntersectRect.USER32(?,?,?), ref: 00419E16
CreateRectRgnIndirect.GDI32(?), ref: 00419E20

Strings

\tC, xrefs: 00419D83, 00419E01
\tC, xrefs: 00419DB7

Memory Dump Source

Source File: 00000005.00000002.1722456807.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1722022141.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723561398.0000000000436000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000444000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000448000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1724304481.000000000044B000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_LetsPRO.jbxd

Similarity

API ID: H_prolog3Rect$CreateException@8IndirectIntersectThrow
String ID: \tC$\tC
API String ID: 2872313494-411660950
Opcode ID: 6266ce099981ab3fc1da5aecf8a9b089e2a3bce859c59b6e97a1a84198f42bbc
Instruction ID: ba4ea9b9528902d1c78e49f260f44041bdd8400842486086e24808afdda945b6
Opcode Fuzzy Hash: 6266ce099981ab3fc1da5aecf8a9b089e2a3bce859c59b6e97a1a84198f42bbc
Instruction Fuzzy Hash: 8E318E71D0021ADBCF11DFA4C585ADEBBB4AF18304F10806AE541BB295C7785E85CFA9

Function 0041AD7B Relevance: 10.6, APIs: 7, Instructions: 86windowCOMMON

Download Yara Rule

APIs

GetWindow.USER32(?,00000002), ref: 0041AD96
GetParent.USER32(?), ref: 0041ADA7
GetWindow.USER32(?,00000002), ref: 0041ADCA
GetWindow.USER32(?,00000002), ref: 0041ADDC
GetWindowLongW.USER32(?,000000EC), ref: 0041ADEB
IsWindowVisible.USER32(?), ref: 0041AE05
GetTopWindow.USER32(?), ref: 0041AE2B

Memory Dump Source

Source File: 00000005.00000002.1722456807.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1722022141.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723561398.0000000000436000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000444000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000448000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1724304481.000000000044B000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_LetsPRO.jbxd

Similarity

API ID: Window$LongParentVisible
String ID:
API String ID: 506644340-0
Opcode ID: e417cc422434b890637ed474b91c5a7feb20e2d574c99d7b6227ed527305c4b1
Instruction ID: ede95467abab4a469cb73df1122a69acd9ba3decd1374b3227c3b83166b186ca
Opcode Fuzzy Hash: e417cc422434b890637ed474b91c5a7feb20e2d574c99d7b6227ed527305c4b1
Instruction Fuzzy Hash: 7B212532641710ABCA316B71DC09FAB729CAF84744F09492AFD41E7691E72DDC60C76A

Function 0040A2A3 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 83COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00000028,000000FF,00000028,00000020), ref: 0040A2E1
SystemParametersInfoA.USER32(00000030,00000000,00000000,00000000), ref: 0040A30B
GetSystemMetrics.USER32(00000000), ref: 0040A322
GetSystemMetrics.USER32(00000001), ref: 0040A329
MultiByteToWideChar.KERNEL32(00000000,00000000,DISPLAY,000000FF,-00000028,00000020), ref: 0040A354

Strings

DISPLAY, xrefs: 0040A34B

Memory Dump Source

Source File: 00000005.00000002.1722456807.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1722022141.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723561398.0000000000436000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000444000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000448000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1724304481.000000000044B000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_LetsPRO.jbxd

Similarity

API ID: System$ByteCharMetricsMultiWide$InfoParameters
String ID: DISPLAY
API String ID: 381819527-865373369
Opcode ID: 0acf7b25444fc12225ae1c7bebccfd927a5b3ffe46abfd1f9888736ea2938cbc
Instruction ID: 3faf45386223d8f9befc810e6994d2ee03b35c7a318f12a10b862d2210c02060
Opcode Fuzzy Hash: 0acf7b25444fc12225ae1c7bebccfd927a5b3ffe46abfd1f9888736ea2938cbc
Instruction Fuzzy Hash: 08210372500325ABDF209F24CC84A6B7BA8EF06720F15817BFC04BA2C1C675D850CBAA

Function 00407C30 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 65registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(80000001,software,00000000,0002001F,?), ref: 00407C5E
RegCreateKeyExW.ADVAPI32(?,?,00000000,00000000,00000000,0002001F,00000000,?,?), ref: 00407C81
RegCreateKeyExW.ADVAPI32(?,?,00000000,00000000,00000000,0002001F,00000000,?,?), ref: 00407C9D
RegCloseKey.ADVAPI32(?), ref: 00407CAD
RegCloseKey.ADVAPI32(?), ref: 00407CB7

Strings

software, xrefs: 00407C46

Memory Dump Source

Source File: 00000005.00000002.1722456807.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1722022141.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723561398.0000000000436000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000444000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000448000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1724304481.000000000044B000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_LetsPRO.jbxd

Similarity

API ID: CloseCreate$Open
String ID: software
API String ID: 1740278721-2010147023
Opcode ID: 645897005454721eedff282ef63391f219f8ea54baeecc9100917e38134091b2
Instruction ID: 2deeef6699cb28ba533ba9a0caa1c83f1cddf3442a444e5576604b3d9670b227
Opcode Fuzzy Hash: 645897005454721eedff282ef63391f219f8ea54baeecc9100917e38134091b2
Instruction Fuzzy Hash: D311F876D00119FBDB21DF9ACD89CDFBFBCEF89740F1140AAB500A2121D275AA50DBA4

Function 00410F70 Relevance: 10.6, APIs: 7, Instructions: 51memoryCOMMON

Download Yara Rule

APIs

LeaveCriticalSection.KERNEL32(?), ref: 00410F77
__CxxThrowException@8.LIBCMT ref: 00410F81

Part of subcall function 00421117: RaiseException.KERNEL32(?,?,00000008,?), ref: 00421157

LocalReAlloc.KERNEL32(?,00000000,00000002,00000000,00000010,?,?,00000000,?,00000004,004104C7,004047EE,00405A03,?,?,00401564), ref: 00410F98
LeaveCriticalSection.KERNEL32(?,?,?,00000000,?,00000004,004104C7,004047EE,00405A03,?,?,00401564), ref: 00410FA5

Part of subcall function 004047A0: __CxxThrowException@8.LIBCMT ref: 004047B4

_memset.LIBCMT ref: 00410FC4
TlsSetValue.KERNEL32(?,00000000,?,1A1A596F), ref: 00410FD5
LeaveCriticalSection.KERNEL32(?,?,00000000,?,00000004,004104C7,004047EE,00405A03,?,?,00401564), ref: 00410FF6

Memory Dump Source

Source File: 00000005.00000002.1722456807.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1722022141.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723561398.0000000000436000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000444000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000448000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1724304481.000000000044B000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_LetsPRO.jbxd

Similarity

API ID: CriticalLeaveSection$Exception@8Throw$AllocExceptionLocalRaiseValue_memset
String ID:
API String ID: 356813703-0
Opcode ID: f120e72514cbc6bb79e40d833ba6928a1ed90d3e601d679ad022578ca1de4325
Instruction ID: b40d56f7868951589c682ec62da2b827d3d53878d8b68479c7b9f4ac02ba6882
Opcode Fuzzy Hash: f120e72514cbc6bb79e40d833ba6928a1ed90d3e601d679ad022578ca1de4325
Instruction Fuzzy Hash: 8211CE74100206AFDB20AF64DC86C6BBBB9EF40314B11C52EF50592266CB74ACA0CB58

Function 00424A29 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00426847,004268C7,00426847,00000014,004251F2,00000000,00000FA0,00441178,0000000C,00425251,004053D2,-0000000F,?,0041FC1F,00000004,00441010), ref: 00424A36
TlsGetValue.KERNEL32(00000005,?,0041FC1F,00000004,00441010,0000000C,0042635F,00000004,00000004,00000000,00000000,00000000,00424C6E,00000001,00000214), ref: 00424A4D
GetModuleHandleA.KERNEL32(KERNEL32.DLL,?,0041FC1F,00000004,00441010,0000000C,0042635F,00000004,00000004,00000000,00000000,00000000,00424C6E,00000001,00000214), ref: 00424A62
GetProcAddress.KERNEL32(00000000,EncodePointer), ref: 00424A7D

Strings

KERNEL32.DLL, xrefs: 00424A5D
EncodePointer, xrefs: 00424A77

Memory Dump Source

Source File: 00000005.00000002.1722456807.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1722022141.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723561398.0000000000436000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000444000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000448000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1724304481.000000000044B000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_LetsPRO.jbxd

Similarity

API ID: Value$AddressHandleModuleProc
String ID: EncodePointer$KERNEL32.DLL
API String ID: 1929421221-3682587211
Opcode ID: a38179c592d202d615c620be9411c8ff69f59b8789d4490dfa0cad31cf59ae2e
Instruction ID: a5f4b44f2debae20424e01b4d7fbae965d65e2b7db882ffcff45c87cd44f4608
Opcode Fuzzy Hash: a38179c592d202d615c620be9411c8ff69f59b8789d4490dfa0cad31cf59ae2e
Instruction Fuzzy Hash: 33F0F634781633EBDB11A774FC0491B3A94DF823A07458132F824D23B1CB39CC018A5D

Function 00424AA0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,0042527E,00420190,004053D2,?,004044B2,00000000,?,00000000,00404563,0000000C,00000004,004010F6,00000000,004053D2,00000000), ref: 00424AAD
TlsGetValue.KERNEL32(00000005,?,004044B2,00000000,?,00000000,00404563,0000000C,00000004,004010F6,00000000,004053D2,00000000,?,1A1A596F), ref: 00424AC4
GetModuleHandleA.KERNEL32(KERNEL32.DLL,?,004044B2,00000000,?,00000000,00404563,0000000C,00000004,004010F6,00000000,004053D2,00000000,?,1A1A596F), ref: 00424AD9
GetProcAddress.KERNEL32(00000000,DecodePointer), ref: 00424AF4

Strings

DecodePointer, xrefs: 00424AEE
KERNEL32.DLL, xrefs: 00424AD4

Memory Dump Source

Source File: 00000005.00000002.1722456807.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1722022141.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723561398.0000000000436000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000444000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000448000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1724304481.000000000044B000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_LetsPRO.jbxd

Similarity

API ID: Value$AddressHandleModuleProc
String ID: DecodePointer$KERNEL32.DLL
API String ID: 1929421221-629428536
Opcode ID: c97b8679716475ddb5f6ab4a27228259d782978a9ec7f157efcde8f8c2eec6c8
Instruction ID: e23b5751e85efee7d8fe45ab4ded4dcb26f0a3c36f4ac3796df6b1606e0a0fd3
Opcode Fuzzy Hash: c97b8679716475ddb5f6ab4a27228259d782978a9ec7f157efcde8f8c2eec6c8
Instruction Fuzzy Hash: B1F06234385532EB9E11EB34FC04A5B3A94DF863517569172E814D22B1CB29DD11CA5D

Function 004109A7 Relevance: 10.5, APIs: 7, Instructions: 29COMMON

Download Yara Rule

APIs

GetSysColor.USER32(0000000F), ref: 004109B3
GetSysColor.USER32(00000010), ref: 004109BA
GetSysColor.USER32(00000014), ref: 004109C1
GetSysColor.USER32(00000012), ref: 004109C8
GetSysColor.USER32(00000006), ref: 004109CF
GetSysColorBrush.USER32(0000000F), ref: 004109DC
GetSysColorBrush.USER32(00000006), ref: 004109E3

Memory Dump Source

Source File: 00000005.00000002.1722456807.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1722022141.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723561398.0000000000436000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000444000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000448000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1724304481.000000000044B000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_LetsPRO.jbxd

Similarity

API ID: Color$Brush
String ID:
API String ID: 2798902688-0
Opcode ID: abb5041fba15b4109dc25deb98222754520511b48511f324ba86ab2981ab33ae
Instruction ID: 0b1aa65802c534105ffacf7c053cdbcc100f8cf1ed311821b2d0b23212901df7
Opcode Fuzzy Hash: abb5041fba15b4109dc25deb98222754520511b48511f324ba86ab2981ab33ae
Instruction Fuzzy Hash: B3F012719407445BD730BF725D49B47BAD5FFC4710F02192ED2418B990D6B6E040DF44

Function 00435B14 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 24registryclipboardCOMMON

Download Yara Rule

APIs

GetVersion.KERNEL32 ref: 00435B1C
GetVersion.KERNEL32 ref: 00435B27
GetVersion.KERNEL32 ref: 00435B2F
GetVersion.KERNEL32 ref: 00435B35
RegisterClipboardFormatW.USER32(MSWHEEL_ROLLMSG), ref: 00435B42

Strings

MSWHEEL_ROLLMSG, xrefs: 00435B3D

Memory Dump Source

Source File: 00000005.00000002.1722456807.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1722022141.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723561398.0000000000436000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000444000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000448000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1724304481.000000000044B000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_LetsPRO.jbxd

Similarity

API ID: Version$ClipboardFormatRegister
String ID: MSWHEEL_ROLLMSG
API String ID: 2888461884-2485103130
Opcode ID: b61c5f877e7cc2fe19be049a3a633eda145f5d6ca1208ce7b51ad084e2ec726e
Instruction ID: 4434e3ad18ff8c6803f885bc1781f72a16721d82a57b72b72385bff11eaaff04
Opcode Fuzzy Hash: b61c5f877e7cc2fe19be049a3a633eda145f5d6ca1208ce7b51ad084e2ec726e
Instruction Fuzzy Hash: D1E0867E80091A56D7113768BC0077AE6955B8C391F1A603FDA0253354DF7C28439EBE

Function 0041A329 Relevance: 9.4, APIs: 6, Instructions: 404COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0041A345
VariantClear.OLEAUT32(?), ref: 0041A3AA

Part of subcall function 004047D4: __CxxThrowException@8.LIBCMT ref: 004047E8
Part of subcall function 004047D4: __EH_prolog3.LIBCMT ref: 004047F5

VariantClear.OLEAUT32(?), ref: 0041A5B9
VariantClear.OLEAUT32(?), ref: 0041A62B
VariantClear.OLEAUT32(?), ref: 0041A81C

Part of subcall function 00412513: VariantCopy.OLEAUT32(?,?), ref: 00412521

Part of subcall function 00419BB7: __EH_prolog3.LIBCMT ref: 00419BBE

Part of subcall function 004128BB: __EH_prolog3.LIBCMT ref: 004128C5

Memory Dump Source

Source File: 00000005.00000002.1722456807.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1722022141.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723561398.0000000000436000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000444000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000448000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1724304481.000000000044B000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_LetsPRO.jbxd

Similarity

API ID: Variant$ClearH_prolog3$CopyException@8Throw
String ID:
API String ID: 243482497-0
Opcode ID: d2eba55ac3a0b79bab3d68795f0a93ad7a81a6fd9eff23634cac8475c1ec41e9
Instruction ID: 1b54e45b7b57396d2ece5143104f11f165e9d879096335b3c55456d5225beae9
Opcode Fuzzy Hash: d2eba55ac3a0b79bab3d68795f0a93ad7a81a6fd9eff23634cac8475c1ec41e9
Instruction Fuzzy Hash: 42F18E7040114CEADF15EFA0C990AFE7BB9AF04308F54405BFC5193292DB789A99DB6A

Function 0041D88B Relevance: 9.1, APIs: 6, Instructions: 120memoryCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0041D8BA
SysAllocString.OLEAUT32(?), ref: 0041D90E
SysAllocString.OLEAUT32(?), ref: 0041D936
SysAllocString.OLEAUT32(00000000), ref: 0041D98B
SysAllocString.OLEAUT32(00000000), ref: 0041D9B4
SysAllocString.OLEAUT32(00000000), ref: 0041D9E3

Memory Dump Source

Source File: 00000005.00000002.1722456807.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1722022141.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723561398.0000000000436000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000444000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000448000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1724304481.000000000044B000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_LetsPRO.jbxd

Similarity

API ID: AllocString$_memset
String ID:
API String ID: 287750986-0
Opcode ID: 8a686bd9c69b90a85bdeffdd8789eb5a4d7bada0b0eb2c5a9bb1b5cf060b3a4e
Instruction ID: 19da23529e382080cfadccb8a7bf69935c3b4974c2b602bed654a2ceae79891a
Opcode Fuzzy Hash: 8a686bd9c69b90a85bdeffdd8789eb5a4d7bada0b0eb2c5a9bb1b5cf060b3a4e
Instruction Fuzzy Hash: 7F4153B19006059FCB24EF79CC41ADEB7B1BF48314F10452FE565A72A2DB78A884CF58

Function 00406B48 Relevance: 9.1, APIs: 6, Instructions: 115threadwindowCOMMON

Download Yara Rule

APIs

Part of subcall function 00406A9D: GetParent.USER32(?), ref: 00406AF0
Part of subcall function 00406A9D: GetLastActivePopup.USER32(?), ref: 00406AFF
Part of subcall function 00406A9D: IsWindowEnabled.USER32(?), ref: 00406B14
Part of subcall function 00406A9D: EnableWindow.USER32(?,00000000), ref: 00406B27

EnableWindow.USER32(?,00000001), ref: 00406B95
GetWindowThreadProcessId.USER32(?,?), ref: 00406BA3
GetCurrentProcessId.KERNEL32(?,?), ref: 00406BAD
SendMessageW.USER32(?,00000376,00000000,00000000), ref: 00406BC2
GetModuleFileNameW.KERNEL32(00000000,?,00000104,?,?), ref: 00406C40
EnableWindow.USER32(?,00000001), ref: 00406C7D

Memory Dump Source

Source File: 00000005.00000002.1722456807.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1722022141.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723561398.0000000000436000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000444000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000448000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1724304481.000000000044B000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_LetsPRO.jbxd

Similarity

API ID: Window$Enable$Process$ActiveCurrentEnabledFileLastMessageModuleNameParentPopupSendThread
String ID:
API String ID: 1877664794-0
Opcode ID: a2feb9747a77accd7b5d31d1d3efa1eb3bf8559e16afbb7db6dfa6caad9cf869
Instruction ID: b8540eb5b98f888d24379612b03e7353567efa45137c105c27a9c2beb3ad7245
Opcode Fuzzy Hash: a2feb9747a77accd7b5d31d1d3efa1eb3bf8559e16afbb7db6dfa6caad9cf869
Instruction Fuzzy Hash: 2141A172A002199BEB309F64DC847DEB7B4FB05700F22053EE946EB2C1D73899108B58

Function 00406A9D Relevance: 9.1, APIs: 6, Instructions: 68COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000F0), ref: 00406ACF
GetParent.USER32(?), ref: 00406ADD
GetParent.USER32(?), ref: 00406AF0
GetLastActivePopup.USER32(?), ref: 00406AFF
IsWindowEnabled.USER32(?), ref: 00406B14
EnableWindow.USER32(?,00000000), ref: 00406B27

Memory Dump Source

Source File: 00000005.00000002.1722456807.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1722022141.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723561398.0000000000436000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000444000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000448000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1724304481.000000000044B000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_LetsPRO.jbxd

Similarity

API ID: Window$Parent$ActiveEnableEnabledLastLongPopup
String ID:
API String ID: 670545878-0
Opcode ID: e8c3a55ab576bf2e2535636b4c9f1ff76900f191daf80ded5fa2f5ce81fe5b9e
Instruction ID: 0fb3ec5c2b7467ceeb950f9fa6decbe5ae173939f1cdcec82498a730b73f98dc
Opcode Fuzzy Hash: e8c3a55ab576bf2e2535636b4c9f1ff76900f191daf80ded5fa2f5ce81fe5b9e
Instruction Fuzzy Hash: C11198B1B4023257C6317A694C4472BB6EC5F66B64F178136E807F3394DB79EC208A9D

Function 00412BF6 Relevance: 9.0, APIs: 6, Instructions: 45COMMON

Download Yara Rule

APIs

ClientToScreen.USER32(?,?), ref: 00412C05
GetDlgCtrlID.USER32(00000000), ref: 00412C19
GetWindowLongW.USER32(00000000,000000F0), ref: 00412C27
GetWindowRect.USER32(00000000,?), ref: 00412C39
PtInRect.USER32(?,?,?), ref: 00412C49
GetWindow.USER32(?,00000005), ref: 00412C56

Memory Dump Source

Source File: 00000005.00000002.1722456807.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1722022141.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723561398.0000000000436000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000444000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000448000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1724304481.000000000044B000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_LetsPRO.jbxd

Similarity

API ID: Window$Rect$ClientCtrlLongScreen
String ID:
API String ID: 1315500227-0
Opcode ID: ac51c64727053b849b56758aa3bfb7bae30d9dfffef820e7f40c43dedfc9fe87
Instruction ID: f79b7111529225612cf2298c0965d814fb565c960213846f44f2643f38286b68
Opcode Fuzzy Hash: ac51c64727053b849b56758aa3bfb7bae30d9dfffef820e7f40c43dedfc9fe87
Instruction Fuzzy Hash: 7601A23260021ABBDB215F549D08EEF3B6CEF00750F018022FE01E6150E774DA628BEC

Function 00410D8A Relevance: 9.0, APIs: 6, Instructions: 26memoryCOMMON

Download Yara Rule

APIs

GlobalHandle.KERNEL32 ref: 00410D8B
GlobalUnlock.KERNEL32(00000000), ref: 00410D94
GlobalReAlloc.KERNEL32(00000000,00000000,00002002), ref: 00410DAB
GlobalHandle.KERNEL32(?), ref: 00410DBD
GlobalLock.KERNEL32(00000000), ref: 00410DC4
LeaveCriticalSection.KERNEL32(?), ref: 00410DCE
GlobalLock.KERNEL32(00000000), ref: 00410DDA
_memset.LIBCMT ref: 00410DF3
LeaveCriticalSection.KERNEL32(?), ref: 00410E1F

Memory Dump Source

Source File: 00000005.00000002.1722456807.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1722022141.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723561398.0000000000436000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000444000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000448000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1724304481.000000000044B000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_LetsPRO.jbxd

Similarity

API ID: Global$CriticalHandleLeaveLockSection$AllocUnlock_memset
String ID:
API String ID: 3803186603-0
Opcode ID: 54a7072b20afe1e5706ae40e5face34904e7989312569ffcd1934f837df2d8ad
Instruction ID: 5fe6879b4fc1fb8311075263d750ce0850b964cedd63e7ce93d429ea2b59f952
Opcode Fuzzy Hash: 54a7072b20afe1e5706ae40e5face34904e7989312569ffcd1934f837df2d8ad
Instruction Fuzzy Hash: 9AE01271505702BFE6502FB0AC4DA2B366CFB047017079829F903A71A2DB78A8409B28

Function 004183DF Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 70COMMONLIBRARYCODE

Download Yara Rule

APIs

SafeArrayDestroy.OLEAUT32 ref: 00418400
CoTaskMemFree.OLE32(?), ref: 00418483

Strings

`<uP?<u, xrefs: 00418464

Memory Dump Source

Source File: 00000005.00000002.1722456807.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1722022141.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723561398.0000000000436000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000444000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000448000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1724304481.000000000044B000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_LetsPRO.jbxd

Similarity

API ID: ArrayDestroyFreeSafeTask
String ID: `<uP?<u
API String ID: 3253174383-1824141693
Opcode ID: b7db36039837c95fed06159c73f860e21cd283643b17ee612da319be55a74c6f
Instruction ID: fb0e688511880ef16883d691e6aa758461728539e5637be73218af831dd36008
Opcode Fuzzy Hash: b7db36039837c95fed06159c73f860e21cd283643b17ee612da319be55a74c6f
Instruction Fuzzy Hash: AA110030200207AFDB259F65D848BE67764EF01751B28842EF855DA251EF3DDCC1CA58

Function 00419E7C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00419E83
GetRgnBox.GDI32(?,?), ref: 00419EFE
IntersectRect.USER32(?,?,?), ref: 00419F13
EqualRect.USER32(?,?), ref: 00419F21

Strings

\tC, xrefs: 00419ED4

Memory Dump Source

Source File: 00000005.00000002.1722456807.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1722022141.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723561398.0000000000436000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000444000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000448000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1724304481.000000000044B000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_LetsPRO.jbxd

Similarity

API ID: Rect$EqualH_prolog3Intersect
String ID: \tC
API String ID: 2161412305-1046585886
Opcode ID: 2f304e1a592a1fb7876c2bf03e19644e920fce016a94d81cdba0ec3d1aee9119
Instruction ID: 14969293292fa8888d1e39c9557eda0df8a4be6e0d65f5e00231d85e00c5be1c
Opcode Fuzzy Hash: 2f304e1a592a1fb7876c2bf03e19644e920fce016a94d81cdba0ec3d1aee9119
Instruction Fuzzy Hash: AC21667190020AEBCF11EFA5C8859EEBBB9BF08300F00C46AF411A3251CB789A45DF68

Function 00407F1E Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 57COMMON

Download Yara Rule

Strings

Edit, xrefs: 00407F6E

Memory Dump Source

Source File: 00000005.00000002.1722456807.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1722022141.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723561398.0000000000436000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000444000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000448000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1724304481.000000000044B000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_LetsPRO.jbxd

Similarity

API ID:
String ID: Edit
API String ID: 0-554135844
Opcode ID: bb86d6f691182863da96636ef1a435be8b096dc3c90520e444be487f9377fc33
Instruction ID: 7cc65a0c25cb72cf2f45f51d1126d3fa655fac6390edec6aacb2ab78c870a169
Opcode Fuzzy Hash: bb86d6f691182863da96636ef1a435be8b096dc3c90520e444be487f9377fc33
Instruction Fuzzy Hash: 1401C471A5C203BAEA202B358C05B67B6656F55700F20843BF141F22E2DB7CFC60C56E

Function 0042B9B3 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00424CBC: __amsg_exit.LIBCMT ref: 00424CCA

__amsg_exit.LIBCMT ref: 0042B9DF
__lock.LIBCMT ref: 0042B9EF
InterlockedDecrement.KERNEL32(?), ref: 0042BA0C
InterlockedIncrement.KERNEL32(00F528F8), ref: 0042BA37

Strings

[D, xrefs: 0042BA16

Memory Dump Source

Source File: 00000005.00000002.1722456807.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1722022141.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723561398.0000000000436000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000444000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000448000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1724304481.000000000044B000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_LetsPRO.jbxd

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__lock
String ID: [D
API String ID: 4129207761-3436156298
Opcode ID: dc7f9dfaf5a3e14f769dfcd189f287d4fb17365e02ea5eea400680f27d93bdb9
Instruction ID: 7b9b39af88f92016941318049326f61d16d2e5241b25eb83a92f05acab4e16ab
Opcode Fuzzy Hash: dc7f9dfaf5a3e14f769dfcd189f287d4fb17365e02ea5eea400680f27d93bdb9
Instruction Fuzzy Hash: 46018431B01731ABDB20EB5AB80675E77A0FF05728F95405BE41467692CB3C6981CBDE

Function 004147BC Relevance: 7.6, APIs: 5, Instructions: 108windowthreadCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 004147C3
SendMessageW.USER32(?,00000138,?,?), ref: 0041483B
GetBkColor.GDI32(?), ref: 00414844
GetTextColor.GDI32(?), ref: 00414850
GetThreadLocale.KERNEL32(0000F1C0,00000000,?,?,00000014), ref: 004148E2

Memory Dump Source

Source File: 00000005.00000002.1722456807.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1722022141.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723561398.0000000000436000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000444000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000448000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1724304481.000000000044B000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_LetsPRO.jbxd

Similarity

API ID: Color$H_prolog3LocaleMessageSendTextThread
String ID:
API String ID: 187318432-0
Opcode ID: db315c7ed58b82d42b85c3004ea8fed1200383aa74af5b9776cc54ec0859b4ee
Instruction ID: 69cd0a2bb710276349843e00a71a4dbc379fc72fb7d011f5d6fa6c530a077a36
Opcode Fuzzy Hash: db315c7ed58b82d42b85c3004ea8fed1200383aa74af5b9776cc54ec0859b4ee
Instruction Fuzzy Hash: 95418D75410346DFCB10EF65C8459EAB7B0FF48314F10896EE8A69B3A1D778E881CB69

Function 00401F20 Relevance: 7.6, APIs: 5, Instructions: 103COMMON

Download Yara Rule

APIs

_memcpy_s.LIBCMT ref: 00401F5F
_memcpy_s.LIBCMT ref: 00401F74

Part of subcall function 00402040: _memcpy_s.LIBCMT ref: 004020D8

FindResourceW.KERNEL32(?,?,00000005,?,000000FF,?,80070057), ref: 00408785
LoadResource.KERNEL32(?,00000000), ref: 0040878D
FreeResource.KERNEL32(00000000,00000000,?,?), ref: 004087A5

Memory Dump Source

Source File: 00000005.00000002.1722456807.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1722022141.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723561398.0000000000436000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000444000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000448000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1724304481.000000000044B000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_LetsPRO.jbxd

Similarity

API ID: Resource_memcpy_s$FindFreeLoad
String ID:
API String ID: 1074299570-0
Opcode ID: b791ce1855917d58b949b0af6a15d2f0f6f0680457a6dbf20c07c71199e404da
Instruction ID: 14bdff6c92ac4730630b5eee593737351e9842c129ef966e3131e81007bf6a6b
Opcode Fuzzy Hash: b791ce1855917d58b949b0af6a15d2f0f6f0680457a6dbf20c07c71199e404da
Instruction Fuzzy Hash: 8B21B472201211AFC7109F5ADD88E6BB7EDFF84315F01842EF648A7255C778AC40C7A9

Function 004091A7 Relevance: 7.6, APIs: 5, Instructions: 75registryCOMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 004091C6
RegOpenKeyW.ADVAPI32(?,00000000,?), ref: 004091E5
RegEnumKeyW.ADVAPI32(?,00000000,00000000,00000104), ref: 00409203
RegDeleteKeyW.ADVAPI32(?,?), ref: 0040927E
RegCloseKey.ADVAPI32(?), ref: 00409289

Memory Dump Source

Source File: 00000005.00000002.1722456807.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1722022141.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723561398.0000000000436000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000444000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000448000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1724304481.000000000044B000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_LetsPRO.jbxd

Similarity

API ID: CloseDeleteEnumH_prolog3_catchOpen
String ID:
API String ID: 3522057324-0
Opcode ID: 27858f26125fddd8b1314a2ab04868adcdeae4ab4f032ce248b73a6512b7b45f
Instruction ID: 4a026120e8ebbdb4435aa69819b7052e216f5652db37abfb8c9e7d40694c2b64
Opcode Fuzzy Hash: 27858f26125fddd8b1314a2ab04868adcdeae4ab4f032ce248b73a6512b7b45f
Instruction Fuzzy Hash: BF21CA76D0021AABDB25DF64D845AEEB7B4EB08310F11423AED11B72D1DB385E049BA8

Function 0041C491 Relevance: 7.6, APIs: 5, Instructions: 58COMMON

Download Yara Rule

APIs

GetMapMode.GDI32(?,?,?,?,?,?,00416050,?,00000000,0000001C,004169BE,?,?,?,?,?), ref: 0041C4A1
GetDeviceCaps.GDI32(?,00000058), ref: 0041C4DB
GetDeviceCaps.GDI32(?,0000005A), ref: 0041C4E4

Part of subcall function 00409AEF: MulDiv.KERNEL32(?,00000000,00000000), ref: 00409B2F
Part of subcall function 00409AEF: MulDiv.KERNEL32(?,00000000,00000000), ref: 00409B4C

MulDiv.KERNEL32(?,000009EC,00000060), ref: 0041C508
MulDiv.KERNEL32(00000000,000009EC,?), ref: 0041C513

Memory Dump Source

Source File: 00000005.00000002.1722456807.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1722022141.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723561398.0000000000436000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000444000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000448000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1724304481.000000000044B000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_LetsPRO.jbxd

Similarity

API ID: CapsDevice$Mode
String ID:
API String ID: 696222070-0
Opcode ID: 41d49b5f8e1722712a4a6fc4fa8517ecb4d383a78426cf8622abfa7ec949b047
Instruction ID: 0de93767dac5a1f30f45dc3265eab0b270b620dfa0ce97d0934d32c8c6a30fac
Opcode Fuzzy Hash: 41d49b5f8e1722712a4a6fc4fa8517ecb4d383a78426cf8622abfa7ec949b047
Instruction Fuzzy Hash: B711C235640604BFCB21AF69CC84C2EBBFAEF99750B12442AE98197360C775AC418F94

Function 0041C51F Relevance: 7.6, APIs: 5, Instructions: 58COMMON

Download Yara Rule

APIs

GetMapMode.GDI32(?,00000000,?,?,?,?,00416094,?,?,?,?,?,?), ref: 0041C52F
GetDeviceCaps.GDI32(?,00000058), ref: 0041C569
GetDeviceCaps.GDI32(?,0000005A), ref: 0041C572

Part of subcall function 00409A86: MulDiv.KERNEL32(?,00000000,00000000), ref: 00409AC6
Part of subcall function 00409A86: MulDiv.KERNEL32(?,00000000,00000000), ref: 00409AE3

MulDiv.KERNEL32(?,00000060,000009EC), ref: 0041C596
MulDiv.KERNEL32(00000000,?,000009EC), ref: 0041C5A1

Memory Dump Source

Source File: 00000005.00000002.1722456807.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1722022141.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723561398.0000000000436000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000444000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000448000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1724304481.000000000044B000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_LetsPRO.jbxd

Similarity

API ID: CapsDevice$Mode
String ID:
API String ID: 696222070-0
Opcode ID: 82b30b659c9baf86aca53e4e31df19fca71a57232901bb8f260463c9dd08f265
Instruction ID: 7822b7f1f664c7a983d35e23143af023a6b733a5fa967a1b4a90d979f702dbeb
Opcode Fuzzy Hash: 82b30b659c9baf86aca53e4e31df19fca71a57232901bb8f260463c9dd08f265
Instruction Fuzzy Hash: F611A035600614BFDB21AF65CC84C1EBBFAEF85750712842AE98657360CB75EC41DF98

Function 00412A79 Relevance: 7.6, APIs: 5, Instructions: 53stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,1FFFFFFF,?,?), ref: 00412AA3
_memset.LIBCMT ref: 00412AC1
GetWindowTextW.USER32(?,00000000,00000100), ref: 00412ADB
lstrcmpW.KERNEL32(00000000,?), ref: 00412AED
SetWindowTextW.USER32(?,?), ref: 00412AF9

Part of subcall function 004047D4: __CxxThrowException@8.LIBCMT ref: 004047E8
Part of subcall function 004047D4: __EH_prolog3.LIBCMT ref: 004047F5

Memory Dump Source

Source File: 00000005.00000002.1722456807.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1722022141.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723561398.0000000000436000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000444000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000448000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1724304481.000000000044B000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_LetsPRO.jbxd

Similarity

API ID: TextWindow$Exception@8H_prolog3Throw_memsetlstrcmplstrlen
String ID:
API String ID: 4273134663-0
Opcode ID: d9018af1212e69d34d4fa1256f11c09f5f9cebc11e26f1e67d2ab3ac6df5d96c
Instruction ID: 7b9b7475ceceae39792133326987c0c06dad4e7e6eb5e5574c6b90b8788a8c87
Opcode Fuzzy Hash: d9018af1212e69d34d4fa1256f11c09f5f9cebc11e26f1e67d2ab3ac6df5d96c
Instruction Fuzzy Hash: 3701D6B660021AB7DB21EB61DD49BDFB3ACEF44740F014077F905E3142DA789D4487A8

Function 004202CC Relevance: 7.5, APIs: 5, Instructions: 44memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

__lock.LIBCMT ref: 004202EA

Part of subcall function 00425238: __mtinitlocknum.LIBCMT ref: 0042524C
Part of subcall function 00425238: __amsg_exit.LIBCMT ref: 00425258
Part of subcall function 00425238: EnterCriticalSection.KERNEL32(-0000000F,-0000000F,?,0041FC1F,00000004,00441010,0000000C,0042635F,00000004,00000004,00000000,00000000,00000000,00424C6E,00000001,00000214), ref: 00425260

___sbh_find_block.LIBCMT ref: 004202F5
___sbh_free_block.LIBCMT ref: 00420304
HeapFree.KERNEL32(00000000,004053D2,00441070,0000000C,00425219,00000000,00441178,0000000C,00425251,004053D2,-0000000F,?,0041FC1F,00000004,00441010,0000000C), ref: 00420334
GetLastError.KERNEL32(?,0041FC1F,00000004,00441010,0000000C,0042635F,00000004,00000004,00000000,00000000,00000000,00424C6E,00000001,00000214), ref: 00420345

Memory Dump Source

Source File: 00000005.00000002.1722456807.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1722022141.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723561398.0000000000436000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000444000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000448000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1724304481.000000000044B000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_LetsPRO.jbxd

Similarity

API ID: CriticalEnterErrorFreeHeapLastSection___sbh_find_block___sbh_free_block__amsg_exit__lock__mtinitlocknum
String ID:
API String ID: 2714421763-0
Opcode ID: 1d6ff78643fa5b0dc52a1d98af31271e4a413a3a6a1b28d174920395141c8d10
Instruction ID: d2c0df2fb2ae950650880e5cd5228293dd4d3cdbf5c9d68202deeeeee3e20ab1
Opcode Fuzzy Hash: 1d6ff78643fa5b0dc52a1d98af31271e4a413a3a6a1b28d174920395141c8d10
Instruction Fuzzy Hash: 1E018431B01325EBDF24BB72BC0675E3AA49F05368FE4445FF900A61A2CA3C89408A5D

Function 0040EE65 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 234COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0040EE93

Strings

AfxMDIFrame80su, xrefs: 0040EF34
|C, xrefs: 0040EEEF
AfxFrameOrView80su, xrefs: 0040EF59

Memory Dump Source

Source File: 00000005.00000002.1722456807.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1722022141.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723561398.0000000000436000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000444000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000448000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1724304481.000000000044B000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_LetsPRO.jbxd

Similarity

API ID: _memset
String ID: |C$AfxFrameOrView80su$AfxMDIFrame80su
API String ID: 2102423945-507966845
Opcode ID: 865d84fa1ab593152ee6e8c455b3ee9ac906137a7d8251f868b831866b6d5e3e
Instruction ID: dd6b40b50874193ebed5b7caec57095060ea5f9a5309662484e0634c5017a1a1
Opcode Fuzzy Hash: 865d84fa1ab593152ee6e8c455b3ee9ac906137a7d8251f868b831866b6d5e3e
Instruction Fuzzy Hash: B9816571C04209BADB50DFA9C4867DEBBF8AF04348F10817AFA18F62C1D7789A44C795

Function 0041BDD4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 109stringCOMMON

Download Yara Rule

APIs

GlobalLock.KERNEL32(?,75295E50,System,0000000A,System,00000000,?,00000000,00000000), ref: 0041BDEE
lstrlenW.KERNEL32(00000000,?,00000000), ref: 0041BE36

Strings

System, xrefs: 0041BDEA

Memory Dump Source

Source File: 00000005.00000002.1722456807.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1722022141.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723561398.0000000000436000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000444000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000448000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1724304481.000000000044B000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_LetsPRO.jbxd

Similarity

API ID: GlobalLocklstrlen
String ID: System
API String ID: 1144527523-3470857405
Opcode ID: be81e45d66c70ee2720e872fc544c589118427e03fe761c35eef7fecdf0063ff
Instruction ID: f8acf7e696f8f55f9dccc23175bceb4e859dc29176c7afef4ab907951e8a1d84
Opcode Fuzzy Hash: be81e45d66c70ee2720e872fc544c589118427e03fe761c35eef7fecdf0063ff
Instruction Fuzzy Hash: 1641D071900216EFCB04DF74C8859EEB7B9EF00304F10C66AE81597281E7389A81CBD8

Function 00414DF0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

SysStringLen.OLEAUT32(?), ref: 00414DF8
CoGetClassObject.OLE32(?,?,00000000,0043B644,?), ref: 00414E16
CoGetClassObject.OLE32(?,?,00000000,0043B7B4,00000000), ref: 00414E50

Strings

P?<u, xrefs: 00414DF8

Memory Dump Source

Source File: 00000005.00000002.1722456807.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1722022141.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723561398.0000000000436000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000444000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000448000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1724304481.000000000044B000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_LetsPRO.jbxd

Similarity

API ID: ClassObject$String
String ID: P?<u
API String ID: 1109195124-2531429983
Opcode ID: 8a2116e6785763fc3644109bbe71ba8b33785739eccc56d6338190624adc3ca1
Instruction ID: a37a41f29d4104c6fdaf03a18554fb97371e97305a130cb90d466a43192c90ae
Opcode Fuzzy Hash: 8a2116e6785763fc3644109bbe71ba8b33785739eccc56d6338190624adc3ca1
Instruction Fuzzy Hash: B1111276A0021ABFCF118F94CC04A9A7BA9FB48361F108065FD01E6260D735DD22DBA4

Function 0040D70D Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 39libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00412E3C: EnterCriticalSection.KERNEL32(00448A20,?,?,?,00000000,00410C2C,00000010,00000008,004104E6,00410489,004047EE,00405A03,?,?,00401564), ref: 00412E78
Part of subcall function 00412E3C: InitializeCriticalSection.KERNEL32(1A1A596F,?,?,?,00000000,00410C2C,00000010,00000008,004104E6,00410489,004047EE,00405A03,?,?,00401564), ref: 00412E87
Part of subcall function 00412E3C: LeaveCriticalSection.KERNEL32(00448A20,?,?,?,00000000,00410C2C,00000010,00000008,004104E6,00410489,004047EE,00405A03,?,?,00401564), ref: 00412E94
Part of subcall function 00412E3C: EnterCriticalSection.KERNEL32(1A1A596F,?,?,?,00000000,00410C2C,00000010,00000008,004104E6,00410489,004047EE,00405A03,?,?,00401564), ref: 00412EA0

Part of subcall function 00410C11: __EH_prolog3_catch.LIBCMT ref: 00410C18

Part of subcall function 004047D4: __CxxThrowException@8.LIBCMT ref: 004047E8
Part of subcall function 004047D4: __EH_prolog3.LIBCMT ref: 004047F5

GetProcAddress.KERNEL32(00000000,HtmlHelpW), ref: 0040D751
FreeLibrary.KERNEL32(?), ref: 0040D761

Strings

HtmlHelpW, xrefs: 0040D74B
hhctrl.ocx, xrefs: 0040D735

Memory Dump Source

Source File: 00000005.00000002.1722456807.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1722022141.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723561398.0000000000436000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000444000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000448000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1724304481.000000000044B000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_LetsPRO.jbxd

Similarity

API ID: CriticalSection$Enter$AddressException@8FreeH_prolog3H_prolog3_catchInitializeLeaveLibraryProcThrow
String ID: HtmlHelpW$hhctrl.ocx
API String ID: 2853499158-3773518134
Opcode ID: bde5fde49ce1c82eb69d6884f1688759a62cd43a046f5fd279a25631aaf33fc2
Instruction ID: 07e237dfb93cc17589f99f6d02340ac370f970a58f4103c63697e2e91adbb316
Opcode Fuzzy Hash: bde5fde49ce1c82eb69d6884f1688759a62cd43a046f5fd279a25631aaf33fc2
Instruction Fuzzy Hash: 28016231544302AADB217FA29E06B5776A0AF44715F10883FF456B21D0E778C8549A6E

Function 0041075F Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 36libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(?), ref: 00410786
GetProcAddress.KERNEL32(00000000,MFCM80ReleaseManagedReferences), ref: 00410796

Strings

mfcm80u.dll, xrefs: 0041077B
MFCM80ReleaseManagedReferences, xrefs: 00410790

Memory Dump Source

Source File: 00000005.00000002.1722456807.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1722022141.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723561398.0000000000436000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000444000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000448000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1724304481.000000000044B000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_LetsPRO.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: MFCM80ReleaseManagedReferences$mfcm80u.dll
API String ID: 1646373207-1714785701
Opcode ID: de7ba22a2d041783333d9cf118e82a5aaf580b2a0ddb7c845af3b401a9852120
Instruction ID: 328b680509e4a54843c05f09a6833d507a2b16446e17c472f9afd24263a21405
Opcode Fuzzy Hash: de7ba22a2d041783333d9cf118e82a5aaf580b2a0ddb7c845af3b401a9852120
Instruction Fuzzy Hash: 23F0B475700208ABDB00EFB5AC85D9FB7ACAB44700B45403AB515E3181CE38A5048A68

Function 004047D4 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 23COMMONLIBRARYCODE

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 004047E8

Part of subcall function 00421117: RaiseException.KERNEL32(?,?,00000008,?), ref: 00421157

__EH_prolog3.LIBCMT ref: 004047F5

Part of subcall function 00410B82: LocalAlloc.KERNEL32(00000040,?,00410F4B,00000010,?,?,00000000,?,00000004,004104C7,004047EE,00405A03,?,?,00401564), ref: 00410B88

Strings

CD, xrefs: 004047E1
CD, xrefs: 004047DD

Memory Dump Source

Source File: 00000005.00000002.1722456807.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1722022141.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723561398.0000000000436000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000444000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000448000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1724304481.000000000044B000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_LetsPRO.jbxd

Similarity

API ID: AllocExceptionException@8H_prolog3LocalRaiseThrow
String ID: CD$CD
API String ID: 927841988-436287609
Opcode ID: 566db8b6037be2c023b6279a11d39fcd1121e642305a1f6b803b9fb80eb23288
Instruction ID: 99cfcc97ec7cb731710073c78c950ffb2e6519e4d8a49e582657714ad5e1ef0b
Opcode Fuzzy Hash: 566db8b6037be2c023b6279a11d39fcd1121e642305a1f6b803b9fb80eb23288
Instruction Fuzzy Hash: 73E0D874700214ABCB04FBE6880765D71989B44308F90887FA300D3692D7BD0A40426D

Function 0042B6E5 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 13libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(KERNEL32,00423667), ref: 0042B6EA
GetProcAddress.KERNEL32(00000000,IsProcessorFeaturePresent), ref: 0042B6FA

Strings

KERNEL32, xrefs: 0042B6E5
IsProcessorFeaturePresent, xrefs: 0042B6F4

Memory Dump Source

Source File: 00000005.00000002.1722456807.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1722022141.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723561398.0000000000436000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000444000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000448000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1724304481.000000000044B000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_LetsPRO.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: IsProcessorFeaturePresent$KERNEL32
API String ID: 1646373207-3105848591
Opcode ID: c5350ebba51366887bd6029cb260cb4e528941b3f7434bc6006ca02b70fedf6b
Instruction ID: 7be688adf8f71080c3600820ae2129f1ebcad9fdf60077f0780a30947012bfdb
Opcode Fuzzy Hash: c5350ebba51366887bd6029cb260cb4e528941b3f7434bc6006ca02b70fedf6b
Instruction Fuzzy Hash: AFC012143C531265DD1027F12C097162218AB95B02F529853A951D01C0DB5DC01044AE

Function 00419FF2 Relevance: 6.2, APIs: 4, Instructions: 186COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00419FF9
VariantClear.OLEAUT32(?), ref: 0041A0BD
CoTaskMemFree.OLE32(?,00000010), ref: 0041A16A
CoTaskMemFree.OLE32(?,00000010), ref: 0041A178

Memory Dump Source

Source File: 00000005.00000002.1722456807.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1722022141.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723561398.0000000000436000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000444000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000448000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1724304481.000000000044B000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_LetsPRO.jbxd

Similarity

API ID: FreeTask$ClearH_prolog3Variant
String ID:
API String ID: 365290523-0
Opcode ID: 690e6d7e0fbf2ac3677d41bb8861232b538ff844d4e6e66d37c7b30f0f9beb9f
Instruction ID: b88fca7516004c57389e066eb76756a077ccc98f5622f78d8b2978270b75a470
Opcode Fuzzy Hash: 690e6d7e0fbf2ac3677d41bb8861232b538ff844d4e6e66d37c7b30f0f9beb9f
Instruction Fuzzy Hash: 4F714A71601742DFCB20DFA5C8C49AAB7F2BF48304754496EE14A9B751CB39EC90CB5A

Function 004199DF Relevance: 6.2, APIs: 4, Instructions: 173windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 00419A10
GetDesktopWindow.USER32 ref: 00419A20
GetWindowRect.USER32(?,?), ref: 00419A39
GetWindowRect.USER32(?,?), ref: 00419A45

Memory Dump Source

Source File: 00000005.00000002.1722456807.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1722022141.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723561398.0000000000436000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000444000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000448000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1724304481.000000000044B000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_LetsPRO.jbxd

Similarity

API ID: Window$Rect$DesktopVisible
String ID:
API String ID: 1055025324-0
Opcode ID: e6008aa5ebdaa318fcca411c1dbae0e8e2b6e1126345035598c816fa40e7b580
Instruction ID: 30a3f357686995967d8355548517c8131ec4af247385a133efd76c826effcbad
Opcode Fuzzy Hash: e6008aa5ebdaa318fcca411c1dbae0e8e2b6e1126345035598c816fa40e7b580
Instruction Fuzzy Hash: 5951F975A0020AEFCB10DFA8C995CAEB7B9FF88344B24456AF506E7250CB34AD44CB64

Function 004119BD Relevance: 6.1, APIs: 4, Instructions: 132timeCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 004119D4
GetFileTime.KERNEL32(?,?,?,?), ref: 00411A0B
GetFileSize.KERNEL32(?,00000000), ref: 00411A20

Memory Dump Source

Source File: 00000005.00000002.1722456807.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1722022141.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723561398.0000000000436000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000444000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000448000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1724304481.000000000044B000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_LetsPRO.jbxd

Similarity

API ID: File$SizeTime_memset
String ID:
API String ID: 151880914-0
Opcode ID: 9ea6d89ffef01ad9ed47163886ea5edd698f9787e1b36c7fa63b099ed3bb7df3
Instruction ID: 0f2bde544b20c68b27f54795bdea468e726295a95f515ac3caf4fbaf01c9bedb
Opcode Fuzzy Hash: 9ea6d89ffef01ad9ed47163886ea5edd698f9787e1b36c7fa63b099ed3bb7df3
Instruction Fuzzy Hash: 3B412175504705AFC724DF69D8819ABBBF9FF083507108A2EE2A6D36A0E734F944CB58

Function 00401820 Relevance: 6.1, APIs: 4, Instructions: 119windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000080,00000001,?), ref: 00401863
SendMessageW.USER32(?,00000080,00000000,?), ref: 00401874

Part of subcall function 0040F2D2: IsWindow.USER32(?), ref: 0040F2E1

SendMessageW.USER32(?,00000401,00000000,00640000), ref: 0040196D
SendMessageW.USER32(?,00000402,00000000,00000000), ref: 0040197F

Memory Dump Source

Source File: 00000005.00000002.1722456807.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1722022141.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723561398.0000000000436000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000444000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000448000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1724304481.000000000044B000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_LetsPRO.jbxd

Similarity

API ID: MessageSend$Window
String ID:
API String ID: 2326795674-0
Opcode ID: 20eb9493e6398dfa6bfee7946f0cbc51bafd3ff8cbf402a710d80dc3b3a957bd
Instruction ID: 43caac3a92ff139fbec7bec73ef5c309766bb7178a7e11cae8b1d9c9423a92ec
Opcode Fuzzy Hash: 20eb9493e6398dfa6bfee7946f0cbc51bafd3ff8cbf402a710d80dc3b3a957bd
Instruction Fuzzy Hash: 504166712006019FD310DF28CC82F46B3A4BF89724F1487A9F968AB2E6CB75E805CB58

Function 00414666 Relevance: 6.1, APIs: 4, Instructions: 109comCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0041467F
GetObjectW.GDI32(?,0000005C,?), ref: 004146D2
GetDeviceCaps.GDI32(?,0000005A), ref: 0041473E
OleCreateFontIndirect.OLEAUT32(00000020,0043B724), ref: 0041476B

Memory Dump Source

Source File: 00000005.00000002.1722456807.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1722022141.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723561398.0000000000436000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000444000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000448000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1724304481.000000000044B000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_LetsPRO.jbxd

Similarity

API ID: CapsCreateDeviceFontH_prolog3IndirectObject
String ID:
API String ID: 788831076-0
Opcode ID: f35121c9c5a521f77cda06295d8150fd28530b55d1259f8ed5b93fd8e4cb66a2
Instruction ID: 1fb7041dcbf1daac800056e81f206375816a287724f15f6c3d98df27bbfa1c65
Opcode Fuzzy Hash: f35121c9c5a521f77cda06295d8150fd28530b55d1259f8ed5b93fd8e4cb66a2
Instruction Fuzzy Hash: E5416A70900249DFCB00DFA5C841AEDBBF0BF18348F10812EF959A7291E7789A44CF58

Function 0040F73C Relevance: 6.1, APIs: 4, Instructions: 103windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000F0,00000000,00000000), ref: 0040F770
SendMessageW.USER32(?,000000F0,00000000,00000000), ref: 0040F7D5
SendMessageW.USER32(?,000000F0,00000000,00000000), ref: 0040F81A
SendMessageW.USER32(?,000000F1,00000000,00000000), ref: 0040F843

Memory Dump Source

Source File: 00000005.00000002.1722456807.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1722022141.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723561398.0000000000436000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000444000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000448000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1724304481.000000000044B000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_LetsPRO.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: d911d4947b52ffb853f92abc4e095952210e5e6c464f1d13b42c73513f5e75b2
Instruction ID: 1aad33176d2894c3a30e4338dc9dce7e9cbd2ce42e872499a06128e4d48bbd23
Opcode Fuzzy Hash: d911d4947b52ffb853f92abc4e095952210e5e6c464f1d13b42c73513f5e75b2
Instruction Fuzzy Hash: 2031A131500119BBCB35EF41C881EAA7B69EF01394F10807BF905AB691DB38ED45DB95

Function 0042D76D Relevance: 6.1, APIs: 4, Instructions: 101COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0042D79D
__isleadbyte_l.LIBCMT ref: 0042D7D1
MultiByteToWideChar.KERNEL32(840FFFF8,00000009,?,A045FF98,?,00000000,00000000,?,00000000,0042CE28,?,?,00000002), ref: 0042D802
MultiByteToWideChar.KERNEL32(840FFFF8,00000009,?,00000001,?,00000000,00000000,?,00000000,0042CE28,?,?,00000002), ref: 0042D870

Memory Dump Source

Source File: 00000005.00000002.1722456807.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1722022141.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723561398.0000000000436000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000444000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000448000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1724304481.000000000044B000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_LetsPRO.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 1333e1def73d1eb9f2cb1a5bb71d5da76bda9fea1aeb28964ab92f6f1854b866
Instruction ID: 6d5526e7a7bf98a585b9de7c4e2d1bec8fd29bb5b85f550af205bdd2838d9e72
Opcode Fuzzy Hash: 1333e1def73d1eb9f2cb1a5bb71d5da76bda9fea1aeb28964ab92f6f1854b866
Instruction Fuzzy Hash: CB31D331F00266EFDB20DF64E840AAE7BB5BF01311F5585AAE4A58B291D338DD40DB59

Function 0041C222 Relevance: 6.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

__msize.LIBCMT ref: 0041C2B3
__msize.LIBCMT ref: 0041C2D6
_malloc.LIBCMT ref: 0041C2EE
_malloc.LIBCMT ref: 0041C303

Memory Dump Source

Source File: 00000005.00000002.1722456807.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1722022141.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723561398.0000000000436000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000444000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000448000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1724304481.000000000044B000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_LetsPRO.jbxd

Similarity

API ID: __msize_malloc
String ID:
API String ID: 1288803200-0
Opcode ID: a1fa7297c3384c500036820aa7bf4ee746c29e049b8330fee449d5411354c8a9
Instruction ID: 766545d2d9a57957c3273ef70c76b7f7966c85195388d06f70ce702ee3ac8c40
Opcode Fuzzy Hash: a1fa7297c3384c500036820aa7bf4ee746c29e049b8330fee449d5411354c8a9
Instruction Fuzzy Hash: F1217A316802149BDB24AF65ECC1A9A77A4AF01724B10856BEC298A352DB3CDDD0CA9D

Function 0041F52C Relevance: 6.1, APIs: 4, Instructions: 85windowCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0041F533
PeekMessageW.USER32(00000001,00000000,00000200,00000209,00000003), ref: 0041F58D
PeekMessageW.USER32(00000001,00000000,00000100,00000109,00000003), ref: 0041F5A4
PeekMessageW.USER32(?,00000000,00000000,00000000,00000002), ref: 0041F5DE

Memory Dump Source

Source File: 00000005.00000002.1722456807.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1722022141.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723561398.0000000000436000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000444000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000448000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1724304481.000000000044B000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_LetsPRO.jbxd

Similarity

API ID: MessagePeek$H_prolog3
String ID:
API String ID: 3998274959-0
Opcode ID: 1f42341eaed29bb26e7dabd3b65d755fcb9718198bb94e7807025b4f5fcd60be
Instruction ID: 623070a4d195b4b5a0e97871ace925d1f5c98d2f754eebbac01ba7fd06c5ff44
Opcode Fuzzy Hash: 1f42341eaed29bb26e7dabd3b65d755fcb9718198bb94e7807025b4f5fcd60be
Instruction Fuzzy Hash: 2B318F71A10205FFDF20DFA4DD85EAE77B9BF04314F10092EF552A6292D778AA85CA18

Function 00413738 Relevance: 6.1, APIs: 4, Instructions: 72COMMON

Download Yara Rule

APIs

CharNextW.USER32(?), ref: 0041378D
CharNextW.USER32(00000000), ref: 004137AF
_strtol.LIBCMT ref: 004137DA
_strtoul.LIBCMT ref: 004137E1

Part of subcall function 00423D89: wcstoxl.LIBCMT ref: 00423DA9

Memory Dump Source

Source File: 00000005.00000002.1722456807.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1722022141.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723561398.0000000000436000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000444000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000448000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1724304481.000000000044B000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_LetsPRO.jbxd

Similarity

API ID: CharNext$_strtol_strtoulwcstoxl
String ID:
API String ID: 3842480389-0
Opcode ID: 6136546f868e92f599f09e27f3ba6d97ba50fef5b8f9a586e24832f4e226fef6
Instruction ID: d933f6925d29c4da8357ba0058abbc99701c912001cf1045d67e21fd9f3570af
Opcode Fuzzy Hash: 6136546f868e92f599f09e27f3ba6d97ba50fef5b8f9a586e24832f4e226fef6
Instruction Fuzzy Hash: 2F21F6F160021697DB20AF66DC45BEAB3F4AF04316F51806BF964D61C1D73C9E81875D

Function 00404550 Relevance: 6.1, APIs: 4, Instructions: 58windowCOMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00404557

Part of subcall function 00404493: _malloc.LIBCMT ref: 004044AD

__CxxThrowException@8.LIBCMT ref: 0040458D
FormatMessageW.KERNEL32(00001100,00000000,?,00000800,004010F6,00000000,00000000,00000000,?,1A1A596F,0043ECD8,00000004,004010F6,00000000,004053D2,00000000), ref: 004045B6
LocalFree.KERNEL32(004010F6,004010F6,00000000,004053D2,00000000,?,1A1A596F), ref: 004045E0

Memory Dump Source

Source File: 00000005.00000002.1722456807.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1722022141.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723561398.0000000000436000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000444000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000448000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1724304481.000000000044B000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_LetsPRO.jbxd

Similarity

API ID: Exception@8FormatFreeH_prolog3LocalMessageThrow_malloc
String ID:
API String ID: 1776251131-0
Opcode ID: 9e6ce57f74e8aa7f51b5e3c02f6171b0520a098f9ccfbebfbcfd0abc7ed2b31f
Instruction ID: 78189b8ccb1edd261e64a3c1724e2a35f484fe8c06b2040e7993700b0e0ff718
Opcode Fuzzy Hash: 9e6ce57f74e8aa7f51b5e3c02f6171b0520a098f9ccfbebfbcfd0abc7ed2b31f
Instruction Fuzzy Hash: BA1191B1600219BFDB01AFA5DC05EAE3BA4FF49350F10853AFB18DA2E1D735DA108798

Function 00408235 Relevance: 6.1, APIs: 4, Instructions: 57COMMON

Download Yara Rule

APIs

FindResourceW.KERNEL32(?,00000000,00000005), ref: 0040825B
LoadResource.KERNEL32(?,00000000), ref: 00408263
LockResource.KERNEL32(00000000), ref: 00408275
FreeResource.KERNEL32(00000000), ref: 004082BF

Memory Dump Source

Source File: 00000005.00000002.1722456807.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1722022141.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723561398.0000000000436000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000444000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000448000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1724304481.000000000044B000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_LetsPRO.jbxd

Similarity

API ID: Resource$FindFreeLoadLock
String ID:
API String ID: 1078018258-0
Opcode ID: 27f8c11ffff0d9c8956f1614efca48a1a444230d510af7b2676f46833b6bad5b
Instruction ID: 58e41e832ce2ab50fe1d59985af0b1a3cc5067904a205ccf57f390decb3672b5
Opcode Fuzzy Hash: 27f8c11ffff0d9c8956f1614efca48a1a444230d510af7b2676f46833b6bad5b
Instruction Fuzzy Hash: A5118230501B11EFCB209F55C988AA7B3B4FF00315F1180BEE88263691EB78ED40D764

Function 00405E72 Relevance: 6.1, APIs: 4, Instructions: 56threadCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00405E79

Part of subcall function 00408DFD: __EH_prolog3.LIBCMT ref: 00408E04

__wcsdup.LIBCMT ref: 00405E9B
GetCurrentThread.KERNEL32 ref: 00405EC8
GetCurrentThreadId.KERNEL32 ref: 00405ED1

Memory Dump Source

Source File: 00000005.00000002.1722456807.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1722022141.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723561398.0000000000436000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000444000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000448000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1724304481.000000000044B000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_LetsPRO.jbxd

Similarity

API ID: CurrentH_prolog3Thread$__wcsdup
String ID:
API String ID: 190065205-0
Opcode ID: 01aeee86399d01e2c45f8062f4e03298e51d6b50520dbc0c315699c2280a3336
Instruction ID: 9da16bda545b2b1377f235064dd2c69c34ae0496ec25f29a6c0868ca4c06492b
Opcode Fuzzy Hash: 01aeee86399d01e2c45f8062f4e03298e51d6b50520dbc0c315699c2280a3336
Instruction Fuzzy Hash: 9C219FB0900B508FD7219F2AC58524AFBF4BFA4704F14892FD1AAD7B62C7B8A541DF58

Function 0040E170 Relevance: 6.1, APIs: 4, Instructions: 55windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000001F,00000000,00000000), ref: 0040E19A
SendMessageW.USER32(?,0000001F,00000000,00000000), ref: 0040E1C5

Part of subcall function 0040CF48: GetTopWindow.USER32(?), ref: 0040CF56

GetCapture.USER32 ref: 0040E1D7
SendMessageW.USER32(00000000,0000001F,00000000,00000000), ref: 0040E1E6

Memory Dump Source

Source File: 00000005.00000002.1722456807.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1722022141.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723561398.0000000000436000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000444000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000448000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1724304481.000000000044B000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_LetsPRO.jbxd

Similarity

API ID: MessageSend$CaptureWindow
String ID:
API String ID: 729421689-0
Opcode ID: 968beefbee22a7223bf3c4252e7ee455de8618f6e9fbbaae7459b6c96cc64f4f
Instruction ID: 649640605e0f8474226b010df06119de80eb8d061492605380dff1c4ab4e9835
Opcode Fuzzy Hash: 968beefbee22a7223bf3c4252e7ee455de8618f6e9fbbaae7459b6c96cc64f4f
Instruction Fuzzy Hash: 9A014471350209BFF6312B658CC9FBB36ADEB48788F05057AF241BA1E2C6B54C115664

Function 004071E9 Relevance: 6.1, APIs: 4, Instructions: 55COMMON

Download Yara Rule

APIs

FindResourceW.KERNEL32(?,?,000000F0), ref: 0040720D
LoadResource.KERNEL32(?,00000000), ref: 00407219
LockResource.KERNEL32(00000000), ref: 00407227
FreeResource.KERNEL32(00000000), ref: 00407255

Memory Dump Source

Source File: 00000005.00000002.1722456807.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1722022141.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723561398.0000000000436000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000444000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000448000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1724304481.000000000044B000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_LetsPRO.jbxd

Similarity

API ID: Resource$FindFreeLoadLock
String ID:
API String ID: 1078018258-0
Opcode ID: 1652ea0285f7c82129219f22b3e0b6fa740b5bf0af827081ba1d82611c1e8ce2
Instruction ID: 07adbca5c73878e31649f1f6c6d0559cfc28299f9b1bd5ed6f6db6710e5ef424
Opcode Fuzzy Hash: 1652ea0285f7c82129219f22b3e0b6fa740b5bf0af827081ba1d82611c1e8ce2
Instruction Fuzzy Hash: A4112871600205EFDB109F95D888A9E7BB9EF05310F0580BAF905A72A0CB79EE40CB65

Function 00407D07 Relevance: 6.1, APIs: 4, Instructions: 55registryCOMMON

Download Yara Rule

APIs

RegSetValueExW.ADVAPI32(00000000,?,00000000,00000004,?,00000004), ref: 00407D40
RegCloseKey.ADVAPI32(00000000), ref: 00407D49
_swprintf.LIBCMT ref: 00407D66
WritePrivateProfileStringW.KERNEL32(?,?,?,?), ref: 00407D77

Memory Dump Source

Source File: 00000005.00000002.1722456807.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1722022141.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723561398.0000000000436000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000444000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000448000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1724304481.000000000044B000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_LetsPRO.jbxd

Similarity

API ID: ClosePrivateProfileStringValueWrite_swprintf
String ID:
API String ID: 4210924919-0
Opcode ID: ca31ea4bd56a5b73ce1bd49023e02e344fb11c5298432ca6eb4b7cee61b42886
Instruction ID: d669613178eea09b1050382b9f2ed27b2547cf05832cd3d388e93f9554a90e34
Opcode Fuzzy Hash: ca31ea4bd56a5b73ce1bd49023e02e344fb11c5298432ca6eb4b7cee61b42886
Instruction Fuzzy Hash: E001C472A00209BBDB10DF649C42FAF77ACAF48704F01442AF601A7191DA78ED0497A9

Function 00416FAE Relevance: 6.1, APIs: 4, Instructions: 52COMMON

Download Yara Rule

APIs

IntersectRect.USER32(?,00000000,?), ref: 00416FED
EqualRect.USER32(?,00000000), ref: 00416FFA
IsRectEmpty.USER32(?), ref: 00417004
InvalidateRect.USER32(?,?,?), ref: 00417021

Memory Dump Source

Source File: 00000005.00000002.1722456807.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1722022141.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723561398.0000000000436000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000444000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000448000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1724304481.000000000044B000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_LetsPRO.jbxd

Similarity

API ID: Rect$EmptyEqualIntersectInvalidate
String ID:
API String ID: 3354205298-0
Opcode ID: 369960e12b2d697d1abbede00a596d07e7c2dd3990381c4ee7d328fff8275268
Instruction ID: 53137d054bfcc6e6c4f116b6119babf7d5b874d44a3899ec86223113dc5213de
Opcode Fuzzy Hash: 369960e12b2d697d1abbede00a596d07e7c2dd3990381c4ee7d328fff8275268
Instruction Fuzzy Hash: 8F112E7290021AEFCF01DF94C849EDEBBB9FF08315F004062FA0596155D7759989CFA4

Function 00404CAD Relevance: 6.1, APIs: 4, Instructions: 51COMMON

Download Yara Rule

APIs

Part of subcall function 00404493: _malloc.LIBCMT ref: 004044AD

GetCurrentProcess.KERNEL32(?,00000000,00000000,00000002), ref: 00404CDF
GetCurrentProcess.KERNEL32(?,00000000), ref: 00404CE5
DuplicateHandle.KERNEL32(00000000), ref: 00404CE8
GetLastError.KERNEL32(?), ref: 00404D03

Memory Dump Source

Source File: 00000005.00000002.1722456807.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1722022141.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723561398.0000000000436000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000444000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000448000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1724304481.000000000044B000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_LetsPRO.jbxd

Similarity

API ID: CurrentProcess$DuplicateErrorHandleLast_malloc
String ID:
API String ID: 3704204646-0
Opcode ID: 0fd4ab489c38e403ca11104bb4ab16ad97af153e4327250620caaaac3493fbb2
Instruction ID: 098862218d34d8f4a3f67fe7e5c28faeb6644e0f2317e7a266e25fd7ba6140c3
Opcode Fuzzy Hash: 0fd4ab489c38e403ca11104bb4ab16ad97af153e4327250620caaaac3493fbb2
Instruction Fuzzy Hash: 44011E71700205BBEB10ABA69C49B5B7BA9AF84710F258466FA05DB291DB75DC008764

Function 0040655E Relevance: 6.0, APIs: 4, Instructions: 50windowCOMMON

Download Yara Rule

APIs

EnableMenuItem.USER32(?,00000000,?), ref: 00406596

Part of subcall function 004047D4: __CxxThrowException@8.LIBCMT ref: 004047E8
Part of subcall function 004047D4: __EH_prolog3.LIBCMT ref: 004047F5

GetFocus.USER32 ref: 004065AD
GetParent.USER32(?), ref: 004065BB
SendMessageW.USER32(?,00000028,00000000,00000000), ref: 004065CE

Memory Dump Source

Source File: 00000005.00000002.1722456807.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1722022141.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723561398.0000000000436000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000444000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000448000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1724304481.000000000044B000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_LetsPRO.jbxd

Similarity

API ID: EnableException@8FocusH_prolog3ItemMenuMessageParentSendThrow
String ID:
API String ID: 3849708097-0
Opcode ID: 08ba99893f0c9ff4ca61c12b16a04323a755e0cd72f29c5791bda69e97ed5e34
Instruction ID: d05d510ca60c9f83e9f43078bf20bd9f8c7e446a9de639df797b0a7b5e7cf5ad
Opcode Fuzzy Hash: 08ba99893f0c9ff4ca61c12b16a04323a755e0cd72f29c5791bda69e97ed5e34
Instruction Fuzzy Hash: 15113CB1500601BFCB349F20EC8582BB7B9FF95315B16C63EE187629A4C739AC54CB69

Function 0040CF48 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

GetTopWindow.USER32(?), ref: 0040CF56
GetTopWindow.USER32(00000000), ref: 0040CF95
GetWindow.USER32(00000000,00000002), ref: 0040CFB3

Memory Dump Source

Source File: 00000005.00000002.1722456807.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1722022141.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723561398.0000000000436000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000444000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000448000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1724304481.000000000044B000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_LetsPRO.jbxd

Similarity

API ID: Window
String ID:
API String ID: 2353593579-0
Opcode ID: 4c62a2f414a9df8ba8a0d037c13ac9c377ee79e6f6948d59822ab17e1cbbb0d7
Instruction ID: e472a885b60089987bfeb7e68ca373283d0e00349528069a1c75e77b073227f5
Opcode Fuzzy Hash: 4c62a2f414a9df8ba8a0d037c13ac9c377ee79e6f6948d59822ab17e1cbbb0d7
Instruction Fuzzy Hash: 4A01ED3200421BFBCF125F919D44E9F3A67AF05350F054226FE04651E0C73AC921EBAA

Function 0042B5D9 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 0042B5FD

Part of subcall function 0042B428: __fltout2.LIBCMT ref: 0042B452

__cftog_l.LIBCMT ref: 0042B623
__cftoe_l.LIBCMT ref: 0042B655

Memory Dump Source

Source File: 00000005.00000002.1722456807.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1722022141.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723561398.0000000000436000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000444000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000448000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1724304481.000000000044B000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_LetsPRO.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: 7ea3a893bf3bd11cad7cd0372379ff1f7e327c259811a7a92178e9d3a0fb71f7
Instruction ID: bc4e453140df7a98ba26125bbd02d3a7665885cecc9332a0e131736641bb3453
Opcode Fuzzy Hash: 7ea3a893bf3bd11cad7cd0372379ff1f7e327c259811a7a92178e9d3a0fb71f7
Instruction Fuzzy Hash: DB01427214015ABBCF125E85EC418EE3F66FF18354F998416FA2854131D73BC9B2AB8A

Function 0040C902 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 0040C90D
GetTopWindow.USER32(00000000), ref: 0040C920

Part of subcall function 0040C902: GetWindow.USER32(00000000,00000002), ref: 0040C967

GetTopWindow.USER32(?), ref: 0040C950

Memory Dump Source

Source File: 00000005.00000002.1722456807.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1722022141.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723561398.0000000000436000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000444000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000448000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1724304481.000000000044B000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_LetsPRO.jbxd

Similarity

API ID: Window$Item
String ID:
API String ID: 369458955-0
Opcode ID: d27ff7313269575d1bb09a0715317fb06b700b9d6a605cd072f2df1fd5c2d340
Instruction ID: d4aaeaac1c29cf3b73af84804df15de9eca3ad12ede1d584ca374ba98fbad212
Opcode Fuzzy Hash: d27ff7313269575d1bb09a0715317fb06b700b9d6a605cd072f2df1fd5c2d340
Instruction Fuzzy Hash: F9017C7204161AFBCB222F619C45E9F3A58AF513A0F018336FD00712A0D73AC912AAAD

Function 00424C45 Relevance: 6.0, APIs: 4, Instructions: 45threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,00000000,004211DC,00420580,00000001,004249D8,00000000,00000000,00000000,?,?,004053D2,00424AEA,?,004044B2,00000000), ref: 00424C47

Part of subcall function 00424B17: TlsGetValue.KERNEL32(00000000,00424C5A,?,?,004053D2,00424AEA,?,004044B2,00000000,?,00000000,00404563,0000000C,00000004,004010F6,00000000), ref: 00424B1E
Part of subcall function 00424B17: TlsSetValue.KERNEL32(00000000,?,004053D2,00424AEA,?,004044B2,00000000,?,00000000,00404563,0000000C,00000004,004010F6,00000000,004053D2,00000000), ref: 00424B3F

__calloc_crt.LIBCMT ref: 00424C69

Part of subcall function 0042634C: __calloc_impl.LIBCMT ref: 0042635A
Part of subcall function 0042634C: Sleep.KERNEL32(00000000,00000000,004053D2,00000000,?,1A1A596F), ref: 00426371

Part of subcall function 00424AA0: TlsGetValue.KERNEL32(00000000,0042527E,00420190,004053D2,?,004044B2,00000000,?,00000000,00404563,0000000C,00000004,004010F6,00000000,004053D2,00000000), ref: 00424AAD
Part of subcall function 00424AA0: TlsGetValue.KERNEL32(00000005,?,004044B2,00000000,?,00000000,00404563,0000000C,00000004,004010F6,00000000,004053D2,00000000,?,1A1A596F), ref: 00424AC4

Part of subcall function 00424B86: GetModuleHandleA.KERNEL32(KERNEL32.DLL,00441130,0000000C,00424C97,00000000,00000000,?,?,004053D2,00424AEA,?,004044B2,00000000,?,00000000,00404563), ref: 00424B97
Part of subcall function 00424B86: GetProcAddress.KERNEL32(00404563,EncodePointer), ref: 00424BCB
Part of subcall function 00424B86: GetProcAddress.KERNEL32(00404563,DecodePointer), ref: 00424BDB
Part of subcall function 00424B86: InterlockedIncrement.KERNEL32(00445BE0), ref: 00424BFD
Part of subcall function 00424B86: __lock.LIBCMT ref: 00424C05
Part of subcall function 00424B86: ___addlocaleref.LIBCMT ref: 00424C24

GetCurrentThreadId.KERNEL32 ref: 00424C99
SetLastError.KERNEL32(00000000,?,?,004053D2,00424AEA,?,004044B2,00000000,?,00000000,00404563,0000000C,00000004,004010F6,00000000,004053D2), ref: 00424CB1

Memory Dump Source

Source File: 00000005.00000002.1722456807.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1722022141.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723561398.0000000000436000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000444000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000448000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1724304481.000000000044B000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_LetsPRO.jbxd

Similarity

API ID: Value$AddressErrorLastProc$CurrentHandleIncrementInterlockedModuleSleepThread___addlocaleref__calloc_crt__calloc_impl__lock
String ID:
API String ID: 1081334783-0
Opcode ID: 00658e219b0c32efad13730bacc45b5b967d707bb2476f0506d0c524c1af3b48
Instruction ID: 585f626bd2a4fb1c3cb249413e2eeb9adecc7371ab85424afb953cfb8441407b
Opcode Fuzzy Hash: 00658e219b0c32efad13730bacc45b5b967d707bb2476f0506d0c524c1af3b48
Instruction Fuzzy Hash: 51F0C832706A32ABD7313B7A7C0675B3A94DF81771753012FF844961E1CE29D84196EC

Function 00401610 Relevance: 6.0, APIs: 4, Instructions: 32COMMON

Download Yara Rule

APIs

~_Task_impl.LIBCPMT ref: 00401643

Part of subcall function 00408A6B: __EH_prolog3.LIBCMT ref: 00408A72

~_Task_impl.LIBCPMT ref: 00401653

Part of subcall function 00408A16: __EH_prolog3.LIBCMT ref: 00408A1D

~_Task_impl.LIBCPMT ref: 00401663
~_Task_impl.LIBCPMT ref: 00401670

Part of subcall function 0040882C: __EH_prolog3.LIBCMT ref: 00408833

Part of subcall function 00407DC8: __EH_prolog3.LIBCMT ref: 00407DCF

Memory Dump Source

Source File: 00000005.00000002.1722456807.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1722022141.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723561398.0000000000436000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000444000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000448000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1724304481.000000000044B000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_LetsPRO.jbxd

Similarity

API ID: H_prolog3Task_impl
String ID:
API String ID: 2182512335-0
Opcode ID: 8f99f12a0844c0a3aec2417e74a598c1894b0082cf609bcfb53354e8aa428bd9
Instruction ID: 033783f5f02b00e22d4f262fbb060d2e3d885b728daa5598d3cf1c0724294993
Opcode Fuzzy Hash: 8f99f12a0844c0a3aec2417e74a598c1894b0082cf609bcfb53354e8aa428bd9
Instruction Fuzzy Hash: EC014F35108B828FD305DF24D441B9ABBE4BF59724F404B2EE4E6536D1DB786108CA96

Function 00408691 Relevance: 6.0, APIs: 4, Instructions: 32COMMON

Download Yara Rule

APIs

EnableWindow.USER32(?,00000001), ref: 004086B1
GetActiveWindow.USER32 ref: 004086BC
SetActiveWindow.USER32(?,?,00000024,004015D6), ref: 004086CA
FreeResource.KERNEL32(?,?,00000024,004015D6), ref: 004086E6

Part of subcall function 0040F3A8: EnableWindow.USER32(?,0043BE74), ref: 0040F3B5

Memory Dump Source

Source File: 00000005.00000002.1722456807.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1722022141.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723561398.0000000000436000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000444000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000448000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1724304481.000000000044B000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_LetsPRO.jbxd

Similarity

API ID: Window$ActiveEnable$FreeResource
String ID:
API String ID: 253586258-0
Opcode ID: 0c40ac9966e1c1b3073ea091d4e8f334113125148879fdc2da107284a5d140de
Instruction ID: 45d0fb33e8e3c148bcc653e4de8ab649ef6aa14939d62e4caff0f199cf912bd8
Opcode Fuzzy Hash: 0c40ac9966e1c1b3073ea091d4e8f334113125148879fdc2da107284a5d140de
Instruction Fuzzy Hash: D6F03C34900705DBCF22AF65CA455AEB7B1BF98705F22043EE582722A1CB3B5D80CE5D

Function 0041E469 Relevance: 6.0, APIs: 4, Instructions: 21COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0041E48B
GetTickCount.KERNEL32 ref: 0041E498
CoFreeUnusedLibraries.OLE32 ref: 0041E4A7
GetTickCount.KERNEL32 ref: 0041E4AD

Part of subcall function 0041E412: CoFreeUnusedLibraries.OLE32(00000000,0041E4F1,00000000), ref: 0041E456
Part of subcall function 0041E412: OleUninitialize.OLE32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,0041E4F1), ref: 0041E45C

Memory Dump Source

Source File: 00000005.00000002.1722456807.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1722022141.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723561398.0000000000436000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000444000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000448000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1724304481.000000000044B000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_LetsPRO.jbxd

Similarity

API ID: CountTick$FreeLibrariesUnused$Uninitialize
String ID:
API String ID: 685759847-0
Opcode ID: a3320c9f2a1a2676830a77218ad8e5e5445e34df1bd4327487d89b5f0dd22aec
Instruction ID: de5c77cbc8acef64842f2cfb72bed3e102335ec01c0207a05cc7c9a94cd2442d
Opcode Fuzzy Hash: a3320c9f2a1a2676830a77218ad8e5e5445e34df1bd4327487d89b5f0dd22aec
Instruction Fuzzy Hash: 9CE09238804225DBDB10AF65ED043993BA4EB06301F00883BD5459A162C77C28C4DF6E

Function 00418573 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 170COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32(?), ref: 004185AC

Strings

(, xrefs: 004186BC

Memory Dump Source

Source File: 00000005.00000002.1722456807.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1722022141.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723561398.0000000000436000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000444000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000448000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1724304481.000000000044B000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_LetsPRO.jbxd

Similarity

API ID: ClearVariant
String ID: (
API String ID: 1473721057-3887548279
Opcode ID: 3c894c3abc0016e82eac178bd11d42717aa0382b3e23e348eb7c063e906c0bbc
Instruction ID: fdf7db0491a45ddfa6d2de12227586edd0ea4d946040c84ee2411de5ac11b420
Opcode Fuzzy Hash: 3c894c3abc0016e82eac178bd11d42717aa0382b3e23e348eb7c063e906c0bbc
Instruction Fuzzy Hash: 86516A71A00701EFCB64CF69C9819AAF7F1FF48314B504A6EE5829BA91CB74F981CB44

Function 00416464 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 150COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0041646B

Strings

@, xrefs: 004164CE

Memory Dump Source

Source File: 00000005.00000002.1722456807.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1722022141.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723561398.0000000000436000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000444000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000448000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1724304481.000000000044B000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_LetsPRO.jbxd

Similarity

API ID: H_prolog3
String ID: @
API String ID: 431132790-2766056989
Opcode ID: e43076a41cf91167308861e9f8b4a38497743ecc94f95581c0701ac1c3b142a9
Instruction ID: fc188eaebd722770accb6aac7378f7f59a65883b2cf8f2d38b1f69d5648ffc14
Opcode Fuzzy Hash: e43076a41cf91167308861e9f8b4a38497743ecc94f95581c0701ac1c3b142a9
Instruction Fuzzy Hash: AD51F7B0A002099FDB04CFA8C888AEEB7F9FF48304F14456EE516EB250E778A945CF54

Function 0042D3B1 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 69COMMON

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 0042D3D3
__calloc_crt.LIBCMT ref: 0042D3EC

Strings

xbD, xrefs: 0042D455

Memory Dump Source

Source File: 00000005.00000002.1722456807.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1722022141.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723561398.0000000000436000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000444000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000448000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1724304481.000000000044B000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_LetsPRO.jbxd

Similarity

API ID: __calloc_crt
String ID: xbD
API String ID: 3494438863-2212064342
Opcode ID: 30379b5f31472a63be69b1ec58f538da127ed52b73fe499d77a1fe93ad767d41
Instruction ID: 4c0c7b8a1ee9215efbac2266b0acd383f31d2b19c9e5cb9b43a3eae996d79d41
Opcode Fuzzy Hash: 30379b5f31472a63be69b1ec58f538da127ed52b73fe499d77a1fe93ad767d41
Instruction Fuzzy Hash: 5F11E731B442305BF718BB2EBC4066623D5EB82724B65423FEA11CA2D0DA389C42455E

Function 004021D0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

_memmove_s.LIBCMT ref: 0040222E

Strings

B$@, xrefs: 004021D1, 00402215

Memory Dump Source

Source File: 00000005.00000002.1722456807.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1722022141.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723561398.0000000000436000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000444000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000448000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1724304481.000000000044B000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_LetsPRO.jbxd

Similarity

API ID: _memmove_s
String ID: B$@
API String ID: 800865076-191570058
Opcode ID: 117989d4495ee38c03da9b21b2427e6b329de4bdb6fb9d5611ea46d9b13d1d68
Instruction ID: 82b09e8a0687f23eefd6bda383aa7d95b6386fc6fd4392956032a4c7082acb0b
Opcode Fuzzy Hash: 117989d4495ee38c03da9b21b2427e6b329de4bdb6fb9d5611ea46d9b13d1d68
Instruction Fuzzy Hash: D711C8326006449FCB14DED6CDCCE5BF3A8FB90710F4081AEF9056B2D1C6B8AD048695

Function 00405DFA Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000104), ref: 00405E20
PathFindExtensionW.SHLWAPI(?), ref: 00405E36

Part of subcall function 00405B0B: __EH_prolog3.LIBCMT ref: 00405B2A
Part of subcall function 00405B0B: GetModuleHandleW.KERNEL32(kernel32.dll,0000005C), ref: 00405B54
Part of subcall function 00405B0B: GetProcAddress.KERNEL32(00000000,GetUserDefaultUILanguage), ref: 00405B65
Part of subcall function 00405B0B: ConvertDefaultLocale.KERNELBASE(?), ref: 00405B9B
Part of subcall function 00405B0B: ConvertDefaultLocale.KERNELBASE(?), ref: 00405BA3
Part of subcall function 00405B0B: GetProcAddress.KERNEL32(?,GetSystemDefaultUILanguage), ref: 00405BB7
Part of subcall function 00405B0B: ConvertDefaultLocale.KERNEL32(?), ref: 00405BDB
Part of subcall function 00405B0B: ConvertDefaultLocale.KERNEL32(74DEF550), ref: 00405BE1
Part of subcall function 00405B0B: GetModuleFileNameW.KERNEL32(00400000,00000000,00000105), ref: 00405C18

Strings

%s%s.dll, xrefs: 00405E40

Memory Dump Source

Source File: 00000005.00000002.1722456807.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1722022141.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723561398.0000000000436000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000444000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000448000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1724304481.000000000044B000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_LetsPRO.jbxd

Similarity

API ID: ConvertDefaultLocale$Module$AddressFileNameProc$ExtensionFindH_prolog3HandlePath
String ID: %s%s.dll
API String ID: 2355367764-1649984862
Opcode ID: d295025bfd6f47dccd83782b2ac090d90e74aba6b47760e6f40420c5ca697674
Instruction ID: 542de31ceff2efdc278ff8b252affbc67f14bf2204e871b6a14260524ec97e11
Opcode Fuzzy Hash: d295025bfd6f47dccd83782b2ac090d90e74aba6b47760e6f40420c5ca697674
Instruction Fuzzy Hash: 2F01D672A00518ABDB11DB64FC859EF73F8FF09300F4504BAE805E7081EB74AA058F98

Function 0041158F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 32COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00411596

Part of subcall function 00404493: _malloc.LIBCMT ref: 004044AD

__CxxThrowException@8.LIBCMT ref: 004115CF

Part of subcall function 00405101: __EH_prolog3.LIBCMT ref: 00405108

Strings

>N@, xrefs: 004115DC

Memory Dump Source

Source File: 00000005.00000002.1722456807.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1722022141.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723561398.0000000000436000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000444000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000448000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1724304481.000000000044B000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_LetsPRO.jbxd

Similarity

API ID: H_prolog3$Exception@8Throw_malloc
String ID: >N@
API String ID: 623675022-3381801619
Opcode ID: def3e89db506bb85c75e4e9c6b0c3815060b3f316687404b84010f26f0b65078
Instruction ID: 8d46a7198642ee084d4953a32e184eb2b4a73c0f42afeca71593d9f5b4b96bbe
Opcode Fuzzy Hash: def3e89db506bb85c75e4e9c6b0c3815060b3f316687404b84010f26f0b65078
Instruction Fuzzy Hash: 52F09631500206BFCF04EFA0CC05AAF7BA2BF48304F10892FB215A61B1D7398A90DB59

Function 00433A38 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 25COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00433A3F
__CxxThrowException@8.LIBCMT ref: 00433A71

Part of subcall function 00421117: RaiseException.KERNEL32(?,?,00000008,?), ref: 00421157

Part of subcall function 00403330: std::exception::exception.LIBCMT ref: 0040335E

Strings

invalid string position, xrefs: 00433A44

Memory Dump Source

Source File: 00000005.00000002.1722456807.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1722022141.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723561398.0000000000436000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000444000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000448000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1724304481.000000000044B000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_LetsPRO.jbxd

Similarity

API ID: ExceptionException@8H_prolog3RaiseThrowstd::exception::exception
String ID: invalid string position
API String ID: 2977319401-1799206989
Opcode ID: 2f743c992f6c7dd628681efeb039213f1babb925da590db2a9f01d2bf47f1e53
Instruction ID: 9ac6d9e09b916556b802cab7350980fc65dfd418094a18e8268f165898ba5e4f
Opcode Fuzzy Hash: 2f743c992f6c7dd628681efeb039213f1babb925da590db2a9f01d2bf47f1e53
Instruction Fuzzy Hash: BDE03071600118AAC704EFD1EC42BCEBB78EF18355F50942FB60166192DBB95A45C7A9

Function 0041F0DC Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 24COMMON

Download Yara Rule

APIs

SysStringLen.OLEAUT32(GA), ref: 0041F0E9

Part of subcall function 004013D0: _memcpy_s.LIBCMT ref: 004013E4

Strings

P?<u, xrefs: 0041F0E9
GA, xrefs: 0041F0E6

Memory Dump Source

Source File: 00000005.00000002.1722456807.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1722022141.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723561398.0000000000436000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000444000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000448000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1724304481.000000000044B000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_LetsPRO.jbxd

Similarity

API ID: String_memcpy_s
String ID: GA$P?<u
API String ID: 1954371419-1945424304
Opcode ID: 50bf2bd798dd79b378328ef1c7e29f86e0217dcecd2c3f51df139beccd9fa7eb
Instruction ID: 57690cd15a6c3a4f8fe63b31d6f06b1898ff661d9d227d34056da1f520487e99
Opcode Fuzzy Hash: 50bf2bd798dd79b378328ef1c7e29f86e0217dcecd2c3f51df139beccd9fa7eb
Instruction Fuzzy Hash: F4E01271001518BBE715AF55DC09EEA3B58DF40354F408029FD0956192DB796A55C6A8

Function 00433B69 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24COMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?), ref: 00433B8C
InterlockedExchange.KERNEL32(h;C,Function_00033AFF), ref: 00433BB4

Strings

h;C, xrefs: 00433BAF, 00433BBA

Memory Dump Source

Source File: 00000005.00000002.1722456807.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1722022141.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723561398.0000000000436000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000444000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000448000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1724304481.000000000044B000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_LetsPRO.jbxd

Similarity

API ID: ExchangeInterlockedVersion
String ID: h;C
API String ID: 2700998522-1793244312
Opcode ID: bd03a5d6949793b0eac306e159473fec640864326d9bc82e048d58b04f085e47
Instruction ID: 9385e4ec68a24ee53328ff75928e76a20124649d03c2be088ee5218a6657af5b
Opcode Fuzzy Hash: bd03a5d6949793b0eac306e159473fec640864326d9bc82e048d58b04f085e47
Instruction Fuzzy Hash: CAF037749002189FDB50EF64DD0675DB7B4EB09305F5190BAE50AD2253CF749E88CF09

Function 0042D482 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

APIs

__lock.LIBCMT ref: 0042D4A3

Part of subcall function 00425238: __mtinitlocknum.LIBCMT ref: 0042524C
Part of subcall function 00425238: __amsg_exit.LIBCMT ref: 00425258
Part of subcall function 00425238: EnterCriticalSection.KERNEL32(-0000000F,-0000000F,?,0041FC1F,00000004,00441010,0000000C,0042635F,00000004,00000004,00000000,00000000,00000000,00424C6E,00000001,00000214), ref: 00425260

EnterCriticalSection.KERNEL32(?,00000000,0042FEE7,00000040,00441520,0000000C,0042DAA6,00000000,?), ref: 0042D4B6

Strings

hdD, xrefs: 0042D490

Memory Dump Source

Source File: 00000005.00000002.1722456807.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1722022141.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723561398.0000000000436000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000444000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000448000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1724304481.000000000044B000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_LetsPRO.jbxd

Similarity

API ID: CriticalEnterSection$__amsg_exit__lock__mtinitlocknum
String ID: hdD
API String ID: 3996875869-3383060640
Opcode ID: 1f622785268acd552b80633e4b0ccfe39dbe0f0505f3c5cf319ba54229dd82f7
Instruction ID: db911717914fc9c371b4392fa992577b4860e12cd593728289a35ebaa2dcff0f
Opcode Fuzzy Hash: 1f622785268acd552b80633e4b0ccfe39dbe0f0505f3c5cf319ba54229dd82f7
Instruction Fuzzy Hash: 04D0CD32F04231579F243128784528EA754DB05270347C55FFCC666280C67D6C804AED

Function 0040686A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 18networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00410C11: __EH_prolog3_catch.LIBCMT ref: 00410C18

WSACleanup.WS2_32 ref: 00406891
FreeLibrary.KERNEL32(?,?,?,Function_00006855), ref: 0040689A

Strings

7M, xrefs: 00406870

Memory Dump Source

Source File: 00000005.00000002.1722456807.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1722022141.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723561398.0000000000436000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000444000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000448000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1724304481.000000000044B000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_LetsPRO.jbxd

Similarity

API ID: CleanupFreeH_prolog3_catchLibrary
String ID: 7M
API String ID: 1589224113-2086340997
Opcode ID: 8fb3e4aeb764626a6b32352ca1483c914ba6e49e02fcff9fa3947c41840ae5de
Instruction ID: 8ad376f1dbf54e360afe849f3b59e3ec438efcaa94a8302017a8168a35db8b36
Opcode Fuzzy Hash: 8fb3e4aeb764626a6b32352ca1483c914ba6e49e02fcff9fa3947c41840ae5de
Instruction Fuzzy Hash: 9FE04632001612DBDB362B09E80879636A09F40325F12C03B986B695E0C7BC98E0CF5A

Function 0040971E Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 9COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 00409732

Part of subcall function 00421117: RaiseException.KERNEL32(?,?,00000008,?), ref: 00421157

Strings

mD, xrefs: 00409727
mD, xrefs: 0040972B

Memory Dump Source

Source File: 00000005.00000002.1722456807.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1722022141.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723561398.0000000000436000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000444000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000448000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1724304481.000000000044B000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_LetsPRO.jbxd

Similarity

API ID: ExceptionException@8RaiseThrow
String ID: mD$ mD
API String ID: 3976011213-4248300037
Opcode ID: d7b7b45a3bab2f0644710810d0cb950b72e299e16b4ec5f129513fe013df295d
Instruction ID: 424005e5f711a86c1dda7cd5a16bd7671ca7ea0ed70993597897f0ac09a491ec
Opcode Fuzzy Hash: d7b7b45a3bab2f0644710810d0cb950b72e299e16b4ec5f129513fe013df295d
Instruction Fuzzy Hash: 91C09BB4D0020CBB5704D7C6DD07D5DFAEC9A09754F604056E70093102E7F86F045669

Function 0041101A Relevance: 5.1, APIs: 4, Instructions: 60COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 00411077
LeaveCriticalSection.KERNEL32(?,?), ref: 00411087
LocalFree.KERNEL32(?), ref: 00411090
TlsSetValue.KERNEL32(?,00000000), ref: 004110A2

Memory Dump Source

Source File: 00000005.00000002.1722456807.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1722022141.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723561398.0000000000436000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000444000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000448000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1724304481.000000000044B000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_LetsPRO.jbxd

Similarity

API ID: CriticalSection$EnterFreeLeaveLocalValue
String ID:
API String ID: 2949335588-0
Opcode ID: 011e73fcab51d9f97b90f4f5c2b20dedc33d675dbf62a00de958a34d7cc0e362
Instruction ID: c6b2df5b204db0b7b57362f5b95f8c7b5503a1dc12c11ff70db35c08e8e68cc3
Opcode Fuzzy Hash: 011e73fcab51d9f97b90f4f5c2b20dedc33d675dbf62a00de958a34d7cc0e362
Instruction Fuzzy Hash: 02118E31A00605EFD714DF54D884F9ABBB4FF09355F10806EE64287AB1CB75A8C0CB54

Function 00412E3C Relevance: 5.0, APIs: 4, Instructions: 37COMMONLIBRARYCODE

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00448A20,?,?,?,00000000,00410C2C,00000010,00000008,004104E6,00410489,004047EE,00405A03,?,?,00401564), ref: 00412E78
InitializeCriticalSection.KERNEL32(1A1A596F,?,?,?,00000000,00410C2C,00000010,00000008,004104E6,00410489,004047EE,00405A03,?,?,00401564), ref: 00412E87
LeaveCriticalSection.KERNEL32(00448A20,?,?,?,00000000,00410C2C,00000010,00000008,004104E6,00410489,004047EE,00405A03,?,?,00401564), ref: 00412E94
EnterCriticalSection.KERNEL32(1A1A596F,?,?,?,00000000,00410C2C,00000010,00000008,004104E6,00410489,004047EE,00405A03,?,?,00401564), ref: 00412EA0

Part of subcall function 004047D4: __CxxThrowException@8.LIBCMT ref: 004047E8
Part of subcall function 004047D4: __EH_prolog3.LIBCMT ref: 004047F5

Memory Dump Source

Source File: 00000005.00000002.1722456807.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1722022141.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723561398.0000000000436000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000444000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000448000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1724304481.000000000044B000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_LetsPRO.jbxd

Similarity

API ID: CriticalSection$Enter$Exception@8H_prolog3InitializeLeaveThrow
String ID:
API String ID: 2895727460-0
Opcode ID: 9f94173e4b4b48543ff8a5a79e710f272e7b9f2ef5d17a07924fd465bc42a9c4
Instruction ID: 7aeea641f90c5084b6422e07a61dba14237952717d1af914249aa2cc8ef23968
Opcode Fuzzy Hash: 9f94173e4b4b48543ff8a5a79e710f272e7b9f2ef5d17a07924fd465bc42a9c4
Instruction Fuzzy Hash: 64F0F073600209ABDE102B18ED45B9AB76AEB92355F46102FE14093251DFB984808A6D

Function 00410BAA Relevance: 5.0, APIs: 4, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(0000001C,00000000,?,?,0041116F,?,00000004,004104C7,004047EE,00405A03,?,?,00401564), ref: 00410BB3
TlsGetValue.KERNEL32(00000000,?,?,0041116F,?,00000004,004104C7,004047EE,00405A03,?,?,00401564), ref: 00410BC8
LeaveCriticalSection.KERNEL32(0000001C,?,?,0041116F,?,00000004,004104C7,004047EE,00405A03,?,?,00401564), ref: 00410BDE
LeaveCriticalSection.KERNEL32(0000001C,?,?,0041116F,?,00000004,004104C7,004047EE,00405A03,?,?,00401564), ref: 00410BE9

Memory Dump Source

Source File: 00000005.00000002.1722456807.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1722022141.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723561398.0000000000436000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000444000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1723685337.0000000000448000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1724304481.000000000044B000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_LetsPRO.jbxd

Similarity

API ID: CriticalSection$Leave$EnterValue
String ID:
API String ID: 3969253408-0
Opcode ID: 6ac16fc4d48cfe9ea7bea7421d0f0fc9b6a646f011049c58f0492536ac54ab44
Instruction ID: 0cc9ac87ec18164dd1729375a6fa1bb96596cb2d61f8493cbc3dc492704a56cd
Opcode Fuzzy Hash: 6ac16fc4d48cfe9ea7bea7421d0f0fc9b6a646f011049c58f0492536ac54ab44
Instruction Fuzzy Hash: 4EF082363086029FC7209FA8DC88C5B73EDEF85359317986BE40697211C7B4F885CB64

Analysis Process: wegame.exePID: 7800, Parent PID: 1044COMMON

Execution Graph

Execution Coverage:	5.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	12.8%
Total number of Nodes:	2000
Total number of Limit Nodes:	121

Executed Functions

Function 004660C6 Relevance: 209.4, APIs: 80, Strings: 39, Instructions: 1190stringsynchronizationwindowCOMMON

Download Yara Rule

APIs

__EH_prolog3_catch_GS.LIBCMT ref: 004660D0
GetCommandLineW.KERNEL32(000001A8), ref: 004660E7
SimpleUString::operator=.MSOBJ140-MSVCRT ref: 00466132

Part of subcall function 00456777: __EH_prolog3_GS.LIBCMT ref: 00456781
Part of subcall function 00456777: memset.VCRUNTIME140(?,00000000,00000208,00000254), ref: 00456805
Part of subcall function 00456777: GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 0045681A
Part of subcall function 00456777: SimpleUString::operator=.MSOBJ140-MSVCRT ref: 0045682D
Part of subcall function 00456777: wcsrchr.VCRUNTIME140(?,0000005C), ref: 0045683B
Part of subcall function 00456777: SimpleUString::operator=.MSOBJ140-MSVCRT ref: 00456852
Part of subcall function 00456777: SimpleUString::operator=.MSOBJ140-MSVCRT ref: 00456869

Part of subcall function 00420F10: memcpy.VCRUNTIME140(00000000,00000000,00000000,004204D1,00000000,00000000,00000000,?,00423FD2,00000000,00000001), ref: 00420F37

MessageBoxA.USER32(00000000,debug,debug,00000000), ref: 0046615B
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,stamp_record), ref: 0046616E
?stamp_init@@YAXXZ.COMMON(?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00466179
?stamp_point@@YAXPBD@Z.COMMON(main_start), ref: 00466183
?get_log_instance@base@@YAPAVILogger@1@XZ.COMMON ref: 00466189
?u16to8@common@ierd_tgp@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@4@@Z.COMMON(?,?), ref: 00466217
?get_client_id@util_client_info@ierd_tgp@@YAHXZ.COMMON(wegame.exe,0000000A), ref: 00466263
?extract_op_from_cmd@Sys_wrapper@common@ierd_tgp@@SA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PAV45@@Z.COMMON(?,?,multi_launcher,0000000E,wegame.exe,0000000A), ref: 004662C4
?get_process_count@util_multi_instance@ierd_tgp@@YAHPBD@Z.COMMON(?,multi_launcher,0000000E,wegame.exe,0000000A), ref: 004662E3
?set_same_client_type_multi_instance@util_multi_instance@ierd_tgp@@YAX_N@Z.COMMON(00000001,multi_launcher,0000000E,wegame.exe,0000000A), ref: 004662EF
?get_qos_instance@qos@adapt_for_imports@ierd_tgp@@YAAAVQos@123@XZ.COMMON(multi_launcher,0000000E,wegame.exe,0000000A), ref: 004662F5
?SetIsMultiInstance@Qos@qos@adapt_for_imports@ierd_tgp@@QAEX_N@Z.COMMON(00000001,multi_launcher,0000000E,wegame.exe,0000000A), ref: 004662FD

Part of subcall function 00420D40: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,0043DEC9,F69FE839,?,?,?,0046D880,000000FF,?,0043DE1E,F69FE839,?,?,?,0046D82F,000000FF), ref: 00420D85

Part of subcall function 0040BC90: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,0040E9C2,?,?), ref: 0040BCDD

?get_coexist_name@util_multi_instance@ierd_tgp@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PBD@Z.COMMON(?,_TGP_EXISTS_MUTEX_NAME_), ref: 00466337
OutputDebugStringA.KERNEL32(?), ref: 00466357
CreateMutexA.KERNEL32(00000000,00000001,?), ref: 0046637F
GetLastError.KERNEL32 ref: 004663A0
?get_coexist_name@util_multi_instance@ierd_tgp@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PBD@Z.COMMON(?,31F73356-9B60-4B52-9FF0-F27E3A9BBEC2), ref: 004663BA
OpenEventA.KERNEL32(001F0003,00000000,?), ref: 004663D7
SetEvent.KERNEL32(00000000), ref: 004663E4
CloseHandle.KERNEL32(00000000), ref: 004663F1
CloseHandle.KERNEL32(?), ref: 00466402
?get_log_instance@base@@YAPAVILogger@1@XZ.COMMON ref: 00466409
GetCurrentProcess.KERNEL32(00000000), ref: 00466463
TerminateProcess.KERNEL32(00000000), ref: 0046646A

Strings

start_from_host, xrefs: 00466611, 00466663
[main] wegame already exist., xrefs: 00466444
wegamex.exe, xrefs: 0046626E
e:\dailybuild_fix_5.4\wegame_client\codes\main\tgp_daemon\src\tgp_daemon_main.cpp, xrefs: 004661AD, 0046642D, 00466928, 004669DB, 00466A22, 00466A7F, 00466B36, 00466B8A, 00466C52, 00466D33, 00466DD7, 00466E42, 00466F18, 00466F7E, 00466FE2
gCH, xrefs: 0046681B
--debug, xrefs: 004660FF
[CleanCache] need clean page cache., xrefs: 00466D4A
wegame.exe, xrefs: 00466252
", xrefs: 00467040
offline=, xrefs: 004666DC
offline, xrefs: 0046672F
delete_qb_cookies.txt, xrefs: 00466CA1, 00466CB7
ierd_tgp_daemon.exe, xrefs: 00466E85
stamp_record, xrefs: 00466166
_TGP_EXISTS_MUTEX_NAME_, xrefs: 0046632B
game_id, xrefs: 004668D7, 004668E8
[main]get and set cmd info from cmd_start_info successfully, xrefs: 00466C69
[main]WeGame is in tool mode., xrefs: 00466DF3
[Sys_wrapper]initialize COM library. Error code = %x, xrefs: 00466E5F
[wegame_launch][step2]App inited., xrefs: 00466F2F
31F73356-9B60-4B52-9FF0-F27E3A9BBEC2, xrefs: 004663B1
multi_launcher, xrefs: 004662AB
uin=, xrefs: 00466562
[Launcher]Command line game_id not find., xrefs: 00466944
main_start, xrefs: 0046617E
launcher_ver, xrefs: 00466962, 00466973
app inited, xrefs: 00466F4E
-launcher=, xrefs: 004667EF
[Launcher]Command line version not find., xrefs: 004669F7
[Launcher]Parser launcher command json fail., xrefs: 00466A3E
debug, xrefs: 00466153, 00466158, 00466159
normal end., xrefs: 00466FF9
-multi_launcher=, xrefs: 00466229
[Launcher]Launcher info: %s, xrefs: 00466AA6
[wegame_launch][step1]Main start., xrefs: 004661C9
[Launcher]Launcher parser fail: %s, xrefs: 00466B59
[Launcher]No launcher info., xrefs: 00466BA1
begin..., xrefs: 00466F95
gCH, xrefs: 00466BF5

Memory Dump Source

Source File: 00000006.00000002.4137209488.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.4137156906.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137406249.0000000000476000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137497400.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137574844.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137626631.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137684215.00000000004A3000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_wegame.jbxd

Similarity

API ID: D@std@@SimpleString::operator=U?$char_traits@V?$allocator@V?$basic_string@$D@2@@std@@$?get_coexist_name@util_multi_instance@ierd_tgp@@?get_log_instance@base@@CloseEventHandleLogger@1@Process_invalid_parameter_noinfo_noreturn$?extract_op_from_cmd@?get_client_id@util_client_info@ierd_tgp@@?get_process_count@util_multi_instance@ierd_tgp@@?get_qos_instance@qos@adapt_for_imports@ierd_tgp@@?set_same_client_type_multi_instance@util_multi_instance@ierd_tgp@@?stamp_init@@?stamp_point@@?u16to8@common@ierd_tgp@@CommandCreateCurrentD@2@@4@@DebugErrorFileH_prolog3_H_prolog3_catch_Instance@LastLineMessageModuleMultiMutexNameOpenOutputQos@123@Qos@qos@adapt_for_imports@ierd_tgp@@StringSys_wrapper@common@ierd_tgp@@TerminateU?$char_traits@_V45@@V?$allocator@_V?$basic_string@_W@2@@std@@W@std@@memcpymemsetstrcmpwcsrchr
String ID: "$--debug$-launcher=$-multi_launcher=$31F73356-9B60-4B52-9FF0-F27E3A9BBEC2$[CleanCache] need clean page cache.$[Launcher]Command line game_id not find.$[Launcher]Command line version not find.$[Launcher]Launcher info: %s$[Launcher]Launcher parser fail: %s$[Launcher]No launcher info.$[Launcher]Parser launcher command json fail.$[Sys_wrapper]initialize COM library. Error code = %x$[main] wegame already exist.$[main]WeGame is in tool mode.$[main]get and set cmd info from cmd_start_info successfully$[wegame_launch][step1]Main start.$[wegame_launch][step2]App inited.$_TGP_EXISTS_MUTEX_NAME_$app inited$begin...$debug$delete_qb_cookies.txt$e:\dailybuild_fix_5.4\wegame_client\codes\main\tgp_daemon\src\tgp_daemon_main.cpp$gCH$gCH$game_id$ierd_tgp_daemon.exe$launcher_ver$main_start$multi_launcher$normal end.$offline$offline=$stamp_record$start_from_host$uin=$wegame.exe$wegamex.exe
API String ID: 2001937073-2272416485
Opcode ID: bc6ff527e56626c5cfc26e1ba288837b056eb98a7f00c717793725bbef734f26
Instruction ID: d0d91c82970682349ed0ca60bb0f3fa7b064013dd67f67c3cd00920e2f9273f7
Opcode Fuzzy Hash: bc6ff527e56626c5cfc26e1ba288837b056eb98a7f00c717793725bbef734f26
Instruction Fuzzy Hash: C1A2E730D04248EEDF10EBA5CC55BDEBB75AF15308F64809EE04977282EB785E45CB6A

Function 0045D537 Relevance: 59.7, APIs: 30, Strings: 4, Instructions: 245
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3_catch_GS.LIBCMT ref: 0045D541

Part of subcall function 00451621: __EH_prolog3.LIBCMT ref: 00451628

Part of subcall function 00420F10: memcpy.VCRUNTIME140(00000000,00000000,00000000,004204D1,00000000,00000000,00000000,?,00423FD2,00000000,00000001), ref: 00420F37

?get_cfg_by_path@common@ierd_tgp@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAV?$basic_ptree@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@property_tree@boost@@_N@Z.COMMON(?,?,00000000,qos.id,00000006,000000EC,00452A2A), ref: 0045D59A
?get_qos_instance@qos@adapt_for_imports@ierd_tgp@@YAAAVQos@123@XZ.COMMON ref: 0045D65D
?set_qos_id@Qos@qos@adapt_for_imports@ierd_tgp@@QAEXK@Z.COMMON(00000B57), ref: 0045D665
?get_qos_instance@qos@adapt_for_imports@ierd_tgp@@YAAAVQos@123@XZ.COMMON(00000B57), ref: 0045D66A
?set_ver@Qos@qos@adapt_for_imports@ierd_tgp@@QAEXABUversion_t@common@4@@Z.COMMON(00000000), ref: 0045D68A
?get_qos_instance@qos@adapt_for_imports@ierd_tgp@@YAAAVQos@123@XZ.COMMON(00000000), ref: 0045D68F
?get_machine_id@Application@common@ierd_tgp@@SA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ.COMMON(?,00000000), ref: 0045D69A
?set_machine_id@Qos@qos@adapt_for_imports@ierd_tgp@@QAEXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z.COMMON(00000000,00000000), ref: 0045D6A7
?get_qos_instance@qos@adapt_for_imports@ierd_tgp@@YAAAVQos@123@XZ.COMMON(00000000,00000000), ref: 0045D6B7
?set_qm_report_guid@Qos@qos@adapt_for_imports@ierd_tgp@@QAEXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z.COMMON(?,0047A300,00000002,00000000,00000000), ref: 0045D6E6
?set_machine_guid_async@Application@common@ierd_tgp@@SAXXZ.COMMON(?,0047A300,00000002,00000000,00000000), ref: 0045D6F6
?get_qos_instance@qos@adapt_for_imports@ierd_tgp@@YAAAVQos@123@XZ.COMMON(?,0047A300,00000002,00000000,00000000), ref: 0045D6FB
?get_session_id@Application@common@ierd_tgp@@QAE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ.COMMON(?,?,0047A300,00000002,00000000,00000000), ref: 0045D70C
?set_session_id@Qos@qos@adapt_for_imports@ierd_tgp@@QAEXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z.COMMON(00000000,?,?,0047A300,00000002,00000000,00000000), ref: 0045D718
?get_qos_instance@qos@adapt_for_imports@ierd_tgp@@YAAAVQos@123@XZ.COMMON(00000000,?,?,0047A300,00000002,00000000,00000000), ref: 0045D728
?get_client_id@util_client_info@ierd_tgp@@YAHXZ.COMMON(00000000,?,?,0047A300,00000002,00000000,00000000), ref: 0045D72F
?set_client_version_type@Qos@qos@adapt_for_imports@ierd_tgp@@QAEXH@Z.COMMON(00000000,00000000,?,?,0047A300,00000002,00000000,00000000), ref: 0045D737
?GetLastLoginedUin@common@ierd_tgp@@YA_KXZ.COMMON(00000000,00000000,?,?,0047A300,00000002,00000000,00000000), ref: 0045D73C
?get_qos_instance@qos@adapt_for_imports@ierd_tgp@@YAAAVQos@123@XZ.COMMON(00000002,00000000,00000000), ref: 0045D765
?set_uid@Qos@qos@adapt_for_imports@ierd_tgp@@QAEXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z.COMMON(?,00000002,00000000,00000000), ref: 0045D770

Part of subcall function 0044CEF7: __EH_prolog3.LIBCMT ref: 0044CEFE
Part of subcall function 0044CEF7: ?_Init@locale@std@@CAPAV_Locimp@12@_N@Z.MSVCP140(00000001,?,?,?,?,00000008), ref: 0044CF15

Part of subcall function 00420F10: memcpy.VCRUNTIME140(00000000,00000000,00000000,004204D1,00000000,00000000,00000000,?,00423FD2,00000000,00000001), ref: 00420FDB

Part of subcall function 0044D17C: __EH_prolog3_GS.LIBCMT ref: 0044D183
Part of subcall function 0044D17C: ?get_cfg_by_path@common@ierd_tgp@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAV?$basic_ptree@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@property_tree@boost@@_N@Z.COMMON(?,00000008,00000000,0000006C,00000000,bool __thiscall boost::property_tree::basic_ptree<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,struct std::less<class std::basic_,e:\dailybuild_fix_5.4\wegame_client\dependences\boost_1_67_0\boost\property_tree\detail\ptree_implementation.hpp,000002A0,?,00000008,00000000,int __thiscall boost::property_tree::basic_ptree<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,struct std::less<class std::basic_s,e:\dailybuild_fix_5.4\wegame_client\dependences\boost_1_67_0\boost\property_tree\detail\ptree_implementation.hpp,000002A0), ref: 0044D1A2
Part of subcall function 0044D17C: ?get_log_instance@base@@YAPAVILogger@1@XZ.COMMON(bool __thiscall boost::property_tree::basic_ptree<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,struct std::less<class std::basic_,e:\dailybuild_fix_5.4\wegame_client\dependences\boost_1_67_0\boost\property_tree\detail\ptree_implementation.hpp,000002A0,?,00000008,00000000,int __thiscall boost::property_tree::basic_ptree<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,struct std::less<class std::basic_s,e:\dailybuild_fix_5.4\wegame_client\dependences\boost_1_67_0\boost\property_tree\detail\ptree_implementation.hpp,000002A0), ref: 0044D1AE

?get_exe_path_ex@Application@common@ierd_tgp@@SA?AVpath@filesystem@3@XZ.COMMON(?), ref: 0045D805
?parent_path@path@filesystem@ierd_tgp@@QBE?AV123@XZ.COMMON(?), ref: 0045D815

Part of subcall function 00466016: __EH_prolog3.LIBCMT ref: 0046601D

Part of subcall function 00456CF6: __EH_prolog3_GS.LIBCMT ref: 00456CFD
Part of subcall function 00456CF6: ?get_log_instance@base@@YAPAVILogger@1@XZ.COMMON(00000050,0045D833,00000000,?,?), ref: 00456D2D

Part of subcall function 0040BC90: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,0040E9C2,?,?), ref: 0040BCDD

?get_qos_instance@qos@adapt_for_imports@ierd_tgp@@YAAAVQos@123@XZ.COMMON(?,?), ref: 0045D864
?set_channel_id@Qos@qos@adapt_for_imports@ierd_tgp@@QAEXABH@Z.COMMON(00000000), ref: 0045D872
?get_qos_instance@qos@adapt_for_imports@ierd_tgp@@YAAAVQos@123@XZ.COMMON(00000000), ref: 0045D877
?set_bind_game_id@Qos@qos@adapt_for_imports@ierd_tgp@@QAEXAB_K@Z.COMMON(?,00000000), ref: 0045D894
?extract_op_from_cmd@Sys_wrapper@common@ierd_tgp@@SA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PAH@Z.COMMON(?,?,StartFor,00000008,?,00000000), ref: 0045D8CC
?get_qos_instance@qos@adapt_for_imports@ierd_tgp@@YAAAVQos@123@XZ.COMMON(StartFor,00000008,?,00000000), ref: 0045D8DF
?SetStartForID@Qos@qos@adapt_for_imports@ierd_tgp@@QAEX_K@Z.COMMON(?,?,StartFor,00000008,?,00000000), ref: 0045D8EF

Strings

StartFor, xrefs: 0045D8B0
initial.bind_by_game.game_id, xrefs: 0045D7D9
qos.id, xrefs: 0045D580
initial.bind_by_game.channel_id, xrefs: 0045D797

Memory Dump Source

Source File: 00000006.00000002.4137209488.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.4137156906.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137406249.0000000000476000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137497400.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137574844.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137626631.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137684215.00000000004A3000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_wegame.jbxd

Similarity

API ID: D@std@@U?$char_traits@V?$allocator@V?$basic_string@$?get_qos_instance@qos@adapt_for_imports@ierd_tgp@@Qos@123@Qos@qos@adapt_for_imports@ierd_tgp@@$D@2@@std@@$Application@common@ierd_tgp@@D@2@@std@@@$H_prolog3$?get_cfg_by_path@common@ierd_tgp@@?get_log_instance@base@@D@2@@std@@@2@@property_tree@boost@@_H_prolog3_Logger@1@U?$less@V12@V?$basic_ptree@memcpy$?extract_op_from_cmd@?get_client_id@util_client_info@ierd_tgp@@?get_exe_path_ex@?get_machine_id@?get_session_id@?parent_path@path@filesystem@ierd_tgp@@?set_bind_game_id@?set_channel_id@?set_client_version_type@?set_machine_guid_async@?set_machine_id@?set_qm_report_guid@?set_qos_id@?set_session_id@?set_uid@?set_ver@H_prolog3_catch_Init@locale@std@@LastLocimp@12@_LoginedStartSys_wrapper@common@ierd_tgp@@Uin@common@ierd_tgp@@Uversion_t@common@4@@V123@Vpath@filesystem@3@_invalid_parameter_noinfo_noreturn
String ID: StartFor$initial.bind_by_game.channel_id$initial.bind_by_game.game_id$qos.id
API String ID: 2008230459-2812686160
Opcode ID: 5321205c7a1076dccaa0de173bca92a47cf936ff173197c28a633a7614193f5e
Instruction ID: 5becb8b44b71cd4b35533b1b7b2d51a3f3d6f783a7d0048e2dc5001f69840116
Opcode Fuzzy Hash: 5321205c7a1076dccaa0de173bca92a47cf936ff173197c28a633a7614193f5e
Instruction Fuzzy Hash: 55A18271D04258DADB10EFBDC851BDDBBB46F14308F5484AEE009B7282EB784B49CB66

Function 0045D63F Relevance: 54.5, APIs: 28, Strings: 3, Instructions: 207
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

?get_qos_instance@qos@adapt_for_imports@ierd_tgp@@YAAAVQos@123@XZ.COMMON ref: 0045D65D
?set_qos_id@Qos@qos@adapt_for_imports@ierd_tgp@@QAEXK@Z.COMMON(00000B57), ref: 0045D665
?get_qos_instance@qos@adapt_for_imports@ierd_tgp@@YAAAVQos@123@XZ.COMMON(00000B57), ref: 0045D66A
?set_ver@Qos@qos@adapt_for_imports@ierd_tgp@@QAEXABUversion_t@common@4@@Z.COMMON(00000000), ref: 0045D68A
?get_qos_instance@qos@adapt_for_imports@ierd_tgp@@YAAAVQos@123@XZ.COMMON(00000000), ref: 0045D68F
?get_machine_id@Application@common@ierd_tgp@@SA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ.COMMON(?,00000000), ref: 0045D69A
?set_machine_id@Qos@qos@adapt_for_imports@ierd_tgp@@QAEXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z.COMMON(00000000,00000000), ref: 0045D6A7
?get_qos_instance@qos@adapt_for_imports@ierd_tgp@@YAAAVQos@123@XZ.COMMON(00000000,00000000), ref: 0045D6B7

Part of subcall function 00420F10: memcpy.VCRUNTIME140(00000000,00000000,00000000,004204D1,00000000,00000000,00000000,?,00423FD2,00000000,00000001), ref: 00420F37

?set_qm_report_guid@Qos@qos@adapt_for_imports@ierd_tgp@@QAEXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z.COMMON(?,0047A300,00000002,00000000,00000000), ref: 0045D6E6

Part of subcall function 00420D40: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,0043DEC9,F69FE839,?,?,?,0046D880,000000FF,?,0043DE1E,F69FE839,?,?,?,0046D82F,000000FF), ref: 00420D85

?set_machine_guid_async@Application@common@ierd_tgp@@SAXXZ.COMMON(?,0047A300,00000002,00000000,00000000), ref: 0045D6F6
?get_qos_instance@qos@adapt_for_imports@ierd_tgp@@YAAAVQos@123@XZ.COMMON(?,0047A300,00000002,00000000,00000000), ref: 0045D6FB
?get_session_id@Application@common@ierd_tgp@@QAE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ.COMMON(?,?,0047A300,00000002,00000000,00000000), ref: 0045D70C
?set_session_id@Qos@qos@adapt_for_imports@ierd_tgp@@QAEXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z.COMMON(00000000,?,?,0047A300,00000002,00000000,00000000), ref: 0045D718
?get_qos_instance@qos@adapt_for_imports@ierd_tgp@@YAAAVQos@123@XZ.COMMON(00000000,?,?,0047A300,00000002,00000000,00000000), ref: 0045D728
?get_client_id@util_client_info@ierd_tgp@@YAHXZ.COMMON(00000000,?,?,0047A300,00000002,00000000,00000000), ref: 0045D72F
?set_client_version_type@Qos@qos@adapt_for_imports@ierd_tgp@@QAEXH@Z.COMMON(00000000,00000000,?,?,0047A300,00000002,00000000,00000000), ref: 0045D737
?GetLastLoginedUin@common@ierd_tgp@@YA_KXZ.COMMON(00000000,00000000,?,?,0047A300,00000002,00000000,00000000), ref: 0045D73C

Part of subcall function 0044D4E0: __EH_prolog3_GS.LIBCMT ref: 0044D4E7

?get_qos_instance@qos@adapt_for_imports@ierd_tgp@@YAAAVQos@123@XZ.COMMON(00000002,00000000,00000000), ref: 0045D765
?set_uid@Qos@qos@adapt_for_imports@ierd_tgp@@QAEXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z.COMMON(?,00000002,00000000,00000000), ref: 0045D770

Part of subcall function 00420F10: memcpy.VCRUNTIME140(00000000,00000000,00000000,004204D1,00000000,00000000,00000000,?,00423FD2,00000000,00000001), ref: 00420FDB

Part of subcall function 0044D17C: __EH_prolog3_GS.LIBCMT ref: 0044D183
Part of subcall function 0044D17C: ?get_cfg_by_path@common@ierd_tgp@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAV?$basic_ptree@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@property_tree@boost@@_N@Z.COMMON(?,00000008,00000000,0000006C,00000000,bool __thiscall boost::property_tree::basic_ptree<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,struct std::less<class std::basic_,e:\dailybuild_fix_5.4\wegame_client\dependences\boost_1_67_0\boost\property_tree\detail\ptree_implementation.hpp,000002A0,?,00000008,00000000,int __thiscall boost::property_tree::basic_ptree<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,struct std::less<class std::basic_s,e:\dailybuild_fix_5.4\wegame_client\dependences\boost_1_67_0\boost\property_tree\detail\ptree_implementation.hpp,000002A0), ref: 0044D1A2
Part of subcall function 0044D17C: ?get_log_instance@base@@YAPAVILogger@1@XZ.COMMON(bool __thiscall boost::property_tree::basic_ptree<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,struct std::less<class std::basic_,e:\dailybuild_fix_5.4\wegame_client\dependences\boost_1_67_0\boost\property_tree\detail\ptree_implementation.hpp,000002A0,?,00000008,00000000,int __thiscall boost::property_tree::basic_ptree<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,struct std::less<class std::basic_s,e:\dailybuild_fix_5.4\wegame_client\dependences\boost_1_67_0\boost\property_tree\detail\ptree_implementation.hpp,000002A0), ref: 0044D1AE

Part of subcall function 00420F10: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00421028

?get_exe_path_ex@Application@common@ierd_tgp@@SA?AVpath@filesystem@3@XZ.COMMON(?), ref: 0045D805
?parent_path@path@filesystem@ierd_tgp@@QBE?AV123@XZ.COMMON(?), ref: 0045D815

Part of subcall function 00466016: __EH_prolog3.LIBCMT ref: 0046601D

Part of subcall function 00456CF6: __EH_prolog3_GS.LIBCMT ref: 00456CFD
Part of subcall function 00456CF6: ?get_log_instance@base@@YAPAVILogger@1@XZ.COMMON(00000050,0045D833,00000000,?,?), ref: 00456D2D

Part of subcall function 0040BC90: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,0040E9C2,?,?), ref: 0040BCDD

?get_qos_instance@qos@adapt_for_imports@ierd_tgp@@YAAAVQos@123@XZ.COMMON(?,?), ref: 0045D864
?set_channel_id@Qos@qos@adapt_for_imports@ierd_tgp@@QAEXABH@Z.COMMON(00000000), ref: 0045D872
?get_qos_instance@qos@adapt_for_imports@ierd_tgp@@YAAAVQos@123@XZ.COMMON(00000000), ref: 0045D877
?set_bind_game_id@Qos@qos@adapt_for_imports@ierd_tgp@@QAEXAB_K@Z.COMMON(?,00000000), ref: 0045D894
?extract_op_from_cmd@Sys_wrapper@common@ierd_tgp@@SA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PAH@Z.COMMON(?,?,StartFor,00000008,?,00000000), ref: 0045D8CC
?get_qos_instance@qos@adapt_for_imports@ierd_tgp@@YAAAVQos@123@XZ.COMMON(StartFor,00000008,?,00000000), ref: 0045D8DF
?SetStartForID@Qos@qos@adapt_for_imports@ierd_tgp@@QAEX_K@Z.COMMON(?,?,StartFor,00000008,?,00000000), ref: 0045D8EF

Strings

StartFor, xrefs: 0045D8B0
initial.bind_by_game.game_id, xrefs: 0045D7D9
initial.bind_by_game.channel_id, xrefs: 0045D797

Memory Dump Source

Source File: 00000006.00000002.4137209488.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.4137156906.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137406249.0000000000476000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137497400.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137574844.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137626631.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137684215.00000000004A3000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_wegame.jbxd

Similarity

API ID: ?get_qos_instance@qos@adapt_for_imports@ierd_tgp@@D@std@@Qos@123@Qos@qos@adapt_for_imports@ierd_tgp@@U?$char_traits@V?$allocator@V?$basic_string@$D@2@@std@@$Application@common@ierd_tgp@@D@2@@std@@@$H_prolog3__invalid_parameter_noinfo_noreturn$?get_log_instance@base@@Logger@1@memcpy$?extract_op_from_cmd@?get_cfg_by_path@common@ierd_tgp@@?get_client_id@util_client_info@ierd_tgp@@?get_exe_path_ex@?get_machine_id@?get_session_id@?parent_path@path@filesystem@ierd_tgp@@?set_bind_game_id@?set_channel_id@?set_client_version_type@?set_machine_guid_async@?set_machine_id@?set_qm_report_guid@?set_qos_id@?set_session_id@?set_uid@?set_ver@D@2@@std@@@2@@property_tree@boost@@_H_prolog3LastLoginedStartSys_wrapper@common@ierd_tgp@@U?$less@Uin@common@ierd_tgp@@Uversion_t@common@4@@V123@V12@V?$basic_ptree@Vpath@filesystem@3@
String ID: StartFor$initial.bind_by_game.channel_id$initial.bind_by_game.game_id
API String ID: 893325230-1011178086
Opcode ID: 6cc8c8e7c9224462692659776a731de5ab7d84684394e0605f2dc4ab1be6e7b6
Instruction ID: 564fb639af7409ca49639e263f6824e57bd2def4a13c5142e371a78de71e931d
Opcode Fuzzy Hash: 6cc8c8e7c9224462692659776a731de5ab7d84684394e0605f2dc4ab1be6e7b6
Instruction Fuzzy Hash: 38818171D04258DADF14EBBDC951BDDBBB46F14318F5084DEE009B7282EA784B48CB6A

Function 6C614908 Relevance: 26.5, APIs: 14, Strings: 1, Instructions: 204fileCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6C614912
memset.VCRUNTIME140(?,00000000,00000100,00000C68,6C61424B,?,00000010,?), ref: 6C61494C
__snprintf_s.LIBCMT ref: 6C614965
CreateFileA.KERNEL32(?,00000000,00000003,00000000,00000003,00000000,00000000,?,?,?,00000C68,6C61424B,?,00000010,?), ref: 6C61497E
memset.VCRUNTIME140(?,00000000,0000000C), ref: 6C6149A1
memset.VCRUNTIME140(?,00000000,00000800,?,00000000,0000000C), ref: 6C6149C1
DeviceIoControl.KERNEL32(00000000,002D1400,?,0000000C,?,00000800,?,00000000), ref: 6C6149ED
memset.VCRUNTIME140(?,00000000,00000100,?,?,?,?,?,?,?,?,?,00000C68,6C61424B,?,00000010), ref: 6C614A09
memset.VCRUNTIME140(?,00000000,00000100,?,00000000,00000100,?,?,?,?,?,?,?,?,?,00000C68), ref: 6C614A1C
memset.VCRUNTIME140(?,00000000,00000100,?,00000000,00000100,?,00000000,00000100), ref: 6C614A2F
isalnum.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00000001,?), ref: 6C614A90
isalnum.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C614AA5
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,00000C68,6C61424B,?,00000010,?), ref: 6C614C03
FindCloseChangeNotification.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,00000C68,6C61424B,?,00000010,?), ref: 6C614C0A

Strings

\\.\PhysicalDrive%d, xrefs: 6C614952

Memory Dump Source

Source File: 00000006.00000002.4141448948.000000006C591000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000006.00000002.4141374342.000000006C590000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142318714.000000006C825000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142662450.000000006C906000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142732140.000000006C907000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142791681.000000006C909000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142876110.000000006C911000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142956827.000000006C913000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143044653.000000006C91D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143105643.000000006C925000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c590000_wegame.jbxd

Similarity

API ID: memset$isalnum$ChangeCloseControlCreateDeviceErrorFileFindH_prolog3_LastNotification__snprintf_s
String ID: \\.\PhysicalDrive%d
API String ID: 1220566445-2935326385
Opcode ID: 90a88d36d4ca59276ecf1d42ec091ef7daf46dbc6606d1c178ebde107efe1996
Instruction ID: ac69efa3ac8308eaccd7e25d653d5762a68abc3d6ea4b9db67d719b8abe33bb6
Opcode Fuzzy Hash: 90a88d36d4ca59276ecf1d42ec091ef7daf46dbc6606d1c178ebde107efe1996
Instruction Fuzzy Hash: 15817271D4021CAAEB25CF64CC88FEDB778BB05308F5446E9A519A3681EBB05BC9CF54

Function 0045CBDF Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 122fileCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0045CBE9
memset.VCRUNTIME140(?,00000000,00000208,000008D0,0045E025,00000070,00452C2B), ref: 0045CBFE
GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 0045CC14
?filename@path@filesystem@ierd_tgp@@QBE?AV123@XZ.COMMON(?,?), ref: 0045CC40

Part of subcall function 00466016: __EH_prolog3.LIBCMT ref: 0046601D

?parent_path@path@filesystem@ierd_tgp@@QBE?AV123@XZ.COMMON(?,?,?,?), ref: 0045CC73

Part of subcall function 0040BC90: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,0040E9C2,?,?), ref: 0040BCDD

memset.VCRUNTIME140(?,00000000,00000208,?,?,?,?,?), ref: 0045CCA2
FindFirstFileW.KERNEL32(?,?,?,00000000,00000208,?,?,?,?,?), ref: 0045CCF7
memset.VCRUNTIME140(?,00000000,0000020A), ref: 0045CD2B
wcsncpy_s.API-MS-WIN-CRT-STRING-L1-1-0(?,00000104,?,00000104,?,00000000,0000020A), ref: 0045CD40
wcsncat_s.API-MS-WIN-CRT-STRING-L1-1-0(?,00000104,0047AC50,00000103), ref: 0045CD54
DeleteFileW.KERNEL32(?), ref: 0045CD6A
MoveFileW.KERNEL32(?,?), ref: 0045CD7A
DeleteFileW.KERNEL32(?), ref: 0045CD87
FindClose.KERNEL32(00000000), ref: 0045CD8A

Strings

%s\log\browser_%s.log, xrefs: 0045CCD4

Memory Dump Source

Source File: 00000006.00000002.4137209488.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.4137156906.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137406249.0000000000476000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137497400.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137574844.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137626631.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137684215.00000000004A3000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_wegame.jbxd

Similarity

API ID: File$memset$DeleteFindV123@$?filename@path@filesystem@ierd_tgp@@?parent_path@path@filesystem@ierd_tgp@@CloseFirstH_prolog3H_prolog3_ModuleMoveName_invalid_parameter_noinfo_noreturnwcsncat_swcsncpy_s
String ID: %s\log\browser_%s.log
API String ID: 1354867775-396427173
Opcode ID: 4848fe2a05514b23659f8edeeec9fdfd54934637e026799a3e172bb449cf1a24
Instruction ID: 9171517c19ed65b418b23b122908f0452338bc3aab34387a5d6fe8e79bdf0085
Opcode Fuzzy Hash: 4848fe2a05514b23659f8edeeec9fdfd54934637e026799a3e172bb449cf1a24
Instruction Fuzzy Hash: 6A5113B180011C9EDF20DB61CD89BDEB7BDEB54314F4042EAA509A3191EB355F98CFA5

Function 6C61468C Relevance: 21.2, APIs: 10, Strings: 2, Instructions: 166fileCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6C614696
memset.VCRUNTIME140(?,00000000,00000100,000003B0,6C61421F,?,00000010,?), ref: 6C6146DC
__snprintf_s.LIBCMT ref: 6C6146F5
CreateFileA.KERNEL32(?,C0000000,00000003,00000000,00000003,00000000,00000000), ref: 6C614712
memset.VCRUNTIME140(?,00000000,00000018), ref: 6C614735
DeviceIoControl.KERNEL32(00000000,00074080,00000000,00000000,?,00000018,?,00000000), ref: 6C614756
memset.VCRUNTIME140(?,00000000,00000021), ref: 6C61478A
memset.VCRUNTIME140(?,00000000,00000210,?,00000000,00000021), ref: 6C61479D
DeviceIoControl.KERNEL32(00000000,0007C088,?,00000020,?), ref: 6C614809

Part of subcall function 6C614139: __EH_prolog3.LIBCMT ref: 6C614140

Part of subcall function 6C59A3A0: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,6C5A62D8,00000000,6C5A6649,00000003,9C33995A,?,?,00000000,6C7FF594,000000FF,?,6C5A5B05,00000000), ref: 6C59A3E5

FindCloseChangeNotification.KERNEL32(00000000), ref: 6C6148E6

Strings

., xrefs: 6C614818
\\.\PhysicalDrive%d, xrefs: 6C6146E2

Memory Dump Source

Source File: 00000006.00000002.4141448948.000000006C591000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000006.00000002.4141374342.000000006C590000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142318714.000000006C825000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142662450.000000006C906000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142732140.000000006C907000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142791681.000000006C909000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142876110.000000006C911000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142956827.000000006C913000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143044653.000000006C91D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143105643.000000006C925000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c590000_wegame.jbxd

Similarity

API ID: memset$ControlDevice$ChangeCloseCreateFileFindH_prolog3H_prolog3_Notification__snprintf_s_invalid_parameter_noinfo_noreturn
String ID: .$\\.\PhysicalDrive%d
API String ID: 1363808082-636426351
Opcode ID: fb1fb9f5a06865913a7df122e97dddcfd99a75155afb03620a892b9133962a51
Instruction ID: 89a5e15359662ef1afa3a53139e73dc72e641c8e54f3eb64da4bbf49e0665b25
Opcode Fuzzy Hash: fb1fb9f5a06865913a7df122e97dddcfd99a75155afb03620a892b9133962a51
Instruction Fuzzy Hash: 7851A371E4031CAFDB22CB64CC85BE973BCAB06318F4445D9A258A76C1D7B05F888F55

Function 00456E02 Relevance: 19.7, APIs: 13, Instructions: 171processCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00456E0C

Part of subcall function 0045A71E: __EH_prolog3_GS.LIBCMT ref: 0045A728
Part of subcall function 0045A71E: memset.VCRUNTIME140(?,00000000,00000208,00000214,004635F1,?,F69FE839,?,?,?,?,?,0047458B,000000FF), ref: 0045A74B
Part of subcall function 0045A71E: GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 0045A760
Part of subcall function 0045A71E: PathRemoveFileSpecW.SHLWAPI(?), ref: 0045A76D

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00456E86
Process32First.KERNEL32(00000000,?), ref: 00456EA8
memset.VCRUNTIME140(?,00000000,00000410), ref: 00456EBC
OpenProcess.KERNEL32(00000411,00000000,?), ref: 00456EDF
GetModuleFileNameExW.PSAPI(00000000,00000000,?,00000208), ref: 00456EFE
SimpleUString::operator=.MSOBJ140-MSVCRT ref: 00456F35
memset.VCRUNTIME140(?,00000000,00000208,?,?,?,?), ref: 00456F98
_wsplitpath_s.API-MS-WIN-CRT-FILESYSTEM-L1-1-0(?,00000000,00000000,00000000,00000000,?,00000104,00000000,00000000,?,00000000,00000208,?,?,?,?), ref: 00456FC6
SimpleUString::operator=.MSOBJ140-MSVCRT ref: 00457001
FindCloseChangeNotification.KERNEL32(00000000), ref: 00457072

Part of subcall function 0045B518: __EH_prolog3.LIBCMT ref: 0045B51F

Process32Next.KERNEL32(00000000,?), ref: 004570A4
FindCloseChangeNotification.KERNEL32(00000000), ref: 004570B2

Memory Dump Source

Source File: 00000006.00000002.4137209488.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.4137156906.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137406249.0000000000476000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137497400.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137574844.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137626631.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137684215.00000000004A3000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_wegame.jbxd

Similarity

API ID: Filememset$ChangeCloseFindH_prolog3_ModuleNameNotificationProcess32SimpleString::operator=$CreateFirstH_prolog3NextOpenPathProcessRemoveSnapshotSpecToolhelp32_wsplitpath_s
String ID:
API String ID: 1924654220-0
Opcode ID: 2160b164f31bf767b54a87ef085b19a49c4f79b9bfdfd2ea66254b63b9d068b2
Instruction ID: 08e5f9f804982dac9b178a665889140fceec4a43cadc06e42b251d5a2466d677
Opcode Fuzzy Hash: 2160b164f31bf767b54a87ef085b19a49c4f79b9bfdfd2ea66254b63b9d068b2
Instruction Fuzzy Hash: BB713E709052289EDB60DF64CC45BDDB3B9EB94309F4041EAE50CA3181EB366FA5CF55

Function 6C614FDF Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 115libraryloaderCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,00000104,6C924000,?,?,?,6C614FBE,?,?,?,6C616182,?,?,00000000,00000006), ref: 6C61500B
GetSystemDirectoryA.KERNEL32(?,00000104), ref: 6C61501B
PathAppendA.SHLWAPI(?,iphlpapi.dll), ref: 6C61502D
LoadLibraryA.KERNEL32(?), ref: 6C61503A
GetProcAddress.KERNEL32(00000000,GetAdaptersInfo), ref: 6C615059
GetAdaptersInfo.IPHLPAPI(?,?), ref: 6C61507F
memset.VCRUNTIME140(?,00000000,00000006,?), ref: 6C6150AC
FreeLibrary.KERNEL32(00000000), ref: 6C615130
memset.VCRUNTIME140(?,00000000,00000006), ref: 6C615141

Strings

iphlpapi.dll, xrefs: 6C615021
GetAdaptersInfo, xrefs: 6C615053

Memory Dump Source

Source File: 00000006.00000002.4141448948.000000006C591000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000006.00000002.4141374342.000000006C590000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142318714.000000006C825000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142662450.000000006C906000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142732140.000000006C907000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142791681.000000006C909000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142876110.000000006C911000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142956827.000000006C913000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143044653.000000006C91D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143105643.000000006C925000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c590000_wegame.jbxd

Similarity

API ID: memset$Library$AdaptersAddressAppendDirectoryFreeInfoLoadPathProcSystem
String ID: GetAdaptersInfo$iphlpapi.dll
API String ID: 3992280880-3114217049
Opcode ID: 687d68de85e1855b79041b99b3a1b6ceee506af063304408b78e602b82747e35
Instruction ID: d7beda679c5547ef34560b8e5170cfe80f47529bfa4b5aa6269d2fbbe4af466c
Opcode Fuzzy Hash: 687d68de85e1855b79041b99b3a1b6ceee506af063304408b78e602b82747e35
Instruction Fuzzy Hash: CA414D31A053449FCB21CFB88C48ADAFBB8AF07319F00549DD59D93B41D730AA84CBA4

Function 6C61722F Relevance: 16.0, APIs: 5, Strings: 4, Instructions: 205COMMON

Download Yara Rule

APIs

__EH_prolog3_catch_GS.LIBCMT ref: 6C617239
__Init_thread_footer.LIBCMT ref: 6C6175D0

Part of subcall function 6C5EF899: __EH_prolog3_catch.LIBCMT ref: 6C5EF8A0

GetAdaptersInfo.IPHLPAPI(?,?), ref: 6C6172D6
GetAdaptersInfo.IPHLPAPI(?,?), ref: 6C617301
?get_log_instance@base@@YAPAVILogger@1@XZ.COMMON(?,?,00000288,?,0000015C,6C5B75BA,?,?,?,?,?,00000004), ref: 6C61731E

Part of subcall function 6C5EE707: __EH_prolog3_catch.LIBCMT ref: 6C5EE70E

Part of subcall function 6C5A443B: memcpy.VCRUNTIME140(00000003,00000000,00000000,00000003,00000000,?,6C5A461F,00000000,00000003,00000003,?,00000000,00000000,?,?), ref: 6C5A444E

Strings

ecf4bbea1588, xrefs: 6C617286, 6C61737A, 6C61749C, 6C61755C, 6C6175B6
e:\dailybuild_fix_5.4\wegame_client\codes\common\src\machine_id.cpp, xrefs: 6C61733F
GetAdaptersInfo result is NULL!, xrefs: 6C617356
%02x, xrefs: 6C617395

Memory Dump Source

Source File: 00000006.00000002.4141448948.000000006C591000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000006.00000002.4141374342.000000006C590000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142318714.000000006C825000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142662450.000000006C906000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142732140.000000006C907000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142791681.000000006C909000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142876110.000000006C911000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142956827.000000006C913000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143044653.000000006C91D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143105643.000000006C925000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c590000_wegame.jbxd

Similarity

API ID: AdaptersH_prolog3_catchInfo$?get_log_instance@base@@H_prolog3_catch_Init_thread_footerLogger@1@memcpy
String ID: %02x$GetAdaptersInfo result is NULL!$e:\dailybuild_fix_5.4\wegame_client\codes\common\src\machine_id.cpp$ecf4bbea1588
API String ID: 3527561969-4040861699
Opcode ID: 22eced915c97ad9ba55dcc5ab8125110565f4409b57f0dd1a10b42632ba3971b
Instruction ID: d109b3ddf5e9f0b24527b2749f10bd287b0d0261c3f4e8a1c81347f656a03bc3
Opcode Fuzzy Hash: 22eced915c97ad9ba55dcc5ab8125110565f4409b57f0dd1a10b42632ba3971b
Instruction Fuzzy Hash: 66919C71909298DBCB21CFA9CD80ADDBBB5AF95309F1001E9D009A7B40DB306F89CF95

Function 6C5B6164 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 37encryptionCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6C5B616B
CryptAcquireContextW.ADVAPI32(?,00000000,00000000,00000001,F0000040,00000034,6C5B769A,0000001C,6C5B5A2D,?,?,?,000000D4,6C5B4690,?,?), ref: 6C5B6180
GetLastError.KERNEL32(?,00000000,00000000,00000001,F0000040,00000034,6C5B769A,0000001C,6C5B5A2D,?,?,?,000000D4,6C5B4690,?,?), ref: 6C5B6192

Strings

__thiscall boost::uuids::detail::random_provider_base::random_provider_base(void), xrefs: 6C5B61C3
CryptAcquireContext, xrefs: 6C5B6198
e:\dailybuild_fix_5.4\wegame_client\dependences\boost_1_67_0\boost\uuid\detail\random_provider_wincrypt.ipp, xrefs: 6C5B61BE

Memory Dump Source

Source File: 00000006.00000002.4141448948.000000006C591000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000006.00000002.4141374342.000000006C590000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142318714.000000006C825000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142662450.000000006C906000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142732140.000000006C907000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142791681.000000006C909000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142876110.000000006C911000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142956827.000000006C913000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143044653.000000006C91D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143105643.000000006C925000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c590000_wegame.jbxd

Similarity

API ID: AcquireContextCryptErrorH_prolog3_Last
String ID: CryptAcquireContext$__thiscall boost::uuids::detail::random_provider_base::random_provider_base(void)$e:\dailybuild_fix_5.4\wegame_client\dependences\boost_1_67_0\boost\uuid\detail\random_provider_wincrypt.ipp
API String ID: 2840587545-2099119014
Opcode ID: 6888fce435e19e59ba1552a77fd9c4b030ba5c3852226e9a6c83c14526653889
Instruction ID: 4f12e4f396b925a979ff66ca95896f17c3a5b61792728758e7d2e398a01b805f
Opcode Fuzzy Hash: 6888fce435e19e59ba1552a77fd9c4b030ba5c3852226e9a6c83c14526653889
Instruction Fuzzy Hash: DEF0F670545244AADF349B61CC0CFEE39789FC6704F840858F500B7684DF789D05C7A4

Function 6C7FE1F0 Relevance: 4.5, APIs: 3, Instructions: 26encryptionCOMMON

Download Yara Rule

APIs

CryptAcquireContextA.ADVAPI32(00000000,00000000,00000000,00000001,F0000000,?,?,6C7FC22D,?,00000000,?,00000000,00000000,?,00000000), ref: 6C7FE203
CryptGenRandom.ADVAPI32(00000000,?,00000000,?,6C7FC22D,?,00000000,?,00000000,00000000,?,00000000), ref: 6C7FE21A
CryptReleaseContext.ADVAPI32(00000000,00000000,?,6C7FC22D,?,00000000,?,00000000,00000000,?,00000000), ref: 6C7FE225

Memory Dump Source

Source File: 00000006.00000002.4141448948.000000006C591000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000006.00000002.4141374342.000000006C590000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142318714.000000006C825000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142662450.000000006C906000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142732140.000000006C907000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142791681.000000006C909000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142876110.000000006C911000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142956827.000000006C913000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143044653.000000006C91D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143105643.000000006C925000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c590000_wegame.jbxd

Similarity

API ID: Crypt$Context$AcquireRandomRelease
String ID:
API String ID: 1815803762-0
Opcode ID: 9929c02da0481738ab3c10546a86928b7f6c13c9dd8a53f2ec296c19923c3d64
Instruction ID: f2fd57bed773793b0d298b61544cfb36b54ecdc6ebd2037da5cd9b9a5928f371
Opcode Fuzzy Hash: 9929c02da0481738ab3c10546a86928b7f6c13c9dd8a53f2ec296c19923c3d64
Instruction Fuzzy Hash: 2AE0123168420CBBDF208E90CC0AF9CBB39EB05715F1081A5FE0995190E7765A10A7D4

Function 004595D0 Relevance: 127.0, APIs: 41, Strings: 31, Instructions: 979
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3_GS.LIBCMT ref: 004595DA
GetCommandLineW.KERNEL32(000001A4,00452A3D), ref: 004595EB
?u16to8@common@ierd_tgp@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@4@@Z.COMMON(?,?), ref: 00459620
?get_log_instance@base@@YAPAVILogger@1@XZ.COMMON ref: 00459627
GetCommandLineW.KERNEL32(?), ref: 0045968E
CommandLineToArgvW.SHELL32(00000000), ref: 00459691
wcscmp.API-MS-WIN-CRT-STRING-L1-1-0(0047A64C,00000000), ref: 004596C9
wcscmp.API-MS-WIN-CRT-STRING-L1-1-0(0047A888,00000000), ref: 004596DD
wcscmp.API-MS-WIN-CRT-STRING-L1-1-0(0047A908,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 004596F1
wcscmp.API-MS-WIN-CRT-STRING-L1-1-0(0047A910,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00459701
?get_log_instance@base@@YAPAVILogger@1@XZ.COMMON(?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0045971E
wcscmp.API-MS-WIN-CRT-STRING-L1-1-0(0047A908,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00459789
_wtoi.API-MS-WIN-CRT-CONVERT-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000), ref: 004597A6
_wtoi.API-MS-WIN-CRT-CONVERT-L1-1-0(00000000), ref: 004597CC
_wtoi.API-MS-WIN-CRT-CONVERT-L1-1-0(00000000), ref: 004597F2
_wtoi.API-MS-WIN-CRT-CONVERT-L1-1-0(00000000), ref: 00459818
?get_log_instance@base@@YAPAVILogger@1@XZ.COMMON(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00459853
?open_web@Sys_wrapper@common@ierd_tgp@@SA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z.COMMON(?,http://ue.qq.com/mur/?a=survey&b=15087&c=1&d=15272af955762c32696995ddcabc396a,0000004D), ref: 004598DC
?get_qos_instance@qos@adapt_for_imports@ierd_tgp@@YAAAVQos@123@XZ.COMMON(00000001,00000000,00000000,http://ue.qq.com/mur/?a=survey&b=15087&c=1&d=15272af955762c32696995ddcabc396a,0000004D), ref: 00459901
?get_log_instance@base@@YAPAVILogger@1@XZ.COMMON(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0045992B
?extract_op_from_cmd@Sys_wrapper@common@ierd_tgp@@SA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0AAV45@@Z.COMMON(?,?,?,/GameId,00000007), ref: 004599CB
?get_log_instance@base@@YAPAVILogger@1@XZ.COMMON(?,?,?,?,?,?,?,?,?,?,?,?,?,?,/GameId,00000007), ref: 00459A2E
?extract_op_from_cmd@Sys_wrapper@common@ierd_tgp@@SA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0AAV45@@Z.COMMON(?,?,?,/SkinName,00000009), ref: 00459AF0
?get_log_instance@base@@YAPAVILogger@1@XZ.COMMON(?,?,?,?,?,?,?,?,?,?,?,?,?,?,/SkinName,00000009), ref: 00459B59
?extract_op_from_cmd@Sys_wrapper@common@ierd_tgp@@SA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0AAV45@@Z.COMMON(?,?,?,/ChannelId,0000000A,?,/SkinName,00000009), ref: 00459C24
?get_log_instance@base@@YAPAVILogger@1@XZ.COMMON(?,?,?,?,?,?,?,?,?,?,?,?,?,?,/ChannelId,0000000A), ref: 00459C8D
?extract_op_from_cmd@Sys_wrapper@common@ierd_tgp@@SA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0AAV45@@Z.COMMON(?,0000000D,?,/LockPosition,0000000D,?,/ChannelId,0000000A,?,/SkinName,00000009), ref: 00459D58
?get_log_instance@base@@YAPAVILogger@1@XZ.COMMON(?,?,?,?,?,?,?,?,?,?,?,?,?,?,/LockPosition,0000000D), ref: 00459DC1
?extract_op_from_cmd@Sys_wrapper@common@ierd_tgp@@SA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0AAV45@@Z.COMMON(?,0000000D,?,/SourceId,00000009,?,/LockPosition,0000000D,?,/ChannelId,0000000A,?,/SkinName,00000009), ref: 00459E8C
?get_log_instance@base@@YAPAVILogger@1@XZ.COMMON(?,?,?,?,?,?,?,?,?,?,?,?,?,?,/SourceId,00000009), ref: 00459EF5
?extract_op_from_cmd@Sys_wrapper@common@ierd_tgp@@SA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0AAV45@@Z.COMMON(?,0000000D,?,/PromoteId,0000000A,?,/SourceId,00000009,?,/LockPosition,0000000D,?,/ChannelId,0000000A,?,/SkinName), ref: 00459FB4

Part of subcall function 00420F10: memcpy.VCRUNTIME140(00000000,00000000,00000000,004204D1,00000000,00000000,00000000,?,00423FD2,00000000,00000001), ref: 00420F37

Part of subcall function 0044EB2D: __EH_prolog3_catch_GS.LIBCMT ref: 0044EB34
Part of subcall function 0044EB2D: ?set_cfg_by_path@common@ierd_tgp@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABV?$basic_ptree@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@property_tree@boost@@@Z.COMMON(?,?,00000028), ref: 0044EB6B

?get_log_instance@base@@YAPAVILogger@1@XZ.COMMON(?,?,?,?,?,?,?,?,?,?,?,?,?,?,/PromoteId,0000000A), ref: 0045A01A
?report@Qos@qos@adapt_for_imports@ierd_tgp@@QAE_NABUQos_data_base@234@W4Qos_occasion@234@@Z.COMMON(?,00000001,00000001,00000000,00000000,http://ue.qq.com/mur/?a=survey&b=15087&c=1&d=15272af955762c32696995ddcabc396a,0000004D), ref: 00459911

Part of subcall function 0043F2BB: __EH_prolog3_catch_GS.LIBCMT ref: 0043F2C2

LocalFree.KERNEL32(00000000), ref: 0045A324

Part of subcall function 0043DD1B: __EH_prolog3.LIBCMT ref: 0043DD22

?extract_op_from_cmd@Sys_wrapper@common@ierd_tgp@@SA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0AAV45@@Z.COMMON(0000000D,0000000D,?,/Proxy,00000006,?,/PromoteId,0000000A,?,/SourceId,00000009,?,/LockPosition,0000000D,?,/ChannelId), ref: 0045A0D0
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,none), ref: 0045A101
?save_proxy_settings@client_helper@net@ierd_tgp@@YAXPBD@Z.COMMON(?), ref: 0045A120
?extract_op_from_cmd@Sys_wrapper@common@ierd_tgp@@SA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0AAV45@@Z.COMMON(0000000C,0000000D,?,/QUICKLAUNCH,0000000C,?,/Proxy,00000006,?,/PromoteId,0000000A,?,/SourceId,00000009,?,/LockPosition), ref: 0045A17E
?TaskBarPin@Sys_wrapper@common@ierd_tgp@@SA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@_N@Z.COMMON(00000000,00000001,?,0000000D,wegame.exe,?,?,?,?,/QUICKLAUNCH,0000000C,?,/Proxy,00000006,?,/PromoteId), ref: 0045A1FF
?get_qos_instance@qos@adapt_for_imports@ierd_tgp@@YAAAVQos@123@XZ.COMMON(00000001,00000000,00000000,00000000), ref: 0045A285
?report@Qos@qos@adapt_for_imports@ierd_tgp@@QAE_NABUQos_data_base@234@W4Qos_occasion@234@@Z.COMMON(?,00000001,00000001,00000000,00000000,00000000), ref: 0045A295

Part of subcall function 004568D6: __EH_prolog3_GS.LIBCMT ref: 004568E0
Part of subcall function 004568D6: ?is_regular_file@filesystem@ierd_tgp@@YA_NABVpath@12@AAVerror_code@std@@@Z.COMMON(?,?,?,?,?,00000000,00000000,00000000), ref: 0045699F
Part of subcall function 004568D6: ?parent_path@path@filesystem@ierd_tgp@@QBE?AV123@XZ.COMMON(0000000D,?,?,?,00000000,00000000,00000000), ref: 004569B1
Part of subcall function 004568D6: ?exists@filesystem@ierd_tgp@@YA_NABVpath@12@AAVerror_code@std@@@Z.COMMON(00000000,?,0000000D,?,?,?,00000000,00000000,00000000), ref: 004569C9
Part of subcall function 004568D6: ?copy_file@filesystem@ierd_tgp@@YAXABVpath@12@0W4copy_option@12@AAVerror_code@std@@@Z.COMMON(?,0000000A,00000001,?), ref: 00456A1D

Part of subcall function 00420D40: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,0043DEC9,F69FE839,?,?,?,0046D880,000000FF,?,0043DE1E,F69FE839,?,?,?,0046D82F,000000FF), ref: 00420D85

Strings

/QUICKLAUNCH, xrefs: 0045A15B
initial.bind_by_game.source_id, xrefs: 00459ED6, 0045A255
/PromoteId, xrefs: 00459F91
e:\dailybuild_fix_5.4\wegame_client\codes\main\tgp_daemon\src\tgp_daemon_main.cpp, xrefs: 0045964B, 00459746, 00459877, 0045994F, 00459A52, 00459B7D, 00459CB1, 00459DE5, 00459F19, 0045A03E
/SkinName, xrefs: 00459ACD
initial.bind_by_game.lock_position, xrefs: 00459DA2
YES, xrefs: 0045A19C
[App]This is a restart from assistant., xrefs: 00459762
/GameId, xrefs: 004599AB
[App]setted lock_position(%s) into cfg, set_rs:%d, xrefs: 00459E15
CommandLineToArgvW failed, xrefs: 0045969D
[App]setted source_id(%s) into cfg, set_rs:%d, xrefs: 00459F49
initial.bind_by_game.game_id, xrefs: 00459A0F
promote.netbar_promote.promote_id, xrefs: 00459FFB
http://ue.qq.com/mur/?a=survey&b=15087&c=1&d=15272af955762c32696995ddcabc396a, xrefs: 004598BD
wegame.exe, xrefs: 0045A1E3
initial.bind_by_game.skin, xrefs: 00459B3A
initial.bind_by_game.channel_id, xrefs: 00459C6E
/Proxy, xrefs: 0045A0B0
/ChannelId, xrefs: 00459C01
[App]setted game_id(%s) into cfg, set_rs:%d, xrefs: 00459A79
[App]setted channel_id(%s) into cfg, set_rs:%d, xrefs: 00459CE1
/SourceId, xrefs: 00459E69
[App]This is the start from install., xrefs: 00459966
[App]Command line:[{}], xrefs: 00459666
[App]setted skin(%s) into cfg, set_rs:%d, xrefs: 00459BAD
none, xrefs: 0045A0F7
[App]This is the start from uninstall., xrefs: 00459890
%, xrefs: 0045A281
[App]setted promote_id(%s) into cfg, set_rs:%d, xrefs: 0045A06B
/LockPosition, xrefs: 00459D35

Memory Dump Source

Source File: 00000006.00000002.4137209488.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.4137156906.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137406249.0000000000476000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137497400.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137574844.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137626631.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137684215.00000000004A3000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_wegame.jbxd

Similarity

API ID: D@std@@U?$char_traits@V?$allocator@V?$basic_string@$?get_log_instance@base@@Logger@1@Sys_wrapper@common@ierd_tgp@@$?extract_op_from_cmd@D@2@@std@@0V45@@$wcscmp$_wtoi$CommandLineVerror_code@std@@@$?get_qos_instance@qos@adapt_for_imports@ierd_tgp@@?report@D@2@@std@@H_prolog3_H_prolog3_catch_Qos@123@Qos@qos@adapt_for_imports@ierd_tgp@@Qos_data_base@234@Qos_occasion@234@@U?$char_traits@_V?$allocator@_V?$basic_string@_Vpath@12@W@std@@$?copy_file@filesystem@ierd_tgp@@?exists@filesystem@ierd_tgp@@?is_regular_file@filesystem@ierd_tgp@@?open_web@?parent_path@path@filesystem@ierd_tgp@@?save_proxy_settings@client_helper@net@ierd_tgp@@?set_cfg_by_path@common@ierd_tgp@@?u16to8@common@ierd_tgp@@ArgvD@2@@4@@D@2@@std@@@D@2@@std@@@2@@property_tree@boost@@@FreeH_prolog3LocalPin@TaskU?$less@V123@V12@V?$basic_ptree@Vpath@12@0W4copy_option@12@W@2@@std@@W@2@@std@@__invalid_parameter_noinfo_noreturn_stricmpmemcpy
String ID: %$/ChannelId$/GameId$/LockPosition$/PromoteId$/Proxy$/QUICKLAUNCH$/SkinName$/SourceId$CommandLineToArgvW failed$YES$[App]Command line:[{}]$[App]This is a restart from assistant.$[App]This is the start from install.$[App]This is the start from uninstall.$[App]setted channel_id(%s) into cfg, set_rs:%d$[App]setted game_id(%s) into cfg, set_rs:%d$[App]setted lock_position(%s) into cfg, set_rs:%d$[App]setted promote_id(%s) into cfg, set_rs:%d$[App]setted skin(%s) into cfg, set_rs:%d$[App]setted source_id(%s) into cfg, set_rs:%d$e:\dailybuild_fix_5.4\wegame_client\codes\main\tgp_daemon\src\tgp_daemon_main.cpp$http://ue.qq.com/mur/?a=survey&b=15087&c=1&d=15272af955762c32696995ddcabc396a$initial.bind_by_game.channel_id$initial.bind_by_game.game_id$initial.bind_by_game.lock_position$initial.bind_by_game.skin$initial.bind_by_game.source_id$none$promote.netbar_promote.promote_id$wegame.exe
API String ID: 3584812755-528510675
Opcode ID: 2c7f2e2e53180b853994fa9308f53d2a9f1c8e7f5168bd94b59b7f542393252b
Instruction ID: 44a342e8c1a1b344f34e870f9580954e27753f726a71c3b76016a10f564494b4
Opcode Fuzzy Hash: 2c7f2e2e53180b853994fa9308f53d2a9f1c8e7f5168bd94b59b7f542393252b
Instruction Fuzzy Hash: F182A171D01258EEDB10DBA4CC46BDDBBB4AF15304F64409EE4487B282DB795F48CBAA

Function 00452966 Relevance: 80.8, APIs: 32, Strings: 14, Instructions: 327
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3_GS.LIBCMT ref: 00452970
??0Application@common@ierd_tgp@@QAE@HQAPAD_NKK1ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z.COMMON(?,?,?,?,?,?,?,000000B4), ref: 004529B7

Part of subcall function 0045350E: __EH_prolog3.LIBCMT ref: 00453515
Part of subcall function 0045350E: ??0WndMsgReceiver@Tenio@@QAE@XZ.COMMON(00000004,004529CB,?,?,?,?,?,?,?,000000B4), ref: 0045351F

GetTickCount.KERNEL32 ref: 004529EA
?get_session_id@Application@common@ierd_tgp@@QAE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ.COMMON(?), ref: 004529FC

Part of subcall function 004589B8: __EH_prolog3_catch_GS.LIBCMT ref: 004589BF
Part of subcall function 004589B8: ?stamp_point@@YAXPBD@Z.COMMON(CrashReportLoaderInit begin,0000007C,00452A0B,00000000,?), ref: 004589C9
Part of subcall function 004589B8: ?get_cfg_by_path@common@ierd_tgp@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAV?$basic_ptree@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@property_tree@boost@@_N@Z.COMMON(?,?,00000000,log,00000003,?,?,?,?,?,?,?,?,?,0000007C,00452A0B), ref: 00458A0F
Part of subcall function 004589B8: ?is_static_detail_log@common@ierd_tgp@@YA_NXZ.COMMON(?), ref: 00458A94
Part of subcall function 004589B8: ?GetLastLoginedWegameId@common@ierd_tgp@@YAIXZ.COMMON(?), ref: 00458AA0
Part of subcall function 004589B8: SimpleUString::operator=.MSOBJ140-MSVCRT ref: 00458AC5
Part of subcall function 004589B8: ?get_client_version_type@overseas@ierd_tgp@@YAHXZ.COMMON(?,?,?,?,00452A0B,00000000,?), ref: 00458AD1
Part of subcall function 004589B8: SimpleUString::operator=.MSOBJ140-MSVCRT ref: 00458AF4
Part of subcall function 004589B8: ?Instance@CrashReportLoader@crash_report@@SAAAV12@XZ.ADAPT_FOR_IMPORTS ref: 00458B1A

OutputDebugStringW.KERNEL32(Tenio Initialize!,?), ref: 00452A1D

Part of subcall function 0043ED54: __EH_prolog3.LIBCMT ref: 0043ED5B

Part of subcall function 0043E651: __EH_prolog3_GS.LIBCMT ref: 0043E658
Part of subcall function 0043E651: ?StartThread@CThread@@QAEHPAXH@Z.COMMON(00000000,00000000,00000050), ref: 0043E661
Part of subcall function 0043E651: ?get_log_instance@base@@YAPAVILogger@1@XZ.COMMON(00000000,00000000,00000050), ref: 0043E66A

Part of subcall function 004595D0: __EH_prolog3_GS.LIBCMT ref: 004595DA
Part of subcall function 004595D0: GetCommandLineW.KERNEL32(000001A4,00452A3D), ref: 004595EB
Part of subcall function 004595D0: ?u16to8@common@ierd_tgp@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@4@@Z.COMMON(?,?), ref: 00459620
Part of subcall function 004595D0: ?get_log_instance@base@@YAPAVILogger@1@XZ.COMMON ref: 00459627
Part of subcall function 004595D0: GetCommandLineW.KERNEL32(?), ref: 0045968E
Part of subcall function 004595D0: CommandLineToArgvW.SHELL32(00000000), ref: 00459691

?get_log_instance@base@@YAPAVILogger@1@XZ.COMMON ref: 00452A41
?exit_app@Application@common@ierd_tgp@@QAEXH@Z.COMMON(00000065), ref: 00452A9F
?get_coexist_name@util_multi_instance@ierd_tgp@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PBD@Z.COMMON(?,31F73356-9B60-4B52-9FF0-F27E3A9BBEC2), ref: 00452AB9
CreateEventA.KERNEL32(00000000,00000000,00000000,?), ref: 00452AD3
?get_qos_instance@qos@adapt_for_imports@ierd_tgp@@YAAAVQos@123@XZ.COMMON ref: 00452ADC
?get_quick_login_uin@common@ierd_tgp@@YAKXZ.COMMON ref: 00452AE3
?report@Qos@qos@adapt_for_imports@ierd_tgp@@QAE_NABUQos_data_base@234@W4Qos_occasion@234@@Z.COMMON(00000000,00000001,00000000,?), ref: 00452B04
?get_exe_path_ex@Application@common@ierd_tgp@@SA?AVpath@filesystem@3@XZ.COMMON(?,00000000,00000001,00000000,?), ref: 00452B19
?parent_path@path@filesystem@ierd_tgp@@QBE?AV123@XZ.COMMON(?,00000000,00000001,00000000,?), ref: 00452B29
??_0path@filesystem@ierd_tgp@@QAEAAV012@PB_W@Z.COMMON(host_mgr.dll,?,00000000,00000001,00000000,?), ref: 00452B43
PathFileExistsW.SHLWAPI(?,host_mgr.dll,?,00000000,00000001,00000000,?), ref: 00452B54
LoadLibraryW.KERNEL32(host_mgr.dll), ref: 00452B5F
?get_client_id@util_client_info@ierd_tgp@@YAHXZ.COMMON ref: 00452B71
?stamp_point@@YAXPBD@Z.COMMON(gen_all_components), ref: 00452BA7
?stamp_point@@YAXPBD@Z.COMMON(gen_all_components end), ref: 00452BB9
?get_log_instance@base@@YAPAVILogger@1@XZ.COMMON ref: 00452BBF
?stamp_point@@YAXPBD@Z.COMMON(warming_up), ref: 00452C1E
?stamp_point@@YAXPBD@Z.COMMON(warming_up end), ref: 00452C30
?get_log_instance@base@@YAPAVILogger@1@XZ.COMMON ref: 00452C36
?get_comp_mgr_instance@common@ierd_tgp@@YAAAVComponent_mgr@12@XZ.COMMON ref: 00452C90
?init@Component_mgr@common@ierd_tgp@@QAE_NXZ.COMMON ref: 00452C97
?get_log_instance@base@@YAPAVILogger@1@XZ.COMMON ref: 00452C9C
?get_comp_mgr_instance@common@ierd_tgp@@YAAAVComponent_mgr@12@XZ.COMMON ref: 00452CF6
?inited@Component_mgr@common@ierd_tgp@@QAEXXZ.COMMON ref: 00452CFD
?Init@WndMsgReceiver@Tenio@@QAE_NPBD@Z.COMMON(00000000), ref: 00452D0D

Part of subcall function 0043DD1B: __EH_prolog3.LIBCMT ref: 0043DD22

Part of subcall function 0043F2BB: __EH_prolog3_catch_GS.LIBCMT ref: 0043F2C2

?PushAsyncTask@common@ierd_tgp@@YAXV?$function@$$A6AXXZ@std@@K@Z.COMMON ref: 00452D79
GetTickCount.KERNEL32 ref: 00452D81

Strings

Tenio Initialize!, xrefs: 00452A18
initalize, xrefs: 00452B85
31F73356-9B60-4B52-9FF0-F27E3A9BBEC2, xrefs: 00452AB3
gen_all_components end, xrefs: 00452BB4
host_mgr.dll, xrefs: 00452B3A, 00452B42, 00452B5E
e:\dailybuild_fix_5.4\wegame_client\codes\main\tgp_daemon\src\tgp_daemon_main.cpp, xrefs: 00452A65, 00452BE3, 00452C5A, 00452CC0
gen_all_components, xrefs: 00452BA2
[main]comp inted, xrefs: 00452CD7
[main]warming_up, xrefs: 00452BFA
warming_up end, xrefs: 00452C2B
[main]init comp, xrefs: 00452C71
set_client_info, xrefs: 00452B78
warming_up, xrefs: 00452C19
[main]exiting app started from install, xrefs: 00452A7C

Memory Dump Source

Source File: 00000006.00000002.4137209488.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.4137156906.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137406249.0000000000476000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137497400.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137574844.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137626631.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137684215.00000000004A3000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_wegame.jbxd

Similarity

API ID: D@std@@U?$char_traits@V?$allocator@V?$basic_string@$?get_log_instance@base@@Logger@1@$?stamp_point@@$Application@common@ierd_tgp@@D@2@@std@@$CommandH_prolog3H_prolog3_Line$?get_comp_mgr_instance@common@ierd_tgp@@Component_mgr@12@Component_mgr@common@ierd_tgp@@CountH_prolog3_catch_Receiver@SimpleString::operator=Tenio@@TickV12@$??_0path@filesystem@ierd_tgp@@?exit_app@?get_cfg_by_path@common@ierd_tgp@@?get_client_id@util_client_info@ierd_tgp@@?get_client_version_type@overseas@ierd_tgp@@?get_coexist_name@util_multi_instance@ierd_tgp@@?get_exe_path_ex@?get_qos_instance@qos@adapt_for_imports@ierd_tgp@@?get_quick_login_uin@common@ierd_tgp@@?get_session_id@?init@?inited@?is_static_detail_log@common@ierd_tgp@@?parent_path@path@filesystem@ierd_tgp@@?report@?u16to8@common@ierd_tgp@@ArgvAsyncCrashCreateD@2@@4@@D@2@@std@@@D@2@@std@@@2@@property_tree@boost@@_DebugEventExistsFileId@common@ierd_tgp@@Init@Instance@LastLibraryLoadLoader@crash_report@@LoginedOutputPathPushQos@123@Qos@qos@adapt_for_imports@ierd_tgp@@Qos_data_base@234@Qos_occasion@234@@ReportStartStringTask@common@ierd_tgp@@Thread@Thread@@U?$char_traits@_U?$less@V012@V123@V?$allocator@_V?$basic_ptree@V?$basic_string@_V?$function@$$Vpath@filesystem@3@W@2@@std@@W@std@@WegameZ@std@@
String ID: 31F73356-9B60-4B52-9FF0-F27E3A9BBEC2$Tenio Initialize!$[main]comp inted$[main]exiting app started from install$[main]init comp$[main]warming_up$e:\dailybuild_fix_5.4\wegame_client\codes\main\tgp_daemon\src\tgp_daemon_main.cpp$gen_all_components$gen_all_components end$host_mgr.dll$initalize$set_client_info$warming_up$warming_up end
API String ID: 388799878-2260236949
Opcode ID: b2faa25b30e07798e367b548f491b6c6de02a7ab70814512674db9b29421e609
Instruction ID: 6f31f22b00fb7b7e5017e1f7960d78dc27e8b169c63bd61596f0f758f38f7f51
Opcode Fuzzy Hash: b2faa25b30e07798e367b548f491b6c6de02a7ab70814512674db9b29421e609
Instruction Fuzzy Hash: 17C1C430A05354AADB10EF65CC56BDD7BB0AF15709F14409EF8096B283DBBC9E48CB5A

Function 0045BB05 Relevance: 66.8, APIs: 24, Strings: 14, Instructions: 342
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3_GS.LIBCMT ref: 0045BB0F
memset.VCRUNTIME140(?,00000000,00000208,00000554,0045E342,00000070,00452C2B), ref: 0045BB24
?instance@Application@common@ierd_tgp@@SAPAV123@XZ.COMMON(?,00000000,00000208,00000554,0045E342,00000070,00452C2B), ref: 0045BB29
?get_workingdir_path_ex@Application@common@ierd_tgp@@SA?AVpath@filesystem@3@XZ.COMMON(?,?,00000000,00000208,00000554,0045E342,00000070,00452C2B), ref: 0045BB35
??_0path@filesystem@ierd_tgp@@QAEAAV012@PB_W@Z.COMMON(cfg_data.ini), ref: 0045BB4C
GetPrivateProfileStringW.KERNEL32(qblink_path,platform_dir,QBBlink,?,00000104,?), ref: 0045BB88
memset.VCRUNTIME140(?,00000000,00000208), ref: 0045BB98
GetPrivateProfileStringW.KERNEL32(qblink_path,plugin_dir,QBBlink,?,00000104,?), ref: 0045BBCC
SimpleUString::operator=.MSOBJ140-MSVCRT ref: 0045BC49
?u16to8@common@ierd_tgp@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@4@@Z.COMMON(?,?), ref: 0045BC60
SimpleUString::operator=.MSOBJ140-MSVCRT ref: 0045BCA8
?u16to8@common@ierd_tgp@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@4@@Z.COMMON(?,?), ref: 0045BCBF

Part of subcall function 0040BC90: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,0040E9C2,?,?), ref: 0040BCDD

?get_log_instance@base@@YAPAVILogger@1@XZ.COMMON(?), ref: 0045BD24
?u8to16@common@ierd_tgp@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@4@@Z.COMMON(?,?,?,?), ref: 0045BDF3
??_0path@filesystem@ierd_tgp@@QAEAAV012@ABV012@@Z.COMMON(?,?,?,?,?,?,cfg_data.ini), ref: 0045BE87
??_0path@filesystem@ierd_tgp@@QAEAAV012@PB_W@Z.COMMON(qbclient.dll,?,?,?,?,?,?,cfg_data.ini), ref: 0045BEA6
PathFileExistsW.SHLWAPI(?), ref: 0045BEC0

Part of subcall function 0045A90F: __EH_prolog3_GS.LIBCMT ref: 0045A919
Part of subcall function 0045A90F: ?GetUpdatedFilePath@silence_update@common@ierd_tgp@@SA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PB_W0@Z.COMMON(?,qblink_update,browser.exe,00000104,0045BCF7,?), ref: 0045A957
Part of subcall function 0045A90F: ?get_log_instance@base@@YAPAVILogger@1@XZ.COMMON(?,?,?,?,?,cfg_data.ini), ref: 0045A96C
Part of subcall function 0045A90F: ?u8to16@common@ierd_tgp@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@4@@Z.COMMON(?,?), ref: 0045A9F5
Part of subcall function 0045A90F: ?exists@filesystem@ierd_tgp@@YA_NABVpath@12@@Z.COMMON(?), ref: 0045AA16
Part of subcall function 0045A90F: ?remove_filename@path@filesystem@ierd_tgp@@QAEAAV123@XZ.COMMON(00000005,e:\dailybuild_fix_5.4\wegame_client\codes\main\tgp_daemon\src\tgp_daemon_main.cpp,0000060B,00484367), ref: 0045AA27

PathFileExistsA.SHLWAPI(c:\wgdebug.txt,QBBlink\qbclient.dll,00000014), ref: 0045BF1D
?instance@Application@common@ierd_tgp@@SAPAV123@XZ.COMMON(?), ref: 0045BF35
?get_app_sub_path@Application@common@ierd_tgp@@SA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V45@@Z.COMMON(?,?,?,?,?,qbclient.dll,?,?,?,?,?,?,cfg_data.ini), ref: 0045BF66
?u8to16@common@ierd_tgp@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@4@@Z.COMMON(?,?), ref: 0045BFA6
LoadLibraryW.KERNEL32(?), ref: 0045BFC3
GetProcAddress.KERNEL32(00000000,Prefetch), ref: 0045BFD3
?get_log_instance@base@@YAPAVILogger@1@XZ.COMMON ref: 0045BFE1

Part of subcall function 00420F10: memcpy.VCRUNTIME140(00000000,00000000,00000000,004204D1,00000000,00000000,00000000,?,00423FD2,00000000,00000001), ref: 00420F37

Part of subcall function 00420D40: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,0043DEC9,F69FE839,?,?,?,0046D880,000000FF,?,0043DE1E,F69FE839,?,?,?,0046D82F,000000FF), ref: 00420D85

Strings

qblink_path, xrefs: 0045BB64, 0045BB87, 0045BBCB
[main]PrefetchQblink, xrefs: 0045C01C
e:\dailybuild_fix_5.4\wegame_client\codes\main\tgp_daemon\src\tgp_daemon_main.cpp, xrefs: 0045BD48, 0045C005
c:\wgdebug.txt, xrefs: 0045BF18
cfg_data.ini, xrefs: 0045BB47
platform_dir, xrefs: 0045BB82
[QBlink]read qblink_path, platform:[%s], plugin:[%s], xrefs: 0045BD89
plugin_dir, xrefs: 0045BBC6
QBBlink\qbclient.dll, xrefs: 0045BF08
QBBlink, xrefs: 0045BB7D, 0045BBC1
QBBlink, xrefs: 0045BCD5
qbclient.dll, xrefs: 0045BE9B
Prefetch, xrefs: 0045BFCD
\qbclient.dll, xrefs: 0045BECA

Memory Dump Source

Source File: 00000006.00000002.4137209488.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.4137156906.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137406249.0000000000476000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137497400.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137574844.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137626631.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137684215.00000000004A3000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_wegame.jbxd

Similarity

API ID: D@std@@U?$char_traits@V?$allocator@V?$basic_string@$D@2@@std@@U?$char_traits@_V?$allocator@_V?$basic_string@_W@std@@$Application@common@ierd_tgp@@$??_0path@filesystem@ierd_tgp@@?get_log_instance@base@@?u8to16@common@ierd_tgp@@FileLogger@1@V012@V123@W@2@@4@@$?instance@?u16to8@common@ierd_tgp@@D@2@@4@@ExistsH_prolog3_PathPrivateProfileSimpleStringString::operator=W@2@@std@@_invalid_parameter_noinfo_noreturnmemset$?exists@filesystem@ierd_tgp@@?get_app_sub_path@?get_workingdir_path_ex@?remove_filename@path@filesystem@ierd_tgp@@AddressLibraryLoadPath@silence_update@common@ierd_tgp@@ProcUpdatedV012@@V45@@Vpath@12@@Vpath@filesystem@3@memcpy
String ID: Prefetch$QBBlink$QBBlink$QBBlink\qbclient.dll$[QBlink]read qblink_path, platform:[%s], plugin:[%s]$[main]PrefetchQblink$\qbclient.dll$c:\wgdebug.txt$cfg_data.ini$e:\dailybuild_fix_5.4\wegame_client\codes\main\tgp_daemon\src\tgp_daemon_main.cpp$platform_dir$plugin_dir$qbclient.dll$qblink_path
API String ID: 2089395831-3869890541
Opcode ID: b036ab445ba400daf60af147e20a246d81cc687d499a429a9ece389fca3a9721
Instruction ID: 8a120f4cc8102dbe9996bcb0adc79108ea19c7d9da8d26655a6af3a6f6f558ec
Opcode Fuzzy Hash: b036ab445ba400daf60af147e20a246d81cc687d499a429a9ece389fca3a9721
Instruction Fuzzy Hash: FAF11EB0D052589ADB60DB65CC85BDDB7B4AF14309F5040EEE209A7182DB785F88CF6E

Function 0043E702 Relevance: 59.9, APIs: 23, Strings: 11, Instructions: 376
filetimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3_GS.LIBCMT ref: 0043E70C
PathFileExistsW.SHLWAPI(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000098), ref: 0043E727
?u16to8@common@ierd_tgp@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@4@@Z.COMMON(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000098), ref: 0043E752
SHCreateDirectoryExW.SHELL32(00000000,?,00000000), ref: 0043E768
?get_log_instance@base@@YAPAVILogger@1@XZ.COMMON(?,?,?,?,?,?,?,?,?,?,?,?,?,00000098), ref: 0043E77C
GetLastError.KERNEL32(00000000,00000005,e:\dailybuild_fix_5.4\wegame_client\codes\main\tgp_daemon\src\crashchecker.cpp,00000048,00484367), ref: 0043E7BE
?get_log_instance@base@@YAPAVILogger@1@XZ.COMMON(?,?,?,?,?,?,?,?,?,?,?,?,?,00000098), ref: 0043E7E4
PathFileExistsW.SHLWAPI(?), ref: 0043E882
CreateFileW.KERNEL32(?,C0000000,00000001,00000000,00000001,00000000,00000000), ref: 0043E8B9
?get_log_instance@base@@YAPAVILogger@1@XZ.COMMON(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000098), ref: 0043E8C6
GetLastError.KERNEL32(00000000,00000005,e:\dailybuild_fix_5.4\wegame_client\codes\main\tgp_daemon\src\crashchecker.cpp,0000005E,00484367), ref: 0043E908
memset.VCRUNTIME140(?,00000000,00000010), ref: 0043E93B
ReadFile.KERNEL32(00000000,?,00000010,00000000,00000000), ref: 0043E962
?get_log_instance@base@@YAPAVILogger@1@XZ.COMMON ref: 0043E96C
?get_log_instance@base@@YAPAVILogger@1@XZ.COMMON ref: 0043E9BE
GetLastError.KERNEL32(00000000,00000005,e:\dailybuild_fix_5.4\wegame_client\codes\main\tgp_daemon\src\crashchecker.cpp,0000006A,00484367), ref: 0043E9F8
?get_log_instance@base@@YAPAVILogger@1@XZ.COMMON ref: 0043EA1E
WriteFile.KERNEL32(00000000,00000000,00000010,?,00000000,?,?,?,?,?,?,?,?,00000098), ref: 0043EAC9
?get_log_instance@base@@YAPAVILogger@1@XZ.COMMON(?,?,?,?,?,?,?,?,00000098), ref: 0043EAD3
?get_log_instance@base@@YAPAVILogger@1@XZ.COMMON(?,?,?,?,?,?,?,?,00000098), ref: 0043EB25
GetLocalTime.KERNEL32(00000000,?,?,?,?,?,?,?,?,00000098), ref: 0043EAAC

Part of subcall function 0043DD1B: __EH_prolog3.LIBCMT ref: 0043DD22

Part of subcall function 0043F2BB: __EH_prolog3_catch_GS.LIBCMT ref: 0043F2C2

GetLastError.KERNEL32(00000000,00000005,e:\dailybuild_fix_5.4\wegame_client\codes\main\tgp_daemon\src\crashchecker.cpp,00000082,00484367,?,?,?,?,?,?,?,?,00000098), ref: 0043EB62
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,00000098), ref: 0043EB88

Strings

Read last config success., xrefs: 0043E9AC
Write file success., xrefs: 0043EB14
qgCH, xrefs: 0043EA76, 0043EA7A
Create cache path success: %s., xrefs: 0043E828
Write file failed: %d., xrefs: 0043EB69
Create new file fail: %d., xrefs: 0043E90F
Flag, xrefs: 0043E85B
Last time: %.4d-%.2d-%.2d %.2d:%.2d:%.2d %.3d, xrefs: 0043EA7B
Read last time config fail: %d., xrefs: 0043E9FF
Create cache dir(%s) failed, last_err=%d-%d, xrefs: 0043E7D2
e:\dailybuild_fix_5.4\wegame_client\codes\main\tgp_daemon\src\crashchecker.cpp, xrefs: 0043E7A5, 0043E805, 0043E8EF, 0043E995, 0043E9DF, 0043EA3F, 0043EAFE, 0043EB49

Memory Dump Source

Source File: 00000006.00000002.4137209488.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.4137156906.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137406249.0000000000476000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137497400.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137574844.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137626631.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137684215.00000000004A3000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_wegame.jbxd

Similarity

API ID: ?get_log_instance@base@@Logger@1@$File$ErrorLast$CreateExistsPath$?u16to8@common@ierd_tgp@@CloseD@2@@4@@D@std@@DirectoryH_prolog3H_prolog3_H_prolog3_catch_HandleLocalReadTimeU?$char_traits@U?$char_traits@_V?$allocator@V?$allocator@_V?$basic_string@V?$basic_string@_W@2@@std@@W@std@@Writememset
String ID: Create cache dir(%s) failed, last_err=%d-%d$Create cache path success: %s.$Create new file fail: %d.$Flag$Last time: %.4d-%.2d-%.2d %.2d:%.2d:%.2d %.3d$Read last config success.$Read last time config fail: %d.$Write file failed: %d.$Write file success.$e:\dailybuild_fix_5.4\wegame_client\codes\main\tgp_daemon\src\crashchecker.cpp$qgCH
API String ID: 1197986196-2742762222
Opcode ID: d97bfe615c3c22d4644c60b7fd217977f1b90dba61425b7432b3e9cc052ec056
Instruction ID: f912ac9dde7e4b83544575b81723d2257f53c808c4fa2cf1fa8573d06a637bc3
Opcode Fuzzy Hash: d97bfe615c3c22d4644c60b7fd217977f1b90dba61425b7432b3e9cc052ec056
Instruction Fuzzy Hash: 9FD12670E01614ABDB14EBA5CC46FEE7375AF09704F20405AF8457B2C2DBB96E44CB69

Function 00458B77 Relevance: 54.6, APIs: 24, Strings: 7, Instructions: 336
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3_GS.LIBCMT ref: 00458B81
memset.VCRUNTIME140(?,00000000,00000208,00000000,?,qbclient.dll,?,?,?,?,?,?,cfg_data.ini), ref: 00458BF5
GetModuleHandleW.KERNEL32(00000000,?,00000104,?,?,00000000,?,qbclient.dll,?,?,?,?,?,?,cfg_data.ini), ref: 00458C0B
GetModuleFileNameW.KERNEL32(00000000,?,?,00000000,?,qbclient.dll,?,?,?,?,?,?,cfg_data.ini), ref: 00458C12
PathFindFileNameW.SHLWAPI(?,?,?,00000000,?,qbclient.dll,?,?,?,?,?,?,cfg_data.ini), ref: 00458C1F
SimpleUString::operator=.MSOBJ140-MSVCRT ref: 00458C58
PathFileExistsW.SHLWAPI(?), ref: 00458CC1
DeleteFileW.KERNEL32(?), ref: 00458CEA
?u16to8@common@ierd_tgp@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@4@@Z.COMMON(?,00000000), ref: 00458D02
?get_log_instance@base@@YAPAVILogger@1@XZ.COMMON ref: 00458D09

Part of subcall function 0043DD1B: __EH_prolog3.LIBCMT ref: 0043DD22

Part of subcall function 0043F2BB: __EH_prolog3_catch_GS.LIBCMT ref: 0043F2C2

?get_log_instance@base@@YAPAVILogger@1@XZ.COMMON ref: 00458D85
GetLastError.KERNEL32(00000000,00000005,e:\dailybuild_fix_5.4\wegame_client\codes\main\tgp_daemon\src\tgp_daemon_main.cpp,00000637,00484367), ref: 00458DC8
?u16to8@common@ierd_tgp@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@4@@Z.COMMON(?,00000000,?,?,.bak), ref: 00458E14
MoveFileW.KERNEL32(?,?), ref: 00458E46
?get_log_instance@base@@YAPAVILogger@1@XZ.COMMON ref: 00458E50

Strings

.bak, xrefs: 00458DEA, 00458F29
[AsyncTask]Delete file success: %s., xrefs: 00458D61, 00458FE4
e:\dailybuild_fix_5.4\wegame_client\codes\main\tgp_daemon\src\tgp_daemon_main.cpp, xrefs: 00458D35, 00458DAF, 00458E7C, 00458ED9, 00458FB8, 00459012
[AsyncTask]Rename file fail: %s - %d., xrefs: 00458F0A
[AsyncTask]Rename file success: %s., xrefs: 00458EA8
[AsyncTask]Delete file fail: %d., xrefs: 00458DCB, 0045902E
\devtools_resources.pak, xrefs: 00458BB3

Memory Dump Source

Source File: 00000006.00000002.4137209488.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.4137156906.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137406249.0000000000476000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137497400.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137574844.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137626631.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137684215.00000000004A3000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_wegame.jbxd

Similarity

API ID: File$?get_log_instance@base@@Logger@1@$?u16to8@common@ierd_tgp@@D@2@@4@@D@std@@ModuleNamePathU?$char_traits@U?$char_traits@_V?$allocator@V?$allocator@_V?$basic_string@V?$basic_string@_W@2@@std@@W@std@@$DeleteErrorExistsFindH_prolog3H_prolog3_H_prolog3_catch_HandleLastMoveSimpleString::operator=memset
String ID: .bak$[AsyncTask]Delete file fail: %d.$[AsyncTask]Delete file success: %s.$[AsyncTask]Rename file fail: %s - %d.$[AsyncTask]Rename file success: %s.$\devtools_resources.pak$e:\dailybuild_fix_5.4\wegame_client\codes\main\tgp_daemon\src\tgp_daemon_main.cpp
API String ID: 4094883167-3854754761
Opcode ID: c3a0c5ed63a6955f436c78116d9a5a5455794c8330dce51c29e4c375097f2a47
Instruction ID: 7379ba1d3ae27f5c38ac20be72509df39a73793878f5fe3ba58693311b8cded4
Opcode Fuzzy Hash: c3a0c5ed63a6955f436c78116d9a5a5455794c8330dce51c29e4c375097f2a47
Instruction Fuzzy Hash: 42D17D71A41229DADB20EB60CC99BDE7374AF14705F2041DAE409B72C2DB799F88CF59

Function 0045E00B Relevance: 52.8, APIs: 20, Strings: 10, Instructions: 260
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3_GS.LIBCMT ref: 0045E012

Part of subcall function 0045A3D8: __EH_prolog3_GS.LIBCMT ref: 0045A3E2
Part of subcall function 0045A3D8: ?is_certificate_open@util_curl_certificate@ierd_tgp@@YA_NXZ.COMMON(00000110,0045E01E,00000070,00452C2B), ref: 0045A3E7
Part of subcall function 0045A3D8: ?get_workingdir_path_ex@Application@common@ierd_tgp@@SA?AVpath@filesystem@3@XZ.COMMON(?,00000110,0045E01E,00000070,00452C2B), ref: 0045A3FB
Part of subcall function 0045A3D8: ?u16_to_loc@common@ierd_tgp@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@4@@Z.COMMON(00000000,?,?,?,?,wegamex_client.pfx,?,?,wegamex_client.key), ref: 0045A500
Part of subcall function 0045A3D8: ?u16_to_loc@common@ierd_tgp@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@4@@Z.COMMON(00000000,?,?,?,?,?,wegamex_client.pfx,?,?,wegamex_client.key), ref: 0045A52B

Part of subcall function 0045CBDF: __EH_prolog3_GS.LIBCMT ref: 0045CBE9
Part of subcall function 0045CBDF: memset.VCRUNTIME140(?,00000000,00000208,000008D0,0045E025,00000070,00452C2B), ref: 0045CBFE
Part of subcall function 0045CBDF: GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 0045CC14
Part of subcall function 0045CBDF: ?filename@path@filesystem@ierd_tgp@@QBE?AV123@XZ.COMMON(?,?), ref: 0045CC40
Part of subcall function 0045CBDF: ?parent_path@path@filesystem@ierd_tgp@@QBE?AV123@XZ.COMMON(?,?,?,?), ref: 0045CC73
Part of subcall function 0045CBDF: memset.VCRUNTIME140(?,00000000,00000208,?,?,?,?,?), ref: 0045CCA2
Part of subcall function 0045CBDF: FindFirstFileW.KERNEL32(?,?,?,00000000,00000208,?,?,?,?,?), ref: 0045CCF7
Part of subcall function 0045CBDF: memset.VCRUNTIME140(?,00000000,0000020A), ref: 0045CD2B
Part of subcall function 0045CBDF: wcsncpy_s.API-MS-WIN-CRT-STRING-L1-1-0(?,00000104,?,00000104,?,00000000,0000020A), ref: 0045CD40
Part of subcall function 0045CBDF: wcsncat_s.API-MS-WIN-CRT-STRING-L1-1-0(?,00000104,0047AC50,00000103), ref: 0045CD54

SimpleUString::operator=.MSOBJ140-MSVCRT ref: 0045E045
?PrefetchImage@Sys_wrapper@common@ierd_tgp@@SA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z.COMMON(?,00000070,00452C2B), ref: 0045E051
?get_log_instance@base@@YAPAVILogger@1@XZ.COMMON(00000070,00452C2B), ref: 0045E069
SimpleUString::operator=.MSOBJ140-MSVCRT ref: 0045E0E0
?PrefetchImage@Sys_wrapper@common@ierd_tgp@@SA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z.COMMON(?,00000070,00452C2B), ref: 0045E0F0
?get_log_instance@base@@YAPAVILogger@1@XZ.COMMON(00000070,00452C2B), ref: 0045E108
SimpleUString::operator=.MSOBJ140-MSVCRT ref: 0045E17F
?PrefetchImage@Sys_wrapper@common@ierd_tgp@@SA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z.COMMON(?,00000070,00452C2B), ref: 0045E18F
?get_log_instance@base@@YAPAVILogger@1@XZ.COMMON(00000070,00452C2B), ref: 0045E1A7
SimpleUString::operator=.MSOBJ140-MSVCRT ref: 0045E21B
?PrefetchImage@Sys_wrapper@common@ierd_tgp@@SA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z.COMMON(?,00000070,00452C2B), ref: 0045E22B
?get_log_instance@base@@YAPAVILogger@1@XZ.COMMON(00000070,00452C2B), ref: 0045E243
SimpleUString::operator=.MSOBJ140-MSVCRT ref: 0045E2BA
?PrefetchImage@Sys_wrapper@common@ierd_tgp@@SA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z.COMMON(?,00000070,00452C2B), ref: 0045E2CA
?get_log_instance@base@@YAPAVILogger@1@XZ.COMMON(00000070,00452C2B), ref: 0045E2E2
?get_comp_mgr_instance@common@ierd_tgp@@YAAAVComponent_mgr@12@XZ.COMMON(00000070,00452C2B), ref: 0045E342
?find_component@Component_mgr@common@ierd_tgp@@QAE?AV?$weak_ptr@UIComponent@common@ierd_tgp@@@std@@ABVcomponent_interface_type@23@@Z.COMMON(?,0049EA7C,00000070,00452C2B), ref: 0045E352
?get_comp_mgr_instance@common@ierd_tgp@@YAAAVComponent_mgr@12@XZ.COMMON(?,0049EA7C,00000070,00452C2B), ref: 0045E35F
?find_component@Component_mgr@common@ierd_tgp@@QAE?AV?$weak_ptr@UIComponent@common@ierd_tgp@@@std@@ABVcomponent_interface_type@23@@Z.COMMON(?,0049EB4C,?,0049EA7C,00000070,00452C2B), ref: 0045E36F

Part of subcall function 0043DD1B: __EH_prolog3.LIBCMT ref: 0043DD22

Strings

PrefetchImage wgcore.dll failed, xrefs: 0045E0AC
feature_module.dll, xrefs: 0045E16C
tcls\tenio\TenioTPF.dll, xrefs: 0045E208
e:\dailybuild_fix_5.4\wegame_client\codes\main\tgp_daemon\src\tgp_daemon_main.cpp, xrefs: 0045E08D, 0045E12C, 0045E1CD, 0045E267, 0045E306
PrefetchImage TenioTPF.dll failed, xrefs: 0045E286
wgcore.dll, xrefs: 0045E032
tcls\tenio\TPFCustom.dll, xrefs: 0045E2A7
PrefetchImage TPFCustom.dll failed, xrefs: 0045E325
common.dll, xrefs: 0045E0CD
PrefetchImage common.dll failed, xrefs: 0045E14B, 0045E1E7

Memory Dump Source

Source File: 00000006.00000002.4137209488.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.4137156906.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137406249.0000000000476000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137497400.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137574844.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137626631.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137684215.00000000004A3000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_wegame.jbxd

Similarity

API ID: U?$char_traits@_V?$allocator@_V?$basic_string@_W@std@@$?get_log_instance@base@@Image@Logger@1@PrefetchSimpleString::operator=Sys_wrapper@common@ierd_tgp@@W@2@@std@@@$H_prolog3_memset$?find_component@?get_comp_mgr_instance@common@ierd_tgp@@?u16_to_loc@common@ierd_tgp@@Component@common@ierd_tgp@@@std@@Component_mgr@12@Component_mgr@common@ierd_tgp@@D@2@@4@@D@std@@FileU?$char_traits@V123@V?$allocator@V?$basic_string@V?$weak_ptr@Vcomponent_interface_type@23@@W@2@@std@@$?filename@path@filesystem@ierd_tgp@@?get_workingdir_path_ex@?is_certificate_open@util_curl_certificate@ierd_tgp@@?parent_path@path@filesystem@ierd_tgp@@Application@common@ierd_tgp@@FindFirstH_prolog3ModuleNameVpath@filesystem@3@wcsncat_swcsncpy_s
String ID: PrefetchImage TPFCustom.dll failed$PrefetchImage TenioTPF.dll failed$PrefetchImage common.dll failed$PrefetchImage wgcore.dll failed$common.dll$e:\dailybuild_fix_5.4\wegame_client\codes\main\tgp_daemon\src\tgp_daemon_main.cpp$feature_module.dll$tcls\tenio\TPFCustom.dll$tcls\tenio\TenioTPF.dll$wgcore.dll
API String ID: 1643409868-2646041034
Opcode ID: 3a0749899e03cf6645f38d5760d3e49e26392256bad6943cb1a4067de25de87b
Instruction ID: 680307ae1fff3b28eecf1a229db3305388c9251935d611cd1ec2caa4d4995960
Opcode Fuzzy Hash: 3a0749899e03cf6645f38d5760d3e49e26392256bad6943cb1a4067de25de87b
Instruction Fuzzy Hash: 4BA17270E416059ACB14EFA5C892AEEB770AF48718F20421FE505772C2EB785B45CB99

Function 6C647136 Relevance: 45.7, APIs: 7, Strings: 19, Instructions: 167
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3_GS.LIBCMT ref: 6C647140
memset.VCRUNTIME140(?,00000000,00000118,000001DC,6C63C75A,?,6C8323B0,00000001,00000000,6C8323B0,00000001,00000000), ref: 6C647166
GetVersionExW.KERNEL32(0000011C), ref: 6C64717F

Part of subcall function 6C59A8F0: memcpy.VCRUNTIME140(?,?,9XZl,?,?,00000000,?,?,6C5A5839,?,?), ref: 6C59A917

?Is64Bit_OS@Sys_wrapper@common@ierd_tgp@@SA_NXZ.COMMON(00000000,?,?,?,?,?,6C8323B0), ref: 6C647352

Part of subcall function 6C5BA99D: __EH_prolog3_GS.LIBCMT ref: 6C5BA9A4

Part of subcall function 6C5BF934: __EH_prolog3_GS.LIBCMT ref: 6C5BF93B

Strings

Service Pack 2, xrefs: 6C64721B
Win8, xrefs: 6C6472C3
unknown, xrefs: 6C647193
Service Pack 3, xrefs: 6C64723E
%1%.%2%, xrefs: 6C6472ED
-64, xrefs: 6C64735E, 6C647366
WinXP-SP2, xrefs: 6C64722B
Win11, xrefs: 6C6472DF
Vista, xrefs: 6C64728C
WinNT4.0, xrefs: 6C6471B6
Win10, xrefs: 6C6472BA
WinXP-NoSP, xrefs: 6C64725C
Service Pack 1, xrefs: 6C6471F8
-32, xrefs: 6C647359
WinXP-SP1, xrefs: 6C647208
Server2003, xrefs: 6C647271
WinXP-SP3, xrefs: 6C647250
Win2000, xrefs: 6C6471DB
Win7, xrefs: 6C647299

Memory Dump Source

Source File: 00000006.00000002.4141448948.000000006C591000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000006.00000002.4141374342.000000006C590000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142318714.000000006C825000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142662450.000000006C906000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142732140.000000006C907000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142791681.000000006C909000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142876110.000000006C911000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142956827.000000006C913000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143044653.000000006C91D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143105643.000000006C925000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c590000_wegame.jbxd

Similarity

API ID: H_prolog3_$Bit_Is64Sys_wrapper@common@ierd_tgp@@Versionmemcpymemset
String ID: %1%.%2%$-32$-64$Server2003$Service Pack 1$Service Pack 2$Service Pack 3$Vista$Win10$Win11$Win2000$Win7$Win8$WinNT4.0$WinXP-NoSP$WinXP-SP1$WinXP-SP2$WinXP-SP3$unknown
API String ID: 3529871903-207369704
Opcode ID: d99c8caf4e9b113524f6bfa6f029627cb2d3558dc347f2c0041de8ed2103f6a0
Instruction ID: d3103f93ed61741cf93a1017e210be2942610c25c2b73f6a4c23a59ede33e6e9
Opcode Fuzzy Hash: d99c8caf4e9b113524f6bfa6f029627cb2d3558dc347f2c0041de8ed2103f6a0
Instruction Fuzzy Hash: FA51F070948268A6DF30DAA58D05BDE3A74ABC770CF04E899F90876F40DB714B49CADD

Function 6C5B7825 Relevance: 40.5, APIs: 19, Strings: 4, Instructions: 205
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3_GS.LIBCMT ref: 6C5B782C

Part of subcall function 6C5B6C14: __EH_prolog3.LIBCMT ref: 6C5B6C1B
Part of subcall function 6C5B6C14: ?PushAsyncTask@common@ierd_tgp@@YAXV?$function@$$A6AXXZ@std@@K@Z.COMMON ref: 6C5B6C4E

Part of subcall function 6C5B4F81: __EH_prolog3.LIBCMT ref: 6C5B4F88

_Copy_construct_from.LIBCPMT ref: 6C5B7874
?post_msg@@YAXPBDV?$shared_ptr@Umsg_base@@@std@@@Z.COMMON(?,?,?,?,?,?,?,?,?,00000068), ref: 6C5B7882
GetTickCount.KERNEL32 ref: 6C5B78A2
GetTickCount.KERNEL32 ref: 6C5B78AF
GetTickCount.KERNEL32 ref: 6C5B78B6
GetTickCount.KERNEL32 ref: 6C5B78C8
GetTickCount.KERNEL32 ref: 6C5B78DE
GetTickCount.KERNEL32 ref: 6C5B78F4
?get_comp_mgr_instance@common@ierd_tgp@@YAAAVComponent_mgr@12@XZ.COMMON(?,?,?,?,?,?,?,?,?,?,?,?,?,00000068), ref: 6C5B7918
?get_log_instance@base@@YAPAVILogger@1@XZ.COMMON(?,?,?,?,?,?,?,?,?,?,?,?,?,00000068), ref: 6C5B792B
?get_comp_mgr_instance@common@ierd_tgp@@YAAAVComponent_mgr@12@XZ.COMMON(00000000,00000001,e:\dailybuild_fix_5.4\wegame_client\codes\common\src\app.cpp,0000026D,6C8B5E9F), ref: 6C5B7965
GetTickCount.KERNEL32 ref: 6C5B79EC
GetTickCount.KERNEL32 ref: 6C5B79F9
GetTickCount.KERNEL32 ref: 6C5B7A12
Sleep.KERNEL32(00000005,?,?,?,?,?,?,?,?,?,?,?,?,?,00000068), ref: 6C5B7A21
_Copy_construct_from.LIBCPMT ref: 6C5B7A64
?post_msg@@YAXPBDV?$shared_ptr@Umsg_base@@@std@@@Z.COMMON(?,?,?,?), ref: 6C5B7A72

Part of subcall function 6C5B7ABB: ?stamp_point@@YAXPBD@Z.COMMON(sys_begin,?), ref: 6C5B7AC9
Part of subcall function 6C5B7ABB: QueryPerformanceFrequency.KERNEL32(6C91D0F0,?), ref: 6C5B7AE1
Part of subcall function 6C5B7ABB: QueryPerformanceCounter.KERNEL32(?,?), ref: 6C5B7AEB
Part of subcall function 6C5B7ABB: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 6C5B7C43
Part of subcall function 6C5B7ABB: ?stamp_point@@YAXPBD@Z.COMMON(sys_end), ref: 6C5B7C56

Strings

true, xrefs: 6C5B797C, 6C5B7984
false, xrefs: 6C5B7972
[app][Application::process]do_exit_, count:%d, will_count_:%d, can:%s, xrefs: 6C5B798B
e:\dailybuild_fix_5.4\wegame_client\codes\common\src\app.cpp, xrefs: 6C5B794F

Memory Dump Source

Source File: 00000006.00000002.4141448948.000000006C591000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000006.00000002.4141374342.000000006C590000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142318714.000000006C825000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142662450.000000006C906000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142732140.000000006C907000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142791681.000000006C909000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142876110.000000006C911000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142956827.000000006C913000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143044653.000000006C91D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143105643.000000006C925000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c590000_wegame.jbxd

Similarity

API ID: CountTick$?get_comp_mgr_instance@common@ierd_tgp@@?post_msg@@?stamp_point@@Component_mgr@12@Copy_construct_fromH_prolog3PerformanceQueryUmsg_base@@@std@@@V?$shared_ptr@$?get_log_instance@base@@AsyncCounterFrequencyH_prolog3_Logger@1@MessagePeekPushSleepTask@common@ierd_tgp@@V?$function@$$Z@std@@
String ID: [app][Application::process]do_exit_, count:%d, will_count_:%d, can:%s$e:\dailybuild_fix_5.4\wegame_client\codes\common\src\app.cpp$false$true
API String ID: 4289448702-2533706072
Opcode ID: 157cf7d985f08951f8d1b83e582db3721ef077450fffb0d1329c8a0d7c30d561
Instruction ID: 31b456308ce29350443f0237873cbf9a8281d7ea6216f76f3edd9446e87b008f
Opcode Fuzzy Hash: 157cf7d985f08951f8d1b83e582db3721ef077450fffb0d1329c8a0d7c30d561
Instruction Fuzzy Hash: 2F81A031A09204CFDB05DFA4C965B9CBBF2AF89308F25455CD445ABB91DB31EE06CBA1

Function 6C6160C2 Relevance: 33.7, APIs: 13, Strings: 6, Instructions: 499
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3_GS.LIBCMT ref: 6C6160CC
memset.VCRUNTIME140(?,00000000,00000006,00000358,6C616080,6C924000,?,6C613F1C,?,00000018,6C613FB1,?,00000010), ref: 6C6160E5

Part of subcall function 6C6141BD: __EH_prolog3_GS.LIBCMT ref: 6C6141C7
Part of subcall function 6C6141BD: memset.VCRUNTIME140(?,00000000,00000094,0000009C,6C6161A2,?,?,?,?,?,00000000,00000006,00000358,6C616080,6C924000), ref: 6C6141EA
Part of subcall function 6C6141BD: GetVersionExA.KERNEL32(00000094), ref: 6C614203

Part of subcall function 6C615A8D: memset.VCRUNTIME140(?,00000000,00000031,6C924000,?,?), ref: 6C615ABE
Part of subcall function 6C615A8D: memcpy.VCRUNTIME140(?,?,00000004,6C924000,?,?), ref: 6C615AF1
Part of subcall function 6C615A8D: memcpy.VCRUNTIME140(?,?,00000004,?,?,00000004,6C924000,?,?), ref: 6C615AFC
Part of subcall function 6C615A8D: memcpy.VCRUNTIME140(?,?,00000004,?,?,00000004,?,?,00000004,6C924000,?,?), ref: 6C615B0A
Part of subcall function 6C615A8D: memcpy.VCRUNTIME140(?,?,00000004,?,?,00000004,?,?,00000004,?,?,00000004,6C924000,?,?), ref: 6C615B18

?get_log_instance@base@@YAPAVILogger@1@XZ.COMMON(?,?,?,?,00000105,?,?,00000000,?), ref: 6C616424
CloseHandle.KERNEL32(00000000,?,?,?,?,00000105,?,?,00000000,?), ref: 6C61647F

Part of subcall function 6C5AA5EF: __EH_prolog3.LIBCMT ref: 6C5AA5F6

Part of subcall function 6C5AE945: __EH_prolog3_catch_GS.LIBCMT ref: 6C5AE94C

memset.VCRUNTIME140(?,00000000,00000105), ref: 6C6163A0

Part of subcall function 6C616E4A: __EH_prolog3.LIBCMT ref: 6C616E54
Part of subcall function 6C616E4A: ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z.MSVCP140(6C5A0520,00000002,00000001,000000AC,6C6164B0,?,000000FF,?), ref: 6C616E80
Part of subcall function 6C616E4A: ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z.MSVCP140(?,00000002,00000000), ref: 6C616E90
Part of subcall function 6C616E4A: ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@I@Z.MSVCP140(00000003), ref: 6C616EB0
Part of subcall function 6C616E4A: ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ.MSVCP140(?), ref: 6C616EE0

Part of subcall function 6C615FFB: memset.VCRUNTIME140(?,00000000,?,?,6C830D68,?,?,6C616387,?,?,00000021), ref: 6C61600B
Part of subcall function 6C615FFB: ?MD5String@@YAPADPAD@Z.COMMON(?), ref: 6C61601F
Part of subcall function 6C615FFB: strnlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?), ref: 6C616028
Part of subcall function 6C615FFB: _memcpy_s.PGOCR ref: 6C616039
Part of subcall function 6C615FFB: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6C616047

Part of subcall function 6C615357: __EH_prolog3_GS.LIBCMT ref: 6C615361
Part of subcall function 6C615357: _strnset_s.API-MS-WIN-CRT-STRING-L1-1-0(00000010,00000000,00000000,-00000001,00000144,6C6163D4,000000FF,?,00000105,00000000), ref: 6C6153AE
Part of subcall function 6C615357: memset.VCRUNTIME140(?,00000000,00000105), ref: 6C6153C1
Part of subcall function 6C615357: SHGetFolderPathA.SHELL32(00000000,0000801A,00000000,00000000,?), ref: 6C6153D8
Part of subcall function 6C615357: CreateDirectoryA.KERNEL32(?,00000000), ref: 6C615463
Part of subcall function 6C615357: GetLastError.KERNEL32 ref: 6C615473
Part of subcall function 6C615357: GetLastError.KERNEL32 ref: 6C61547C

?Init@md5@@QAEXXZ.COMMON(?,000000FF), ref: 6C6165F0
?Update@md5@@QAEXPAEI@Z.COMMON(?,?,?,000000FF), ref: 6C616616
?Finalize@md5@@QAEXXZ.COMMON(?,?,?,000000FF), ref: 6C616621
_memcpy_s.PGOCR ref: 6C616636
?get_log_instance@base@@YAPAVILogger@1@XZ.COMMON(?,?,?,000000FF), ref: 6C61663E
FindCloseChangeNotification.KERNEL32(00000000,?,?,000000FF,?), ref: 6C6166E4

Part of subcall function 6C615B63: GetPrivateProfileStringA.KERNEL32(Profile,config1,00000000,?,00000021,?), ref: 6C615BF2
Part of subcall function 6C615B63: GetPrivateProfileStringA.KERNEL32(Profile,config2,00000000,?,00000021,?), ref: 6C615C06
Part of subcall function 6C615B63: GetPrivateProfileStringA.KERNEL32(Profile,config3,00000000,?,00000021,?), ref: 6C615C1A
Part of subcall function 6C615B63: GetPrivateProfileStringA.KERNEL32(Profile,config4,00000000,?,00000021,?), ref: 6C615C32
Part of subcall function 6C615B63: GetPrivateProfileIntA.KERNEL32(Profile,config5,00000000,?), ref: 6C615C3D
Part of subcall function 6C615B63: _stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C615C5C
Part of subcall function 6C615B63: _stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C615C7A

?get_log_instance@base@@YAPAVILogger@1@XZ.COMMON(?,000000FF,?), ref: 6C616740
?get_log_instance@base@@YAPAVILogger@1@XZ.COMMON(?,?,000000FF,?), ref: 6C6167B7

Strings

[machine_guid][CSeqIDGeneratorHusk::GetSequenceIDImp]Get MAC failed, GetIDFromFile..., xrefs: 6C616783
e:\dailybuild_fix_5.4\wegame_client\codes\common\src\machine_guid_seq_id_generator_husk.cpp, xrefs: 6C616448, 6C616662, 6C61676C, 6C6167DB
[machine_guid][CSeqIDGeneratorHusk::GetSequenceIDImp]GetCacheGuid success, return, xrefs: 6C61645F
[machine_guid][CSeqIDGeneratorHusk::GetSequenceIDImp]GetIDFromFile failed, GenerateID and SetIDToFile, xrefs: 6C6167F2
[machine_guid][CSeqIDGeneratorHusk::GetSequenceIDImp]Get MAC success, Get GUID from MAC & PhysicsDrive, xrefs: 6C616679
P, xrefs: 6C6163DF

Memory Dump Source

Source File: 00000006.00000002.4141448948.000000006C591000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000006.00000002.4141374342.000000006C590000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142318714.000000006C825000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142662450.000000006C906000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142732140.000000006C907000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142791681.000000006C909000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142876110.000000006C911000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142956827.000000006C913000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143044653.000000006C91D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143105643.000000006C925000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c590000_wegame.jbxd

Similarity

API ID: memset$PrivateProfile$?get_log_instance@base@@Logger@1@Stringmemcpy$D@std@@@std@@H_prolog3_U?$char_traits@$??6?$basic_ostream@CloseErrorH_prolog3LastV01@_memcpy_s_stricmp$??1?$basic_ios@?setw@std@@ChangeCreateDirectoryFinalize@md5@@FindFolderH_prolog3_catch_HandleInit@md5@@J@1@_NotificationPathSmanip@_String@@U?$_Update@md5@@V21@@VersionVios_base@1@_strnset_sfreestrnlen
String ID: P$[machine_guid][CSeqIDGeneratorHusk::GetSequenceIDImp]Get MAC failed, GetIDFromFile...$[machine_guid][CSeqIDGeneratorHusk::GetSequenceIDImp]Get MAC success, Get GUID from MAC & PhysicsDrive$[machine_guid][CSeqIDGeneratorHusk::GetSequenceIDImp]GetCacheGuid success, return$[machine_guid][CSeqIDGeneratorHusk::GetSequenceIDImp]GetIDFromFile failed, GenerateID and SetIDToFile$e:\dailybuild_fix_5.4\wegame_client\codes\common\src\machine_guid_seq_id_generator_husk.cpp
API String ID: 3102730506-1926164388
Opcode ID: 0c1c2147125c1188d7b811c7324e4fa967b8198ed98306adab9cec23cad70a01
Instruction ID: 24d1c68a941cb95a4cd2c075976aef54365d5648747682f579e4a9dd936237f4
Opcode Fuzzy Hash: 0c1c2147125c1188d7b811c7324e4fa967b8198ed98306adab9cec23cad70a01
Instruction Fuzzy Hash: C022AE71C05298EADF21DBA8CC44BDEBBB89F56308F1440D99149B7681DB709F88CFA5

Function 0045CFAE Relevance: 33.5, APIs: 12, Strings: 7, Instructions: 259
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3_catch_GS.LIBCMT ref: 0045CFB8

Part of subcall function 00451621: __EH_prolog3.LIBCMT ref: 00451628

Part of subcall function 00420F10: memcpy.VCRUNTIME140(00000000,00000000,00000000,004204D1,00000000,00000000,00000000,?,00423FD2,00000000,00000001), ref: 00420F37

?get_cfg_by_path@common@ierd_tgp@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAV?$basic_ptree@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@property_tree@boost@@_N@Z.COMMON(?,?,00000000,log,00000003,?,?,?,000000C0,0045CDD2,00000000,00452A2A), ref: 0045D007
?get_exe_path_ex@Application@common@ierd_tgp@@SA?AVpath@filesystem@3@XZ.COMMON(?,log), ref: 0045D032
?parent_path@path@filesystem@ierd_tgp@@QBE?AV123@XZ.COMMON(?,log), ref: 0045D045

Part of subcall function 00455B3E: __EH_prolog3_GS.LIBCMT ref: 00455B45
Part of subcall function 00455B3E: ??_0path@filesystem@ierd_tgp@@QAEAAV012@ABV012@@Z.COMMON(?,00000024,0045D05C,?,00000000,?,?,log), ref: 00455B75

Part of subcall function 0040BC90: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,0040E9C2,?,?), ref: 0040BCDD

?IsSubWegameProcess@util_multi_instance@ierd_tgp@@YA_NXZ.COMMON(?,?,log), ref: 0045D089
?GetWegameProcessCount@util_multi_instance@ierd_tgp@@YAHXZ.COMMON(?,?,log), ref: 0045D096

Part of subcall function 00465712: __EH_prolog3.LIBCMT ref: 00465719

Part of subcall function 0044A70A: __EH_prolog3.LIBCMT ref: 0044A711

?get_log_instance@base@@YAPAVILogger@1@XZ.COMMON(?,?,?,?,log), ref: 0045D215
?get_log_instance@base@@YAPAVILogger@1@XZ.COMMON(00000001,00000000,?,00000000,00000000,?,00000001,03200000,00000000,00000150), ref: 0045D245
?is_static_detail_log@common@ierd_tgp@@YA_NXZ.COMMON(?,?,?,?,?,?,?,?,?,?,0045CDD2,00000000,00452A2A), ref: 0045D253

Strings

sub_instance_, xrefs: 0045D0AB
level, xrefs: 0045D13C
is_crypt, xrefs: 0045D1B0
log, xrefs: 0045D01A
log, xrefs: 0045CFED
tcls/log, xrefs: 0045D2F2
!, xrefs: 0045D365

Memory Dump Source

Source File: 00000006.00000002.4137209488.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.4137156906.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137406249.0000000000476000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137497400.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137574844.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137626631.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137684215.00000000004A3000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_wegame.jbxd

Similarity

API ID: D@std@@H_prolog3U?$char_traits@V?$allocator@V?$basic_string@$?get_log_instance@base@@D@2@@std@@Logger@1@Wegame$??_0path@filesystem@ierd_tgp@@?get_cfg_by_path@common@ierd_tgp@@?get_exe_path_ex@?is_static_detail_log@common@ierd_tgp@@?parent_path@path@filesystem@ierd_tgp@@Application@common@ierd_tgp@@Count@util_multi_instance@ierd_tgp@@D@2@@std@@@2@@property_tree@boost@@_H_prolog3_H_prolog3_catch_ProcessProcess@util_multi_instance@ierd_tgp@@U?$less@V012@V012@@V123@V12@V?$basic_ptree@Vpath@filesystem@3@_invalid_parameter_noinfo_noreturnmemcpy
String ID: !$is_crypt$level$log$log$sub_instance_$tcls/log
API String ID: 930177022-1757275872
Opcode ID: 9429155e651a05810b9541c94fb62a4631f2ad5f4ec05bfdc3534913548bee1f
Instruction ID: 831558624a23e187721c75da4d60eb9956a5d80d789f8cd24bc35c15a95a70fc
Opcode Fuzzy Hash: 9429155e651a05810b9541c94fb62a4631f2ad5f4ec05bfdc3534913548bee1f
Instruction Fuzzy Hash: 8CB13F71C0524CEADB05EBA5C955BDDBBB4AF14308F1480DEE10577282EB781B48DBA6

Function 6C646F5C Relevance: 33.4, APIs: 12, Strings: 7, Instructions: 123
registrylibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3_GS.LIBCMT ref: 6C646F66

Part of subcall function 6C59A8F0: memcpy.VCRUNTIME140(?,?,9XZl,?,?,00000000,?,?,6C5A5839,?,?), ref: 6C59A917

GetModuleHandleA.KERNEL32 ref: 6C646FC1
GetProcAddress.KERNEL32(00000000), ref: 6C646FC8
memset.VCRUNTIME140(?,00000000,00000040), ref: 6C646FDE
GlobalMemoryStatusEx.KERNEL32(00000040), ref: 6C646FF7
RegOpenKeyExA.KERNEL32(80000002,HARDWARE\DESCRIPTION\System\CentralProcessor\0,00000000,00000001,?), ref: 6C64703F
RegQueryValueExA.KERNEL32(?,~MHz,00000000,00000000,00000000,?), ref: 6C64706E
RegQueryValueExA.KERNEL32(?,~MHz,00000000,00000000,?,00000004), ref: 6C647098
RegCloseKey.KERNEL32(00000000), ref: 6C6470A9
GetModuleHandleA.KERNEL32(kernel32.dll,GetNativeSystemInfo), ref: 6C6470C6
GetProcAddress.KERNEL32(00000000), ref: 6C6470CD
GetNativeSystemInfo.KERNEL32(?), ref: 6C6470DE

Strings

GlobalMemoryStatusEx, xrefs: 6C646F9B
@, xrefs: 6C646FE6
kernel32.dll, xrefs: 6C646FA0, 6C6470C1
GetNativeSystemInfo, xrefs: 6C6470BA
%d#%d#%d#%d, xrefs: 6C6470FF
HARDWARE\DESCRIPTION\System\CentralProcessor\0, xrefs: 6C647035
~MHz, xrefs: 6C647059, 6C64708D

Memory Dump Source

Source File: 00000006.00000002.4141448948.000000006C591000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000006.00000002.4141374342.000000006C590000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142318714.000000006C825000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142662450.000000006C906000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142732140.000000006C907000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142791681.000000006C909000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142876110.000000006C911000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142956827.000000006C913000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143044653.000000006C91D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143105643.000000006C925000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c590000_wegame.jbxd

Similarity

API ID: AddressHandleModuleProcQueryValue$CloseGlobalH_prolog3_InfoMemoryNativeOpenStatusSystemmemcpymemset
String ID: %d#%d#%d#%d$@$GetNativeSystemInfo$GlobalMemoryStatusEx$HARDWARE\DESCRIPTION\System\CentralProcessor\0$kernel32.dll$~MHz
API String ID: 2987608732-3485845034
Opcode ID: c90638aa55f4d5a1ddf4fe17086e8c53f344b676926fa92c0ebd2070bdad318a
Instruction ID: 1e34e3d31af119f48fc44ba4fd1d5a7bddd2950667a887b545e4921a47cf76d6
Opcode Fuzzy Hash: c90638aa55f4d5a1ddf4fe17086e8c53f344b676926fa92c0ebd2070bdad318a
Instruction Fuzzy Hash: 80414DB1900269AFDB208FA4CD44BD9B7B8AB44348F0488EAA50DB6640D7759E84CFA4

Function 6C5DA020 Relevance: 31.7, APIs: 14, Strings: 4, Instructions: 221
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3_catch_GS.LIBCMT ref: 6C5DA02A
?u16to8@common@ierd_tgp@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@4@@Z.COMMON(?,00000008,?,0000018C,6C5DA8B2,?,?,?,?,00000000,00000200,6C5DA71B,?,?,00000000,?), ref: 6C5DA06D
?exists@filesystem@ierd_tgp@@YA_NABVpath@12@@Z.COMMON(?,?,0000018C,6C5DA8B2,?,?,?,?,00000000,00000200,6C5DA71B,?,?,00000000,?,000000A0), ref: 6C5DA081
?get_log_instance@base@@YAPAVILogger@1@XZ.COMMON(?,0000018C,6C5DA8B2,?,?,?,?,00000000,00000200,6C5DA71B,?,?,00000000,?,000000A0,6C5D7256), ref: 6C5DA09D
?parent_path@path@filesystem@ierd_tgp@@QBE?AV123@XZ.COMMON(?,?,0000018C,6C5DA8B2,?,?,?,?,00000000,00000200,6C5DA71B,?,?,00000000,?,000000A0), ref: 6C5DA10C
?exists@filesystem@ierd_tgp@@YA_NABVpath@12@@Z.COMMON(?,?,?,0000018C,6C5DA8B2,?,?,?,?,00000000,00000200,6C5DA71B,?,?,00000000,?), ref: 6C5DA119
?create_directory_ex@Sys_wrapper@common@ierd_tgp@@SA_NABVpath@filesystem@3@@Z.COMMON(?,?,?,0000018C,6C5DA8B2,?,?,?,?,00000000,00000200,6C5DA71B,?,?,00000000,?), ref: 6C5DA127
?filename@path@filesystem@ierd_tgp@@QBE?AV123@XZ.COMMON(?,?,?,0000018C,6C5DA8B2,?,?,?,?,00000000,00000200,6C5DA71B,?,?,00000000,?), ref: 6C5DA136
??0path@filesystem@ierd_tgp@@QAE@ABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z.COMMON(00000000,?,?,?,0000018C,6C5DA8B2,?,?,?,?,00000000,00000200,6C5DA71B,?,?,00000000), ref: 6C5DA143
?backup_cfg_folder@File_info@common@ierd_tgp@@SA?AVpath@filesystem@3@XZ.COMMON(?,00000000,?,?,?,0000018C,6C5DA8B2,?,?,?,?,00000000,00000200,6C5DA71B,?,?), ref: 6C5DA153
?copy_file@filesystem@ierd_tgp@@YAXABVpath@12@0@Z.COMMON(?,?), ref: 6C5DA1A8
?get_log_instance@base@@YAPAVILogger@1@XZ.COMMON ref: 6C5DA1AF
?exists@filesystem@ierd_tgp@@YA_NABVpath@12@@Z.COMMON(?), ref: 6C5DA219
?get_log_instance@base@@YAPAVILogger@1@XZ.COMMON ref: 6C5DA248

Part of subcall function 6C5AA5EF: __EH_prolog3.LIBCMT ref: 6C5AA5F6

Part of subcall function 6C5AE945: __EH_prolog3_catch_GS.LIBCMT ref: 6C5AE94C

Strings

[cfg_file_model]file copied: %s, xrefs: 6C5DA1F6
e:\dailybuild_fix_5.4\wegame_client\codes\common\src\cfg_file_model.cpp, xrefs: 6C5DA0C1, 6C5DA1D3, 6C5DA26C
[cfg_mgr][cfg_file_model]copy file failer: %s, xrefs: 6C5DA28F
[cfg_mgr]file not exist: %s, xrefs: 6C5DA0E4

Memory Dump Source

Source File: 00000006.00000002.4141448948.000000006C591000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000006.00000002.4141374342.000000006C590000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142318714.000000006C825000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142662450.000000006C906000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142732140.000000006C907000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142791681.000000006C909000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142876110.000000006C911000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142956827.000000006C913000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143044653.000000006C91D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143105643.000000006C925000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c590000_wegame.jbxd

Similarity

API ID: ?exists@filesystem@ierd_tgp@@?get_log_instance@base@@Logger@1@Vpath@12@@$H_prolog3_catch_U?$char_traits@_V123@V?$allocator@_V?$basic_string@_W@std@@$??0path@filesystem@ierd_tgp@@?backup_cfg_folder@?copy_file@filesystem@ierd_tgp@@?create_directory_ex@?filename@path@filesystem@ierd_tgp@@?parent_path@path@filesystem@ierd_tgp@@?u16to8@common@ierd_tgp@@D@2@@4@@D@std@@File_info@common@ierd_tgp@@H_prolog3Sys_wrapper@common@ierd_tgp@@U?$char_traits@V?$allocator@V?$basic_string@Vpath@12@0@Vpath@filesystem@3@Vpath@filesystem@3@@W@2@@std@@W@2@@std@@@
String ID: [cfg_file_model]file copied: %s$[cfg_mgr][cfg_file_model]copy file failer: %s$[cfg_mgr]file not exist: %s$e:\dailybuild_fix_5.4\wegame_client\codes\common\src\cfg_file_model.cpp
API String ID: 2517312394-152042586
Opcode ID: 6cd871889c70328ed795b6931f53236c4879bfec1a8378b06d4f4bc52ae1f264
Instruction ID: 99b6b16e1eb8826b5ba23f67891bb68877cefc83b8f7ac19d2c694229efd07d6
Opcode Fuzzy Hash: 6cd871889c70328ed795b6931f53236c4879bfec1a8378b06d4f4bc52ae1f264
Instruction Fuzzy Hash: 2F81CD70C01288EADF11EBE8CD54BDEBB749F55308F208088D0117B682DB71AF4ADBA5

Function 004589B8 Relevance: 31.6, APIs: 12, Strings: 6, Instructions: 121
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3_catch_GS.LIBCMT ref: 004589BF
?stamp_point@@YAXPBD@Z.COMMON(CrashReportLoaderInit begin,0000007C,00452A0B,00000000,?), ref: 004589C9

Part of subcall function 00451621: __EH_prolog3.LIBCMT ref: 00451628

Part of subcall function 00420F10: memcpy.VCRUNTIME140(00000000,00000000,00000000,004204D1,00000000,00000000,00000000,?,00423FD2,00000000,00000001), ref: 00420F37

?get_cfg_by_path@common@ierd_tgp@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAV?$basic_ptree@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@property_tree@boost@@_N@Z.COMMON(?,?,00000000,log,00000003,?,?,?,?,?,?,?,?,?,0000007C,00452A0B), ref: 00458A0F

Part of subcall function 00452794: __EH_prolog3.LIBCMT ref: 0045279B

Part of subcall function 004632E3: __EH_prolog3_GS.LIBCMT ref: 004632EA

Part of subcall function 0044CEF7: __EH_prolog3.LIBCMT ref: 0044CEFE
Part of subcall function 0044CEF7: ?_Init@locale@std@@CAPAV_Locimp@12@_N@Z.MSVCP140(00000001,?,?,?,?,00000008), ref: 0044CF15

Part of subcall function 00420D40: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,0043DEC9,F69FE839,?,?,?,0046D880,000000FF,?,0043DE1E,F69FE839,?,?,?,0046D82F,000000FF), ref: 00420D85

?is_static_detail_log@common@ierd_tgp@@YA_NXZ.COMMON(?), ref: 00458A94
?GetLastLoginedWegameId@common@ierd_tgp@@YAIXZ.COMMON(?), ref: 00458AA0
SimpleUString::operator=.MSOBJ140-MSVCRT ref: 00458AC5
?get_client_version_type@overseas@ierd_tgp@@YAHXZ.COMMON(?,?,?,?,00452A0B,00000000,?), ref: 00458AD1
?get_client_version_type@overseas@ierd_tgp@@YAHXZ.COMMON(?,?,?,?,00452A0B,00000000,?), ref: 00458AE2
SimpleUString::operator=.MSOBJ140-MSVCRT ref: 00458AF4
?Instance@CrashReportLoader@crash_report@@SAAAV12@XZ.ADAPT_FOR_IMPORTS ref: 00458B1A
?Init@CrashReportLoader@crash_report@@QAEXPB_W_K1HP6GHPAUtagCrashReportHelperCallbackInfo@@@Z0@Z.ADAPT_FOR_IMPORTS(?,00000000,00000000,0000000A,00000004,00000000,00457BEC,?), ref: 00458B46
?stamp_point@@YAXPBD@Z.COMMON(CrashReportLoaderInit end), ref: 00458B51

Strings

CrashReportLoaderInit end, xrefs: 00458B4C
level, xrefs: 00458A2B
WeGameX, xrefs: 00458ADB
CrashReportLoaderInit begin, xrefs: 004589C4
WeGame, xrefs: 00458AEC
log, xrefs: 004589F5

Memory Dump Source

Source File: 00000006.00000002.4137209488.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.4137156906.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137406249.0000000000476000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137497400.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137574844.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137626631.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137684215.00000000004A3000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_wegame.jbxd

Similarity

API ID: CrashD@std@@H_prolog3ReportU?$char_traits@V?$allocator@V?$basic_string@$?get_client_version_type@overseas@ierd_tgp@@?stamp_point@@D@2@@std@@Loader@crash_report@@SimpleString::operator=V12@$?get_cfg_by_path@common@ierd_tgp@@?is_static_detail_log@common@ierd_tgp@@CallbackD@2@@std@@@2@@property_tree@boost@@_H_prolog3_H_prolog3_catch_HelperId@common@ierd_tgp@@Info@@@Init@Init@locale@std@@Instance@LastLocimp@12@_LoginedU?$less@UtagV?$basic_ptree@Wegame_invalid_parameter_noinfo_noreturnmemcpy
String ID: CrashReportLoaderInit begin$CrashReportLoaderInit end$WeGame$WeGameX$level$log
API String ID: 2847176672-1460748738
Opcode ID: 6eb0c98c338b58acf020cec65198113a50f4194766f383ddca46c3d0f3acafc8
Instruction ID: d11f3a098ed710ad9da20e9bcf831485d98f3a6bfff5f48507318447d738e45d
Opcode Fuzzy Hash: 6eb0c98c338b58acf020cec65198113a50f4194766f383ddca46c3d0f3acafc8
Instruction Fuzzy Hash: F8417570D05248EADF10EBE9C996BDDBBB4AF14308F60815EE10577182EB781B08CB5A

Function 6C65CC70 Relevance: 30.1, APIs: 12, Strings: 5, Instructions: 384fileCOMMON

Download Yara Rule

APIs

__EH_prolog3_catch_GS.LIBCMT ref: 6C65CC7A
_Xtime_get_ticks.MSVCP140(0000022C), ref: 6C65CC9C

Part of subcall function 6C65BE4B: __EH_prolog3_GS.LIBCMT ref: 6C65BE52

?get_log_instance@base@@YAPAVILogger@1@XZ.COMMON(?,?,?,?,?,?,?,?,?,?,?,?,0000022C), ref: 6C65CCE1
??0path@filesystem@ierd_tgp@@QAE@ABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z.COMMON(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C65CDF1
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C65CF3F
DeleteFileW.KERNEL32(?,?,?,61C46800,00000008,?,?,?,00000000,00000000,00000000,?,?,?), ref: 6C65CFD5
?get_log_instance@base@@YAPAVILogger@1@XZ.COMMON ref: 6C65CFDF
?get_log_instance@base@@YAPAVILogger@1@XZ.COMMON ref: 6C65D057
?get_log_instance@base@@YAPAVILogger@1@XZ.COMMON(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,0000022C), ref: 6C65D1C9
GetLastError.KERNEL32(00000000,00000003,e:\dailybuild_fix_5.4\wegame_client\codes\common\src\utility.cpp,00000030,6C8B5E9F), ref: 6C65D021

Part of subcall function 6C5AA5EF: __EH_prolog3.LIBCMT ref: 6C5AA5F6

DeleteFileW.KERNEL32(6C91F124,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C65D22C

Strings

e:\dailybuild_fix_5.4\wegame_client\codes\common\src\utility.cpp, xrefs: 6C65CD02, 6C65D008, 6C65D078, 6C65D1EA
DeleteExpiredFiles DeleteFileW log file[{}], xrefs: 6C65D205
DeleteExpiredFiles delete log file[{}] success, xrefs: 6C65D093
DeleteExpiredFiles delete log file[{}] failed:[{}], xrefs: 6C65D038
DeleteExpiredFiles check folder:{}, xrefs: 6C65CD1A

Memory Dump Source

Source File: 00000006.00000002.4141448948.000000006C591000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000006.00000002.4141374342.000000006C590000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142318714.000000006C825000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142662450.000000006C906000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142732140.000000006C907000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142791681.000000006C909000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142876110.000000006C911000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142956827.000000006C913000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143044653.000000006C91D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143105643.000000006C925000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c590000_wegame.jbxd

Similarity

API ID: ?get_log_instance@base@@Logger@1@$DeleteFile$??0path@filesystem@ierd_tgp@@ErrorH_prolog3H_prolog3_H_prolog3_catch_LastU?$char_traits@_Unothrow_t@std@@@V?$allocator@_V?$basic_string@_W@2@@std@@@W@std@@Xtime_get_ticks__ehfuncinfo$??2@
String ID: DeleteExpiredFiles DeleteFileW log file[{}]$DeleteExpiredFiles check folder:{}$DeleteExpiredFiles delete log file[{}] failed:[{}]$DeleteExpiredFiles delete log file[{}] success$e:\dailybuild_fix_5.4\wegame_client\codes\common\src\utility.cpp
API String ID: 2732379511-1639003202
Opcode ID: 7018c32425d3f7e26f7d9074a36adae840c65125b51658ef892a3dbc64fbf783
Instruction ID: 931ca8c1014a26b0d8e273122e7ac6f0ad7c418e5fe4f14e5c607be2c40e83f3
Opcode Fuzzy Hash: 7018c32425d3f7e26f7d9074a36adae840c65125b51658ef892a3dbc64fbf783
Instruction Fuzzy Hash: 36026871D04258EACB21DFA8C950BDDB7B4AF5A308F6081DAD409B7680DB705F89CF95

Function 6C6168DF Relevance: 30.1, APIs: 10, Strings: 7, Instructions: 321fileCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6C6168E9
SetFilePointer.KERNEL32(?,00000000,00000000,00000000,00000240,6C6166D7,00000000,?,?,?,?,?,00000010,?,000000FF,?), ref: 6C616933
SetEndOfFile.KERNEL32(?), ref: 6C61693F
GetFileSize.KERNEL32(?,00000000), ref: 6C616954
CreateFileA.KERNEL32(00000010,C0000000,00000003,00000000,00000002,00000080,00000000), ref: 6C616980
CloseHandle.KERNEL32(00000000), ref: 6C6169AF
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C6169BE
__snprintf_s.LIBCMT ref: 6C6169F1

Part of subcall function 6C59A3A0: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,6C5A62D8,00000000,6C5A6649,00000003,9C33995A,?,?,00000000,6C7FF594,000000FF,?,6C5A5B05,00000000), ref: 6C59A3E5

WriteFile.KERNEL32(00000000,?,?,?,00000000,00000000), ref: 6C616D4D
CloseHandle.KERNEL32(00000000), ref: 6C616D61

Strings

config3, xrefs: 6C616B07
config4, xrefs: 6C616B5C
config5, xrefs: 6C616BB2
config1, xrefs: 6C616A5D
%02x, xrefs: 6C6169E7
config2, xrefs: 6C616AB5
[Profile], xrefs: 6C616A31

Memory Dump Source

Source File: 00000006.00000002.4141448948.000000006C591000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000006.00000002.4141374342.000000006C590000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142318714.000000006C825000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142662450.000000006C906000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142732140.000000006C907000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142791681.000000006C909000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142876110.000000006C911000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142956827.000000006C913000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143044653.000000006C91D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143105643.000000006C925000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c590000_wegame.jbxd

Similarity

API ID: File$CloseHandle$CreateH_prolog3_PointerSizeWrite__snprintf_s_invalid_parameter_noinfo_noreturnmemset
String ID: %02x$[Profile]$config1$config2$config3$config4$config5
API String ID: 2584474234-2983988086
Opcode ID: f2dfdeca72b34bd9ef5bd2603d8eb0f8b24cbac5064e954032d61a6d1b9cf503
Instruction ID: 50c41e10e5c24681cbf58ce40989302f11278a8f48cc6e36a320c8868dec8309
Opcode Fuzzy Hash: f2dfdeca72b34bd9ef5bd2603d8eb0f8b24cbac5064e954032d61a6d1b9cf503
Instruction Fuzzy Hash: 05D1CE70C0529CEADB21CBA4CC48BDEBBB8AF55308F1445D9E009B7681DB745F88DBA1

Function 6C62237B Relevance: 30.0, APIs: 8, Strings: 9, Instructions: 209COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6C622385
memset.VCRUNTIME140(?,00000000,00000104,00000868,6C625F7C,00000118,6C6252C7,00000001,00000001,0000000F,00000000,00000001,?,00000000,0000000F,00000002), ref: 6C62239B
memset.VCRUNTIME140(?,00000000,00000104,?,00000000,00000104,00000868,6C625F7C,00000118,6C6252C7,00000001,00000001,0000000F,00000000,00000001,?), ref: 6C6223AB
memset.VCRUNTIME140(?,00000000,00000104,?,00000000,00000104,?,00000000,00000104,00000868,6C625F7C,00000118,6C6252C7,00000001,00000001,0000000F), ref: 6C6223B9
memset.VCRUNTIME140(?,00000000,00000104,?,00000000,00000104,?,00000000,00000104,?,00000000,00000104,00000868,6C625F7C,00000118,6C6252C7), ref: 6C6223C7
memset.VCRUNTIME140(?,00000000,00000400,?,?), ref: 6C6224FA

Part of subcall function 6C5A04F0: __stdio_common_vsprintf_s.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000020,?,6C5A08F4,00000000,?,?,6C5A08F4,?,00000020,%#.16g,?,00000010), ref: 6C5A050C

?get_log_instance@base@@YAPAVILogger@1@XZ.COMMON ref: 6C622563

Part of subcall function 6C5AA5EF: __EH_prolog3.LIBCMT ref: 6C5AA5F6

?get_log_instance@base@@YAPAVILogger@1@XZ.COMMON ref: 6C6225BE

Strings

ied-tqosweb.qq.com, xrefs: 6C622408
ied-tqos-tgp.qq.com, xrefs: 6C6223F0, 6C6223FB, 6C62244B
[qos_t]InitQos success, xrefs: 6C622601
ied-tqos.qq.com, xrefs: 6C6223E3
tqos.wegamex.com.hk, xrefs: 6C62241C, 6C622427
[qos_t]InitQos failed, {}, xrefs: 6C6225B0
ied-tqosweb.wegamex.com.hk, xrefs: 6C622434
ied-tqos.wegamex.com.hk, xrefs: 6C62240F
e:\dailybuild_fix_5.4\wegame_client\codes\common\src\qos_command.cpp, xrefs: 6C62258F, 6C6225E4

Memory Dump Source

Source File: 00000006.00000002.4141448948.000000006C591000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000006.00000002.4141374342.000000006C590000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142318714.000000006C825000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142662450.000000006C906000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142732140.000000006C907000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142791681.000000006C909000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142876110.000000006C911000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142956827.000000006C913000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143044653.000000006C91D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143105643.000000006C925000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c590000_wegame.jbxd

Similarity

API ID: memset$?get_log_instance@base@@Logger@1@$H_prolog3H_prolog3___stdio_common_vsprintf_s
String ID: [qos_t]InitQos failed, {}$[qos_t]InitQos success$e:\dailybuild_fix_5.4\wegame_client\codes\common\src\qos_command.cpp$ied-tqos-tgp.qq.com$ied-tqos.qq.com$ied-tqos.wegamex.com.hk$ied-tqosweb.qq.com$ied-tqosweb.wegamex.com.hk$tqos.wegamex.com.hk
API String ID: 2915109889-298735265
Opcode ID: dafceadc4f7c2299f406aa31cb774777e4cd38caa16ae3a85ffdf33ed3210f81
Instruction ID: 113a754b25543bf158bbd43a3c4504fa1d2615f961f63eb258c3010e66057893
Opcode Fuzzy Hash: dafceadc4f7c2299f406aa31cb774777e4cd38caa16ae3a85ffdf33ed3210f81
Instruction Fuzzy Hash: B4613BB1900219ABCB24DBA0CD48FEE776CAF45718F004599A509A7781DB34DF4ACFE4

Function 6C614DDC Relevance: 29.9, APIs: 12, Strings: 5, Instructions: 137registrystringCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32(80000002,System\CurrentControlSet\Control\Network\{4D36E972-E325-11CE-BFC1-08002BE10318},00000000,00020019,?,?,?,00000003), ref: 6C614E3C
__snprintf_s.LIBCMT ref: 6C614E5A
RegOpenKeyExA.KERNEL32(?,?,00000000,00020019,?), ref: 6C614E7D
RegQueryValueExA.KERNEL32(?,MediaSubType,00000000,?,?,00000104), ref: 6C614EC4
memset.VCRUNTIME140(?,00000000,00000104), ref: 6C614EEF
RegQueryValueExA.ADVAPI32(?,PnpInstanceID,00000000,00000001,?,00000103), ref: 6C614F19
strlen.API-MS-WIN-CRT-STRING-L1-1-0(PCI), ref: 6C614F30
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,PCI,00000000,PCI), ref: 6C614F44
strlen.API-MS-WIN-CRT-STRING-L1-1-0(PCI), ref: 6C614F61
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,PCI,00000000,PCI), ref: 6C614F73
RegCloseKey.KERNEL32(?), ref: 6C614F96
RegCloseKey.ADVAPI32(?), ref: 6C614F9E

Strings

PCI, xrefs: 6C614F2A, 6C614F2F, 6C614F36, 6C614F5C, 6C614F6D
%s\Connection, xrefs: 6C614E47
MediaSubType, xrefs: 6C614EB9
PnpInstanceID, xrefs: 6C614F0E
System\CurrentControlSet\Control\Network\{4D36E972-E325-11CE-BFC1-08002BE10318}, xrefs: 6C614E20

Memory Dump Source

Source File: 00000006.00000002.4141448948.000000006C591000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000006.00000002.4141374342.000000006C590000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142318714.000000006C825000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142662450.000000006C906000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142732140.000000006C907000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142791681.000000006C909000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142876110.000000006C911000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142956827.000000006C913000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143044653.000000006C91D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143105643.000000006C925000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c590000_wegame.jbxd

Similarity

API ID: CloseOpenQueryValuestrlenstrncmp$__snprintf_smemset
String ID: %s\Connection$MediaSubType$PCI$PnpInstanceID$System\CurrentControlSet\Control\Network\{4D36E972-E325-11CE-BFC1-08002BE10318}
API String ID: 3706059900-3769660923
Opcode ID: 6f89fbe523b5d0c5c0209e4800467657d09272d2604eb7d8632c9b5e5f200da0
Instruction ID: bd471db57a937227340e54017380d2fc129340643e3c8364592b7990bb7f1962
Opcode Fuzzy Hash: 6f89fbe523b5d0c5c0209e4800467657d09272d2604eb7d8632c9b5e5f200da0
Instruction Fuzzy Hash: DB4173B194422CAFDB25DB55CD82FDAB3BCAB45309F0005A6E608E6640D7B09EC58FD4

Function 00456B68 Relevance: 29.9, APIs: 8, Strings: 9, Instructions: 123COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00456B6F
?get_log_instance@base@@YAPAVILogger@1@XZ.COMMON(0000007C,00452AB0), ref: 00456B76
?get_app_sub_path@Application@common@ierd_tgp@@SA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V45@@Z.COMMON(?,?,?,?,?,?,?,?,?,0000007C,00452AB0), ref: 00456BF7
?ReadPrivateProfile@Sys_wrapper@common@ierd_tgp@@SA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0AAHAAV45@@Z.COMMON(tgp,OverwriteStatus,?,?,?,?,?,?,?,?,?,?,?,0000007C,00452AB0), ref: 00456C19
?ReadPrivateProfile@Sys_wrapper@common@ierd_tgp@@SA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0AAHAAV45@@Z.COMMON(tgp,SubError,?,?), ref: 00456C47
?ReadPrivateProfile@Sys_wrapper@common@ierd_tgp@@SA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0AAHAAV45@@Z.COMMON(tgp,TickWaitMain,?,?,tgp,SubError,?,?), ref: 00456C5A
?ReadPrivateProfile@Sys_wrapper@common@ierd_tgp@@SA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0AAHAAV45@@Z.COMMON(tgp,TickMoveFile,?,?,tgp,TickWaitMain,?,?,tgp,SubError,?,?), ref: 00456C6D
?get_log_instance@base@@YAPAVILogger@1@XZ.COMMON ref: 00456C8F

Part of subcall function 0043DD1B: __EH_prolog3.LIBCMT ref: 0043DD22

Part of subcall function 0043F2BB: __EH_prolog3_catch_GS.LIBCMT ref: 0043F2C2

Strings

[main]CheckLastUpdate, xrefs: 00456BB1
SubError, xrefs: 00456C3E
tgp, xrefs: 00456C13, 00456C18, 00456C43, 00456C59, 00456C6C
TickMoveFile, xrefs: 00456C67
OverwriteStatus, xrefs: 00456C0E
TickWaitMain, xrefs: 00456C54
e:\dailybuild_fix_5.4\wegame_client\codes\main\tgp_daemon\src\tgp_daemon_main.cpp, xrefs: 00456B9D, 00456CB3
[main][Liveupdate]not in file-overwritting process, xrefs: 00456CCF
update.tmp, xrefs: 00456BD7

Memory Dump Source

Source File: 00000006.00000002.4137209488.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.4137156906.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137406249.0000000000476000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137497400.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137574844.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137626631.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137684215.00000000004A3000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_wegame.jbxd

Similarity

API ID: D@std@@U?$char_traits@V45@@V?$allocator@V?$basic_string@$D@2@@std@@0PrivateProfile@ReadSys_wrapper@common@ierd_tgp@@$?get_log_instance@base@@Logger@1@$?get_app_sub_path@Application@common@ierd_tgp@@D@2@@std@@H_prolog3H_prolog3_H_prolog3_catch_
String ID: OverwriteStatus$SubError$TickMoveFile$TickWaitMain$[main]CheckLastUpdate$[main][Liveupdate]not in file-overwritting process$e:\dailybuild_fix_5.4\wegame_client\codes\main\tgp_daemon\src\tgp_daemon_main.cpp$tgp$update.tmp
API String ID: 1990170196-1272256956
Opcode ID: c5eb565d953049fafc77581deb87313a8e23dd4e2d734e84645ef3d631771782
Instruction ID: 0876260936830ebf31460acae4d9da03aaf25ae8567b781e236bc1d0c2869dc8
Opcode Fuzzy Hash: c5eb565d953049fafc77581deb87313a8e23dd4e2d734e84645ef3d631771782
Instruction Fuzzy Hash: F441A071D01218ABDF11EFA1CD82BDD7B34AF08709F60416FF90167282DBB99A458B99

Function 004577BA Relevance: 28.2, APIs: 9, Strings: 7, Instructions: 242fileCOMMON

Download Yara Rule

APIs

__EH_prolog3_catch_GS.LIBCMT ref: 004577C4
SimpleUString::operator=.MSOBJ140-MSVCRT ref: 00457811
SimpleUString::operator=.MSOBJ140-MSVCRT ref: 0045783D
SimpleUString::operator=.MSOBJ140-MSVCRT ref: 00457860
SimpleUString::operator=.MSOBJ140-MSVCRT ref: 00457883

Part of subcall function 00452499: __EH_prolog3.LIBCMT ref: 004524A0

Part of subcall function 0044A03F: __EH_prolog3_GS.LIBCMT ref: 0044A046

Part of subcall function 00450F37: __EH_prolog3_GS.LIBCMT ref: 00450F41
Part of subcall function 00450F37: _Open_dir.MSVCP140(?,?,?,?,?,?,?,00000000,Function_0005FAB3,00000218), ref: 00450FBD

Part of subcall function 0043DD6D: __EH_prolog3.LIBCMT ref: 0043DD74

Part of subcall function 00462A41: __EH_prolog3_GS.LIBCMT ref: 00462A48

Part of subcall function 0040BC90: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,0040E9C2,?,?), ref: 0040BCDD

DeleteFileW.KERNEL32(?,00000000,?,?,00000000,?,?,?,?,00000018,00000004,Function_0000BC90,000001D4), ref: 00457993
?get_log_instance@base@@YAPAVILogger@1@XZ.COMMON ref: 004579A1
GetLastError.KERNEL32(?,00000005,e:\dailybuild_fix_5.4\wegame_client\codes\main\tgp_daemon\src\tgp_daemon_main.cpp,00000352,00484367), ref: 004579F3
?get_log_instance@base@@YAPAVILogger@1@XZ.COMMON ref: 00457A5B

Strings

daemon_m.log, xrefs: 0045787B
clear_log_file, delete log file[%s] failed:[%d], xrefs: 00457A21
TinyNew.log, xrefs: 00457832
e:\dailybuild_fix_5.4\wegame_client\codes\main\tgp_daemon\src\tgp_daemon_main.cpp, xrefs: 004579D1, 00457A8B
TinyDL_Ex.log, xrefs: 00457806
daemon_x.log, xrefs: 00457858
clear_log_file, delete log file[%s] success, xrefs: 00457AC9

Memory Dump Source

Source File: 00000006.00000002.4137209488.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.4137156906.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137406249.0000000000476000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137497400.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137574844.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137626631.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137684215.00000000004A3000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_wegame.jbxd

Similarity

API ID: SimpleString::operator=$H_prolog3_$?get_log_instance@base@@H_prolog3Logger@1@$DeleteErrorFileH_prolog3_catch_LastOpen_dir_invalid_parameter_noinfo_noreturn
String ID: TinyDL_Ex.log$TinyNew.log$clear_log_file, delete log file[%s] failed:[%d]$clear_log_file, delete log file[%s] success$daemon_m.log$daemon_x.log$e:\dailybuild_fix_5.4\wegame_client\codes\main\tgp_daemon\src\tgp_daemon_main.cpp
API String ID: 3116233958-2175410631
Opcode ID: 4bcbf4ced5a68d50e24c099f2180f57c3bcf2eb90f535103ab3f7369ab94080c
Instruction ID: 2fedfc31f6d1d69dc5e826574d797ff7bc418db444c0ea85556b6dcca2311f4e
Opcode Fuzzy Hash: 4bcbf4ced5a68d50e24c099f2180f57c3bcf2eb90f535103ab3f7369ab94080c
Instruction Fuzzy Hash: 38B15930D05248DEEB11DBA4D945BDDBBB0AF15308F2080EEE409B7292EB785F48DB56

Function 6C644AD6 Relevance: 28.1, APIs: 10, Strings: 6, Instructions: 122registryCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6C644AE0

Part of subcall function 6C59A8F0: memcpy.VCRUNTIME140(?,?,9XZl,?,?,00000000,?,?,6C5A5839,?,?), ref: 6C59A917

RegOpenKeyExW.KERNEL32(80000002,HARDWARE\DESCRIPTION\System\CentralProcessor\0,00000000,00020019,?,unknow,00000006,0000027C), ref: 6C644B0F
memset.VCRUNTIME140(?,00000000,00000208), ref: 6C644B2A
RegQueryValueExW.KERNEL32(?,ProcessorNameString,00000000,?,?,00000104), ref: 6C644B67
?u16to8@common@ierd_tgp@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@4@@Z.COMMON(?,?,?), ref: 6C644BB3

Part of subcall function 6C63347E: __EH_prolog3_GS.LIBCMT ref: 6C633485

?get_log_instance@base@@YAPAVILogger@1@XZ.COMMON ref: 6C644BCE
GetLastError.KERNEL32(00000000,00000005,e:\dailybuild_fix_5.4\wegame_client\codes\common\src\sys_wrapper.cpp,0000057B,6C8B5E9F), ref: 6C644C16
?get_log_instance@base@@YAPAVILogger@1@XZ.COMMON ref: 6C644C2F
GetLastError.KERNEL32(00000000,00000005,e:\dailybuild_fix_5.4\wegame_client\codes\common\src\sys_wrapper.cpp,0000057E,6C8B5E9F), ref: 6C644C6F
RegCloseKey.KERNEL32(?), ref: 6C644C9A

Strings

ProcessorNameString, xrefs: 6C644B5C
unknow, xrefs: 6C644AEC
e:\dailybuild_fix_5.4\wegame_client\codes\common\src\sys_wrapper.cpp, xrefs: 6C644BFA, 6C644C53
HARDWARE\DESCRIPTION\System\CentralProcessor\0, xrefs: 6C644B05
[Sys_wrapper][get_cpu_name]open cpu reg failed. error_code=%d, xrefs: 6C644C76
[Sys_wrapper][get_cpu_name]query cpu reg failed. query_result = %d,error_code=%d, xrefs: 6C644C1E

Memory Dump Source

Source File: 00000006.00000002.4141448948.000000006C591000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000006.00000002.4141374342.000000006C590000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142318714.000000006C825000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142662450.000000006C906000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142732140.000000006C907000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142791681.000000006C909000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142876110.000000006C911000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142956827.000000006C913000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143044653.000000006C91D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143105643.000000006C925000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c590000_wegame.jbxd

Similarity

API ID: ?get_log_instance@base@@ErrorH_prolog3_LastLogger@1@$?u16to8@common@ierd_tgp@@CloseD@2@@4@@D@std@@OpenQueryU?$char_traits@U?$char_traits@_V?$allocator@V?$allocator@_V?$basic_string@V?$basic_string@_ValueW@2@@std@@W@std@@memcpymemset
String ID: HARDWARE\DESCRIPTION\System\CentralProcessor\0$ProcessorNameString$[Sys_wrapper][get_cpu_name]open cpu reg failed. error_code=%d$[Sys_wrapper][get_cpu_name]query cpu reg failed. query_result = %d,error_code=%d$e:\dailybuild_fix_5.4\wegame_client\codes\common\src\sys_wrapper.cpp$unknow
API String ID: 283322450-288352418
Opcode ID: 92b74a3e180bef90bcc260114bc7754e47d07df7353a1e41dea37894d5d5fa6a
Instruction ID: edd875811c59365e0ac866c7081596e54685a7fb42c0a9c03ac95267e435f21b
Opcode Fuzzy Hash: 92b74a3e180bef90bcc260114bc7754e47d07df7353a1e41dea37894d5d5fa6a
Instruction Fuzzy Hash: 1941A671941228ABDB70DFA0CC89BEE7778AF45308F108599A40967790DB715E4ACFD8

Function 6C624E51 Relevance: 26.6, APIs: 8, Strings: 7, Instructions: 390COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6C624E58
?get_log_instance@base@@YAPAVILogger@1@XZ.COMMON(0000007C,6C625A1C,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C624E6A
?get_log_instance@base@@YAPAVILogger@1@XZ.COMMON(?,0000007C,6C625A1C,?), ref: 6C624F59
?get_log_instance@base@@YAPAVILogger@1@XZ.COMMON(00000001,00000001,0000000F,00000002,0000000F,00000000,00000001,?,0000007C,6C625A1C,?), ref: 6C624FED
?get_log_instance@base@@YAPAVILogger@1@XZ.COMMON(00000001,00000001,0000000F,00000002,0000000F,00000000,00000001,00000000,0000000F,00000002,0000000F,00000000,00000001,?,0000007C,6C625A1C), ref: 6C625165
?get_log_instance@base@@YAPAVILogger@1@XZ.COMMON(00000000,00000001,?,00000001,0000000F,00000002,0000000F,00000000,00000001,00000000,0000000F,00000002,0000000F,00000000,00000001,?), ref: 6C6251F0
?get_log_instance@base@@YAPAVILogger@1@XZ.COMMON(00000001,00000001,0000000F,00000000,00000001,?,00000000,0000000F,00000002,0000000F,00000000,00000001,?,0000007C,6C625A1C,?), ref: 6C6252CA
?get_log_instance@base@@YAPAVILogger@1@XZ.COMMON(00000000,00000001,?,00000001,0000000F,00000002,0000000F,00000000,00000001,?,0000007C,6C625A1C,?), ref: 6C625078

Part of subcall function 6C5AA5EF: __EH_prolog3.LIBCMT ref: 6C5AA5F6

Part of subcall function 6C5AE945: __EH_prolog3_catch_GS.LIBCMT ref: 6C5AE94C

Part of subcall function 6C625F5C: __EH_prolog3_GS.LIBCMT ref: 6C625F66
Part of subcall function 6C625F5C: ?get_log_instance@base@@YAPAVILogger@1@XZ.COMMON(00000003,00000001,00000118,6C6252C7,00000001,00000001,0000000F,00000000,00000001,?,00000000,0000000F,00000002,0000000F,00000000,00000001), ref: 6C625FB8
Part of subcall function 6C625F5C: ?get_log_instance@base@@YAPAVILogger@1@XZ.COMMON(00000001,?,00000000,00000003,00000001,00000118,6C6252C7,00000001,00000001,0000000F,00000000,00000001,?,00000000,0000000F,00000002), ref: 6C62604F

Strings

[qos_t]id=%d report http to old server, xrefs: 6C62522E
[qos_t]OfflineMode, disable real_report: %d., xrefs: 6C624EA9
[qos_t] can`t find qos id for kind = %d, xrefs: 6C624FA2
[qos_t]id=%d report http to new server, xrefs: 6C6251A3, 6C625308
[qos_t]id=%d report udp to old server, xrefs: 6C6250B6
e:\dailybuild_fix_5.4\wegame_client\codes\common\src\qos_command.cpp, xrefs: 6C624E8E, 6C624F85, 6C625011, 6C62509C, 6C625189, 6C625214, 6C6252EE
[qos_t]id=%d report udp to new server, xrefs: 6C62502B

Memory Dump Source

Source File: 00000006.00000002.4141448948.000000006C591000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000006.00000002.4141374342.000000006C590000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142318714.000000006C825000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142662450.000000006C906000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142732140.000000006C907000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142791681.000000006C909000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142876110.000000006C911000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142956827.000000006C913000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143044653.000000006C91D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143105643.000000006C925000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c590000_wegame.jbxd

Similarity

API ID: ?get_log_instance@base@@Logger@1@$H_prolog3_$H_prolog3H_prolog3_catch_
String ID: [qos_t] can`t find qos id for kind = %d$[qos_t]OfflineMode, disable real_report: %d.$[qos_t]id=%d report http to new server$[qos_t]id=%d report http to old server$[qos_t]id=%d report udp to new server$[qos_t]id=%d report udp to old server$e:\dailybuild_fix_5.4\wegame_client\codes\common\src\qos_command.cpp
API String ID: 2885499593-3935758042
Opcode ID: edcb553442d46a9dc4eaedd1488b40a551b0ffaf2fd7deb6416e38428d0d1db4
Instruction ID: 07e4d7472827a76f9ceb81b3120aaa2d1a9624023fddbe5cf6d74f1366b2bf1b
Opcode Fuzzy Hash: edcb553442d46a9dc4eaedd1488b40a551b0ffaf2fd7deb6416e38428d0d1db4
Instruction Fuzzy Hash: E1E1ACB0E01718ABCB24DFE4C950ADDBBB1AF45308F204558E8197B786DB75AD06CF98

Function 6C5DA7E6 Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 248COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6C5DA7F0

Part of subcall function 6C5DA4AF: __EH_prolog3_catch_GS.LIBCMT ref: 6C5DA4B9
Part of subcall function 6C5DA4AF: ?is_absolute@path@filesystem@ierd_tgp@@QBE_NXZ.COMMON ref: 6C5DA4D6
Part of subcall function 6C5DA4AF: ?current_path@filesystem@ierd_tgp@@YA?AVpath@12@XZ.COMMON(?), ref: 6C5DA4F1
Part of subcall function 6C5DA4AF: ?absolute@filesystem@ierd_tgp@@YA?AVpath@12@ABV312@0@Z.COMMON(00000000,?,00000000,?), ref: 6C5DA51F

?get_log_instance@base@@YAPAVILogger@1@XZ.COMMON(?,?,?,?,00000000,00000200,6C5DA71B,?,?,00000000,?,000000A0,6C5D7256,?), ref: 6C5DA9FB

Part of subcall function 6C5D49FD: __EH_prolog3.LIBCMT ref: 6C5D4A04

??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ.MSVCP140(?,00000020,00000040,00000001,?,?,?,?,00000000,00000200,6C5DA71B,?,?,00000000,?,000000A0), ref: 6C5DA9EE

Part of subcall function 6C5D4B98: __EH_prolog3.LIBCMT ref: 6C5D4B9F
Part of subcall function 6C5D4B98: ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ.MSVCP140(00000008,6C5DA8EB,00000001,00000001,?,00000020,00000040,00000001,?,?,?,?,00000000,00000200,6C5DA71B,?), ref: 6C5D4BBC
Part of subcall function 6C5D4B98: ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z.MSVCP140(00000007,00000000,00000000,00000008,6C5DA8EB,00000001,00000001,?,00000020,00000040,00000001,?,?,?,?,00000000), ref: 6C5D4BD4

?decode_stream@common@ierd_tgp@@YA?AV?$optional@V?$reference_wrapper@V?$basic_istringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@std@@@std@@AAV?$basic_istream@DU?$char_traits@D@std@@@4@AAV?$basic_istringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@4@@Z.COMMON(?,?,?,00000001,00000001,?,00000020,00000040,00000001,?,?,?,?,00000000,00000200,6C5DA71B), ref: 6C5DA904

Part of subcall function 6C5EEC6D: __EH_prolog3_GS.LIBCMT ref: 6C5EEC77
Part of subcall function 6C5EEC6D: ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z.MSVCP140(00000008,00000002,00000001,000000BC,6C5DA909,?,?,?,00000001,00000001,?,00000020,00000040,00000001,?,?), ref: 6C5EECA7
Part of subcall function 6C5EEC6D: ?decode_string@common@ierd_tgp@@YA?AV?$optional@V?$reference_wrapper@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@std@@@std@@AAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@4@@Z.COMMON(?,00000000,00000000), ref: 6C5EECC8
Part of subcall function 6C5EEC6D: ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ.MSVCP140(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000094), ref: 6C5EED0F

?get_log_instance@base@@YAPAVILogger@1@XZ.COMMON(?,?,?), ref: 6C5DA913

Part of subcall function 6C5AA5EF: __EH_prolog3.LIBCMT ref: 6C5AA5F6

Part of subcall function 6C5AE945: __EH_prolog3_catch_GS.LIBCMT ref: 6C5AE94C

??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ.MSVCP140(?,?,?), ref: 6C5DA9A0
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ.MSVCP140(?,?,?), ref: 6C5DA9BB
?u16to8@common@ierd_tgp@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@4@@Z.COMMON(?,00000000,?,?,?,00000000,00000200,6C5DA71B,?,?,00000000,?,000000A0,6C5D7256,?), ref: 6C5DA890

Part of subcall function 6C63347E: __EH_prolog3_GS.LIBCMT ref: 6C633485

Part of subcall function 6C5DA020: __EH_prolog3_catch_GS.LIBCMT ref: 6C5DA02A
Part of subcall function 6C5DA020: ?u16to8@common@ierd_tgp@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@4@@Z.COMMON(?,00000008,?,0000018C,6C5DA8B2,?,?,?,?,00000000,00000200,6C5DA71B,?,?,00000000,?), ref: 6C5DA06D
Part of subcall function 6C5DA020: ?exists@filesystem@ierd_tgp@@YA_NABVpath@12@@Z.COMMON(?,?,0000018C,6C5DA8B2,?,?,?,?,00000000,00000200,6C5DA71B,?,?,00000000,?,000000A0), ref: 6C5DA081

?u16to8@common@ierd_tgp@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@4@@Z.COMMON(?,00000000,?,?,?,00000000,00000200,6C5DA71B,?,?,00000000,?,000000A0,6C5D7256,?), ref: 6C5DAA98
?get_log_instance@base@@YAPAVILogger@1@XZ.COMMON(?,?,?,00000000,00000200,6C5DA71B,?,?,00000000,?,000000A0,6C5D7256,?), ref: 6C5DAAAB

Strings

[cfg_mgr][cfg_file]decode failed, path:%s, xrefs: 6C5DA95A
e:\dailybuild_fix_5.4\wegame_client\codes\common\src\cfg_file_model.cpp, xrefs: 6C5DA937, 6C5DAA27, 6C5DAACF
[cfg_file_model]file not exist, path:%s, xrefs: 6C5DAA4A
[cfg_file_model][read_cfg_tree]get_full_cfg_path failed, path:%s, xrefs: 6C5DAAF2

Memory Dump Source

Source File: 00000006.00000002.4141448948.000000006C591000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000006.00000002.4141374342.000000006C590000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142318714.000000006C825000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142662450.000000006C906000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142732140.000000006C907000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142791681.000000006C909000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142876110.000000006C911000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142956827.000000006C913000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143044653.000000006C91D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143105643.000000006C925000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c590000_wegame.jbxd

Similarity

API ID: U?$char_traits@$D@std@@D@std@@@std@@V?$allocator@$D@2@@4@@V?$basic_string@$??1?$basic_ios@$?get_log_instance@base@@?u16to8@common@ierd_tgp@@H_prolog3H_prolog3_H_prolog3_catch_Logger@1@U?$char_traits@_V?$allocator@_V?$basic_string@_W@2@@std@@W@std@@$D@2@@std@@@std@@@std@@V?$basic_istringstream@V?$basic_streambuf@V?$optional@V?$reference_wrapper@Vpath@12@$??0?$basic_ios@??0?$basic_istream@??6?$basic_ostream@?absolute@filesystem@ierd_tgp@@?current_path@filesystem@ierd_tgp@@?decode_stream@common@ierd_tgp@@?decode_string@common@ierd_tgp@@?exists@filesystem@ierd_tgp@@?is_absolute@path@filesystem@ierd_tgp@@D@std@@@1@@D@std@@@1@_D@std@@@4@V01@V312@0@V?$basic_istream@Vpath@12@@
String ID: [cfg_file_model][read_cfg_tree]get_full_cfg_path failed, path:%s$[cfg_file_model]file not exist, path:%s$[cfg_mgr][cfg_file]decode failed, path:%s$e:\dailybuild_fix_5.4\wegame_client\codes\common\src\cfg_file_model.cpp
API String ID: 3693779796-611951753
Opcode ID: 30d927d3366a3e0bb8aec18373f93d6936896ed447993a16bd2e325d320e907c
Instruction ID: f418cdbe81e7ebe6aafdefd3b505def46e54919c1cdeb372e445220ed35d1c43
Opcode Fuzzy Hash: 30d927d3366a3e0bb8aec18373f93d6936896ed447993a16bd2e325d320e907c
Instruction Fuzzy Hash: B5A1AB71D01348DEDB10DBE8CD44BDEBBB4AF59308F144499E144B7681EB70AE88CBA6

Function 6C5B3D44 Relevance: 24.6, APIs: 12, Strings: 2, Instructions: 94stringCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,00000100), ref: 6C5B3D70
strcpy_s.API-MS-WIN-CRT-STRING-L1-1-0(?,00000100,?), ref: 6C5B3D89
CreateWindowExA.USER32(00000000,static,?,00000000,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000), ref: 6C5B3DC5
SetLastError.KERNEL32(00000000), ref: 6C5B3DD3
SetWindowLongA.USER32(00000000,000000FC,?), ref: 6C5B3DDD
GetLastError.KERNEL32 ref: 6C5B3DF0
SetLastError.KERNEL32(00000000), ref: 6C5B3DF8
SetWindowLongA.USER32(00000000,000000EB), ref: 6C5B3E02
GetLastError.KERNEL32 ref: 6C5B3E0C
DestroyWindow.USER32(00000000), ref: 6C5B3E13
ShowWindow.USER32(00000000,00000000), ref: 6C5B3E20
UpdateWindow.USER32(00000000), ref: 6C5B3E27

Strings

TCLS_CORE_WND_%u, xrefs: 6C5B3D95
static, xrefs: 6C5B3DBF

Memory Dump Source

Source File: 00000006.00000002.4141448948.000000006C591000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000006.00000002.4141374342.000000006C590000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142318714.000000006C825000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142662450.000000006C906000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142732140.000000006C907000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142791681.000000006C909000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142876110.000000006C911000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142956827.000000006C913000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143044653.000000006C91D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143105643.000000006C925000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c590000_wegame.jbxd

Similarity

API ID: Window$ErrorLast$Long$CreateDestroyShowUpdatememsetstrcpy_s
String ID: TCLS_CORE_WND_%u$static
API String ID: 698125720-2282508738
Opcode ID: 54507c284795f21256b9ef9ae817e9c7ce57a55f0225120248ae6952c068c44f
Instruction ID: 8d8d23a05ed536aad68dd8044c425c9585f4801cf2c03ce12f624189833b3d08
Opcode Fuzzy Hash: 54507c284795f21256b9ef9ae817e9c7ce57a55f0225120248ae6952c068c44f
Instruction Fuzzy Hash: 4921D6B1780314BFDB209B658C5DFAB3A7CEF0A709F504529FA05F7680DAB4D90486E4

Function 0045311A Relevance: 23.0, APIs: 11, Strings: 2, Instructions: 224COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00453124

Part of subcall function 00453087: __EH_prolog3.LIBCMT ref: 0045308E

?get_graphic_card_name@Sys_wrapper@common@ierd_tgp@@SAXAAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z.COMMON(?,00000001,000000A4,00452AFB,00000000,?), ref: 0045319C
?get_ie_version@Sys_wrapper@common@ierd_tgp@@SAXAAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z.COMMON(?,?,00000001,000000A4,00452AFB,00000000,?), ref: 004531A5
?get_cpu_name@Sys_wrapper@common@ierd_tgp@@SAXAAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z.COMMON(?,?,?,00000001,000000A4,00452AFB,00000000,?), ref: 004531AE
?get_hdd_name@Sys_wrapper@common@ierd_tgp@@SAXAAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z.COMMON(?,?,?,?,00000001,000000A4,00452AFB,00000000,?), ref: 004531B7

Part of subcall function 00420F10: memcpy.VCRUNTIME140(00000000,00000000,00000000,004204D1,00000000,00000000,00000000,?,00423FD2,00000000,00000001), ref: 00420F37

?extract_op_from_cmd@Sys_wrapper@common@ierd_tgp@@SA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PAH@Z.COMMON(?,?,StartFor,00000008), ref: 0045320C

Part of subcall function 00420F10: memcpy.VCRUNTIME140(00000000,00000000,00000000,004204D1,00000000,00000000,00000000,?,00423FD2,00000000,00000001), ref: 00420FDB

?extract_op_from_cmd@Sys_wrapper@common@ierd_tgp@@SA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PAH@Z.COMMON(?,?,IsHide,00000006,StartFor,00000008), ref: 00453255

Part of subcall function 00420D40: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,0043DEC9,F69FE839,?,?,?,0046D880,000000FF,?,0043DE1E,F69FE839,?,?,?,0046D82F,000000FF), ref: 00420D85

?IsLaptop@Sys_wrapper@common@ierd_tgp@@SA_NXZ.COMMON(IsHide,00000006,StartFor,00000008), ref: 004532BB
?get_system_name@Sys_wrapper@common@ierd_tgp@@SA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ.COMMON(?,?,?,?,?,IsHide,00000006,StartFor,00000008), ref: 00453326
?get_system_hardware@Sys_wrapper@common@ierd_tgp@@SA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ.COMMON(?,?,?,?,?,IsHide,00000006,StartFor,00000008), ref: 00453348
?get_system_all_build_version@Sys_wrapper@common@ierd_tgp@@SA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ.COMMON(?,?,?,?,?,?,?,?,?,IsHide,00000006,StartFor,00000008), ref: 004533AC

Part of subcall function 0043D5E0: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,00000004,0046D610,000000FF,?,00442459,00000004,?), ref: 0043D6C7

Strings

StartFor, xrefs: 004531E4
IsHide, xrefs: 0045323C

Memory Dump Source

Source File: 00000006.00000002.4137209488.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.4137156906.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137406249.0000000000476000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137497400.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137574844.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137626631.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137684215.00000000004A3000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_wegame.jbxd

Similarity

API ID: Sys_wrapper@common@ierd_tgp@@$D@std@@U?$char_traits@V?$allocator@V?$basic_string@$D@2@@std@@$D@2@@std@@@$?extract_op_from_cmd@_invalid_parameter_noinfo_noreturnmemcpy$?get_cpu_name@?get_graphic_card_name@?get_hdd_name@?get_ie_version@?get_system_all_build_version@?get_system_hardware@?get_system_name@H_prolog3H_prolog3_Laptop@
String ID: IsHide$StartFor
API String ID: 2836791103-3908033177
Opcode ID: d633fd942fd9c3ae70cfc64ef2c907998c147085939a4e3493efb70947794a02
Instruction ID: 1d373f92a6afe8a3b4fe1b04e0380d6fe9486b073bc995dba3c6262a8cd62cff
Opcode Fuzzy Hash: d633fd942fd9c3ae70cfc64ef2c907998c147085939a4e3493efb70947794a02
Instruction Fuzzy Hash: A2913D71D05258DECF10EFAAC885ADDBBB8BF05304F94409FE049A7242DB785B48CB65

Function 0045A3D8 Relevance: 22.9, APIs: 9, Strings: 4, Instructions: 189COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0045A3E2
?is_certificate_open@util_curl_certificate@ierd_tgp@@YA_NXZ.COMMON(00000110,0045E01E,00000070,00452C2B), ref: 0045A3E7
?get_workingdir_path_ex@Application@common@ierd_tgp@@SA?AVpath@filesystem@3@XZ.COMMON(?,00000110,0045E01E,00000070,00452C2B), ref: 0045A3FB

Part of subcall function 00455B3E: __EH_prolog3_GS.LIBCMT ref: 00455B45
Part of subcall function 00455B3E: ??_0path@filesystem@ierd_tgp@@QAEAAV012@ABV012@@Z.COMMON(?,00000024,0045D05C,?,00000000,?,?,log), ref: 00455B75

Part of subcall function 0040BC90: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,0040E9C2,?,?), ref: 0040BCDD

Part of subcall function 00466016: __EH_prolog3.LIBCMT ref: 0046601D

?u16_to_loc@common@ierd_tgp@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@4@@Z.COMMON(00000000,?,?,?,?,wegamex_client.pfx,?,?,wegamex_client.key), ref: 0045A500
?u16_to_loc@common@ierd_tgp@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@4@@Z.COMMON(00000000,?,?,?,?,?,wegamex_client.pfx,?,?,wegamex_client.key), ref: 0045A52B
?u16_to_loc@common@ierd_tgp@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@4@@Z.COMMON(00000000,?,?,?,?,?,?,wegamex_client.pfx,?,?,wegamex_client.key), ref: 0045A556
?get_cert_pwd@util_curl_certificate@ierd_tgp@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ.COMMON(?,?,?,?,?,?,wegamex_client.pfx,?,?,wegamex_client.key), ref: 0045A56D
?export_crt_file@util_curl_certificate@ierd_tgp@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@000@Z.COMMON(?,?,?,00000000,?,?,?,?,?,?,wegamex_client.pfx,?,?,wegamex_client.key), ref: 0045A583
?get_log_instance@base@@YAPAVILogger@1@XZ.COMMON(?,?,?,?,?,?,?,wegamex_client.pfx,?,?,wegamex_client.key), ref: 0045A5A2

Part of subcall function 0043DD1B: __EH_prolog3.LIBCMT ref: 0043DD22

Part of subcall function 0043F2BB: __EH_prolog3_catch_GS.LIBCMT ref: 0043F2C2

Strings

e:\dailybuild_fix_5.4\wegame_client\codes\main\tgp_daemon\src\tgp_daemon_main.cpp, xrefs: 0045A5C6
wegamex_client.key, xrefs: 0045A43E
wegamex_client.pfx, xrefs: 0045A475
[export_curl_crt_file]export fail!, xrefs: 0045A5DD

Memory Dump Source

Source File: 00000006.00000002.4137209488.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.4137156906.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137406249.0000000000476000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137497400.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137574844.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137626631.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137684215.00000000004A3000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_wegame.jbxd

Similarity

API ID: D@std@@U?$char_traits@V?$allocator@V?$basic_string@$?u16_to_loc@common@ierd_tgp@@D@2@@4@@U?$char_traits@_V?$allocator@_V?$basic_string@_W@2@@std@@W@std@@$H_prolog3H_prolog3_$??_0path@filesystem@ierd_tgp@@?export_crt_file@util_curl_certificate@ierd_tgp@@?get_cert_pwd@util_curl_certificate@ierd_tgp@@?get_log_instance@base@@?get_workingdir_path_ex@?is_certificate_open@util_curl_certificate@ierd_tgp@@Application@common@ierd_tgp@@D@2@@std@@D@2@@std@@000@H_prolog3_catch_Logger@1@V012@V012@@Vpath@filesystem@3@_invalid_parameter_noinfo_noreturn
String ID: [export_curl_crt_file]export fail!$e:\dailybuild_fix_5.4\wegame_client\codes\main\tgp_daemon\src\tgp_daemon_main.cpp$wegamex_client.key$wegamex_client.pfx
API String ID: 270246835-1671142673
Opcode ID: be11a3ee1231d827c7d7be9d0d2293993dd50023825a31a5d6551bd5d7a000d8
Instruction ID: 5c151aca83ef9290b4c8780c7ba19baeae3c3cf39a1ff8248e4a12dfafe3a76a
Opcode Fuzzy Hash: be11a3ee1231d827c7d7be9d0d2293993dd50023825a31a5d6551bd5d7a000d8
Instruction Fuzzy Hash: 9D71A071C0524CDADB01EBE5C845BDDBBB8AF14308F5440AFE045B7182EB785B48DB6A

Function 6C5D7784 Relevance: 21.3, APIs: 9, Strings: 3, Instructions: 274COMMON

Download Yara Rule

APIs

__EH_prolog3_catch_GS.LIBCMT ref: 6C5D778E

Part of subcall function 6C5A9A0E: __EH_prolog3.LIBCMT ref: 6C5A9A15

?root_full_path@File_info@common@ierd_tgp@@SA?AVpath@filesystem@3@XZ.COMMON(?,000001E8,6C5D732D,?,?), ref: 6C5D77BA

Part of subcall function 6C5D8A8C: __EH_prolog3_GS.LIBCMT ref: 6C5D8A96
Part of subcall function 6C5D8A8C: ?get_cfg_module_path@File_info@common@ierd_tgp@@SA?AVpath@filesystem@3@XZ.COMMON(?,0000008C,6C5D77BF,?,000001E8,6C5D732D,?,?), ref: 6C5D8AB0
Part of subcall function 6C5D8A8C: ?absolute@filesystem@ierd_tgp@@YA?AVpath@12@ABV312@0@Z.COMMON(?,?,?,?,0000008C,6C5D77BF,?,000001E8,6C5D732D,?,?), ref: 6C5D8AEB
Part of subcall function 6C5D8A8C: ?exists@filesystem@ierd_tgp@@YA_NABVpath@12@AAVerror_code@std@@@Z.COMMON(?,?,?,?,?,?,0000008C,6C5D77BF,?,000001E8,6C5D732D,?,?), ref: 6C5D8B53
Part of subcall function 6C5D8A8C: ??0path@filesystem@ierd_tgp@@QAE@$$QAV012@@Z.COMMON(00000000,?,?,?,00000000,?), ref: 6C5D8B65

Part of subcall function 6C59A8F0: memcpy.VCRUNTIME140(?,?,9XZl,?,?,00000000,?,?,6C5A5839,?,?), ref: 6C59A917

?get_cfg@common@ierd_tgp@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABVpath@filesystem@2@AAV?$basic_ptree@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@property_tree@boost@@@Z.COMMON(?,00000000,?,files,00000005,?,?,?,?,?,?,?,?,000001E8,6C5D732D,?), ref: 6C5D77F8

Part of subcall function 6C5D71FA: ?get_cfg@common@ierd_tgp@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABVpath@filesystem@2@AAV?$basic_ptree@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@property_tree@boost@@_N3@Z.COMMON(?,?,?,00000001,00000000,?,6C5D77FD,?,00000000,?,files,00000005), ref: 6C5D720A

?u8_to_path@common@ierd_tgp@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAVpath@filesystem@2@@Z.COMMON(?,?,?,?,0000002E,?), ref: 6C5D78CF
?cfg_folder@File_info@common@ierd_tgp@@SA?AVpath@filesystem@3@XZ.COMMON(?,?,?,0000002E,?), ref: 6C5D7902

Part of subcall function 6C5D63A0: __EH_prolog3_GS.LIBCMT ref: 6C5D63A7
Part of subcall function 6C5D63A0: ?root_full_path@File_info@common@ierd_tgp@@SA?AVpath@filesystem@3@XZ.COMMON(?), ref: 6C5D63BA
Part of subcall function 6C5D63A0: ?parent_path@path@filesystem@ierd_tgp@@QBE?AV123@XZ.COMMON(?), ref: 6C5D63CC
Part of subcall function 6C5D63A0: ?wstring@path@filesystem@ierd_tgp@@QBE?BV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@XZ.COMMON(?,?), ref: 6C5D63DB
Part of subcall function 6C5D63A0: ??0path@filesystem@ierd_tgp@@QAE@ABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z.COMMON(00000000,?,?), ref: 6C5D63E7

?absolute@filesystem@ierd_tgp@@YA?AVpath@12@ABV312@0@Z.COMMON(?,?,00000000,?,?,?,0000002E,?), ref: 6C5D7917

Part of subcall function 6C5EFFAB: __EH_prolog3_GS.LIBCMT ref: 6C5EFFB5
Part of subcall function 6C5EFFAB: ?is_absolute@path@filesystem@ierd_tgp@@QBE_NXZ.COMMON ref: 6C5EFFD8
Part of subcall function 6C5EFFAB: ??0path@filesystem@ierd_tgp@@QAE@$$QAV012@@Z.COMMON(00000000), ref: 6C5F004D
Part of subcall function 6C5EFFAB: ?root_name@path@filesystem@ierd_tgp@@QBE?AV123@XZ.COMMON(?,00000000), ref: 6C5F00BE
Part of subcall function 6C5EFFAB: ?root_name@path@filesystem@ierd_tgp@@QBE?AV123@XZ.COMMON(?,?,00000000), ref: 6C5F00CE
Part of subcall function 6C5EFFAB: ?root_directory@path@filesystem@ierd_tgp@@QBE?AV123@XZ.COMMON(?,?,?,00000000), ref: 6C5F00DD
Part of subcall function 6C5EFFAB: ??0path@filesystem@ierd_tgp@@QAE@$$QAV012@@Z.COMMON(?,?,?,?,00000000), ref: 6C5F00F2

Part of subcall function 6C5AD1A7: memcpy.VCRUNTIME140(?,?,00000018,?,?), ref: 6C5AD1C5
Part of subcall function 6C5AD1A7: memcpy.VCRUNTIME140(?,0000000F,00000018,?,?,00000018,?,?), ref: 6C5AD1CE
Part of subcall function 6C5AD1A7: memcpy.VCRUNTIME140(0000000F,?,00000018,?,0000000F,00000018,?,?,00000018,?,?), ref: 6C5AD1DA

Part of subcall function 6C59A3A0: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,6C5A62D8,00000000,6C5A6649,00000003,9C33995A,?,?,00000000,6C7FF594,000000FF,?,6C5A5B05,00000000), ref: 6C59A3E5

Strings

files, xrefs: 6C5D77DB
relate path string to path fail, xrefs: 6C5D7A0F
e:\dailybuild_fix_5.4\wegame_client\codes\common\src\cfg_file.cpp, xrefs: 6C5D79F8

Memory Dump Source

Source File: 00000006.00000002.4141448948.000000006C591000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000006.00000002.4141374342.000000006C590000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142318714.000000006C825000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142662450.000000006C906000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142732140.000000006C907000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142791681.000000006C909000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142876110.000000006C911000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142956827.000000006C913000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143044653.000000006C91D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143105643.000000006C925000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c590000_wegame.jbxd

Similarity

API ID: D@std@@U?$char_traits@V?$allocator@V?$basic_string@$D@2@@std@@$??0path@filesystem@ierd_tgp@@File_info@common@ierd_tgp@@V123@Vpath@filesystem@3@memcpy$E@$$H_prolog3_V012@@Vpath@12@$?absolute@filesystem@ierd_tgp@@?get_cfg@common@ierd_tgp@@?root_full_path@?root_name@path@filesystem@ierd_tgp@@U?$char_traits@_U?$less@V12@V312@0@V?$allocator@_V?$basic_ptree@V?$basic_string@_Vpath@filesystem@2@W@std@@$?cfg_folder@?exists@filesystem@ierd_tgp@@?get_cfg_module_path@?is_absolute@path@filesystem@ierd_tgp@@?parent_path@path@filesystem@ierd_tgp@@?root_directory@path@filesystem@ierd_tgp@@?u8_to_path@common@ierd_tgp@@?wstring@path@filesystem@ierd_tgp@@D@2@@std@@@2@@property_tree@boost@@@D@2@@std@@@2@@property_tree@boost@@_H_prolog3H_prolog3_catch_Verror_code@std@@@Vpath@filesystem@2@@W@2@@std@@W@2@@std@@@_invalid_parameter_noinfo_noreturn
String ID: e:\dailybuild_fix_5.4\wegame_client\codes\common\src\cfg_file.cpp$files$relate path string to path fail
API String ID: 1745142281-1326876599
Opcode ID: 3097c29513f79b4230e445cbd1d854a6cf50b3045361a963843cb8eb551096ba
Instruction ID: 1a431ca40abb9b74efc03fde3deced522fedfaef63b672905663e11221bafe1c
Opcode Fuzzy Hash: 3097c29513f79b4230e445cbd1d854a6cf50b3045361a963843cb8eb551096ba
Instruction Fuzzy Hash: CEC16831C05288EADB11DBE8CD44BCDBBB4AF66308F6480D9D045A7681EB746F4DDB62

Function 6C65670A Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 181COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6C656714
memset.VCRUNTIME140(?,00000000,00000208,\config\client_info.info,000003E0,6C61DB3C,?,6C63D334), ref: 6C656773
GetModuleHandleW.KERNEL32(00000000,?,00000104,?,?,6C835DA8), ref: 6C656788
GetModuleFileNameW.KERNEL32(00000000,?,?,6C835DA8), ref: 6C65678F
PathFileExistsW.SHLWAPI(?), ref: 6C656884

Strings

\config\client_info.info, xrefs: 6C65675C
client_id, xrefs: 6C656926

Memory Dump Source

Source File: 00000006.00000002.4141448948.000000006C591000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000006.00000002.4141374342.000000006C590000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142318714.000000006C825000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142662450.000000006C906000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142732140.000000006C907000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142791681.000000006C909000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142876110.000000006C911000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142956827.000000006C913000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143044653.000000006C91D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143105643.000000006C925000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c590000_wegame.jbxd

Similarity

API ID: FileModule$ExistsH_prolog3_HandleNamePathmemset
String ID: \config\client_info.info$client_id
API String ID: 3144288800-1673508345
Opcode ID: bde7c6fa399e03feac985e4b08cf14ae1cd0d14d3d841ac48e4d20bb0dc55178
Instruction ID: c3503f0e9732c9b92df8fc115d94d243dfc457d1838c13a88f7457375e65106a
Opcode Fuzzy Hash: bde7c6fa399e03feac985e4b08cf14ae1cd0d14d3d841ac48e4d20bb0dc55178
Instruction Fuzzy Hash: 8E816870905258DADF20DBA4CC98BCDBBB8AF15308F6041E9D00DA7690DB749F89CFA5

Function 6C625F5C Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 155COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6C625F66
?get_log_instance@base@@YAPAVILogger@1@XZ.COMMON(00000003,00000001,00000118,6C6252C7,00000001,00000001,0000000F,00000000,00000001,?,00000000,0000000F,00000002,0000000F,00000000,00000001), ref: 6C625FB8
?get_log_instance@base@@YAPAVILogger@1@XZ.COMMON(00000001,?,00000000,00000003,00000001,00000118,6C6252C7,00000001,00000001,0000000F,00000000,00000001,?,00000000,0000000F,00000002), ref: 6C62604F
Concurrency::details::platform::__RegisterWaitForSingleObject.LIBCONCRT(00000001,?,00000001,00000001,?,00000000,00000003,00000001,00000118,6C6252C7,00000001,00000001,0000000F,00000000,00000001,?), ref: 6C6260AA
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ.MSVCP140(0000007C,6C625A1C,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C6260C7

Part of subcall function 6C62237B: __EH_prolog3_GS.LIBCMT ref: 6C622385
Part of subcall function 6C62237B: memset.VCRUNTIME140(?,00000000,00000104,00000868,6C625F7C,00000118,6C6252C7,00000001,00000001,0000000F,00000000,00000001,?,00000000,0000000F,00000002), ref: 6C62239B
Part of subcall function 6C62237B: memset.VCRUNTIME140(?,00000000,00000104,?,00000000,00000104,00000868,6C625F7C,00000118,6C6252C7,00000001,00000001,0000000F,00000000,00000001,?), ref: 6C6223AB
Part of subcall function 6C62237B: memset.VCRUNTIME140(?,00000000,00000104,?,00000000,00000104,?,00000000,00000104,00000868,6C625F7C,00000118,6C6252C7,00000001,00000001,0000000F), ref: 6C6223B9
Part of subcall function 6C62237B: memset.VCRUNTIME140(?,00000000,00000104,?,00000000,00000104,?,00000000,00000104,?,00000000,00000104,00000868,6C625F7C,00000118,6C6252C7), ref: 6C6223C7

??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ.MSVCP140(00000001,?,00000000,00000003,00000001,00000118,6C6252C7,00000001,00000001,0000000F,00000000,00000001,?,00000000,0000000F,00000002), ref: 6C6260E7
?get_log_instance@base@@YAPAVILogger@1@XZ.COMMON(00000118,6C6252C7,00000001,00000001,0000000F,00000000,00000001,?,00000000,0000000F,00000002,0000000F,00000000,00000001,?,0000007C), ref: 6C6260F1
Concurrency::details::platform::__RegisterWaitForSingleObject.LIBCONCRT(00000001,?,00000001,00000118,6C6252C7,00000001,00000001,0000000F,00000000,00000001,?,00000000,0000000F,00000002,0000000F,00000000), ref: 6C626155

Part of subcall function 6C5B6270: ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ.MSVCP140(9C33995A,00000001,?,00000000,6C801A29,000000FF,?,6C5D714A,00000010,00000003,00000001,000000B4,6C5D5498,00000000,?,?), ref: 6C5B62C7

Strings

handle is invalid, cannot report qos, xrefs: 6C62612C
e:\dailybuild_fix_5.4\wegame_client\codes\common\src\qos_command.cpp, xrefs: 6C625FDC, 6C626073, 6C626115
cannot report qos by http, xrefs: 6C626087

Memory Dump Source

Source File: 00000006.00000002.4141448948.000000006C591000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000006.00000002.4141374342.000000006C590000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142318714.000000006C825000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142662450.000000006C906000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142732140.000000006C907000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142791681.000000006C909000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142876110.000000006C911000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142956827.000000006C913000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143044653.000000006C91D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143105643.000000006C925000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c590000_wegame.jbxd

Similarity

API ID: memset$?get_log_instance@base@@D@std@@@std@@Logger@1@U?$char_traits@$??1?$basic_ios@Concurrency::details::platform::__H_prolog3_ObjectRegisterSingleWait$??1?$basic_iostream@
String ID: cannot report qos by http$e:\dailybuild_fix_5.4\wegame_client\codes\common\src\qos_command.cpp$handle is invalid, cannot report qos
API String ID: 123105886-1651315320
Opcode ID: ab54b393012fba16d167d52b014832d2495eb87fd31e0843d1425b59fe0d1810
Instruction ID: dc769794d2188bb75f4c8d0b9c0fae059e8e7d604b7dac6462a7afbcb5cb7d56
Opcode Fuzzy Hash: ab54b393012fba16d167d52b014832d2495eb87fd31e0843d1425b59fe0d1810
Instruction Fuzzy Hash: 28511D70900304AADB24EAE0CD15FDEB7749F92748F200498A115BB6D1EB75DF09DFA9

Function 6C63F031 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 153COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6C63F03B
?u8to16@common@ierd_tgp@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@4@@Z.COMMON(?,?,000002DC), ref: 6C63F0F5

Part of subcall function 6C6336B8: __EH_prolog3_GS.LIBCMT ref: 6C6336BF

?u8to16@common@ierd_tgp@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@4@@Z.COMMON(?,?,?,?,000002DC), ref: 6C63F107
?u8to16@common@ierd_tgp@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@4@@Z.COMMON(?,?,?,?,?,?,000002DC), ref: 6C63F114
?u8to16@common@ierd_tgp@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@4@@Z.COMMON(?,?,?,?,?,?,?,?,000002DC), ref: 6C63F126
memset.VCRUNTIME140(?,00000000,00000208,?,?,?,?,?,?,?,?,000002DC), ref: 6C63F139
GetPrivateProfileStringW.KERNEL32(?,?,?,?), ref: 6C63F1A1
?get_log_instance@base@@YAPAVILogger@1@XZ.COMMON(?,?,?,?,?,00000104,?,?,?,?,?,?), ref: 6C63F1AB

Part of subcall function 6C5AA5EF: __EH_prolog3.LIBCMT ref: 6C5AA5F6

GetLastError.KERNEL32(00000000,00000005,e:\dailybuild_fix_5.4\wegame_client\codes\common\src\sys_wrapper.cpp,00000EFC,6C8B5E9F,?,?,?,?,?,00000104), ref: 6C63F1E8
?u16to8@common@ierd_tgp@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@4@@Z.COMMON(?,?,?,?,?,?,?,?,?,?,?,?,?,00000104), ref: 6C63F26A

Strings

e:\dailybuild_fix_5.4\wegame_client\codes\common\src\sys_wrapper.cpp, xrefs: 6C63F1CF

Memory Dump Source

Source File: 00000006.00000002.4141448948.000000006C591000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000006.00000002.4141374342.000000006C590000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142318714.000000006C825000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142662450.000000006C906000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142732140.000000006C907000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142791681.000000006C909000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142876110.000000006C911000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142956827.000000006C913000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143044653.000000006C91D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143105643.000000006C925000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c590000_wegame.jbxd

Similarity

API ID: D@std@@U?$char_traits@U?$char_traits@_V?$allocator@V?$allocator@_V?$basic_string@V?$basic_string@_W@std@@$?u8to16@common@ierd_tgp@@D@2@@std@@W@2@@4@@$H_prolog3_$?get_log_instance@base@@?u16to8@common@ierd_tgp@@D@2@@4@@ErrorH_prolog3LastLogger@1@PrivateProfileStringW@2@@std@@memset
String ID: e:\dailybuild_fix_5.4\wegame_client\codes\common\src\sys_wrapper.cpp
API String ID: 1919723385-4277183394
Opcode ID: 7de7d2e5163e5a49e04dd9bf1ccda561f71f2d2690d64b6239b6e411a5add9b3
Instruction ID: f46e6764f843fbd53c4b201b328c1279a9547fefe4204c6400750dd080deaa5e
Opcode Fuzzy Hash: 7de7d2e5163e5a49e04dd9bf1ccda561f71f2d2690d64b6239b6e411a5add9b3
Instruction Fuzzy Hash: E171FF70D49268DADB60DFA4CC88BDDB7B4AF19304F1051E9A40CA7660DB305F8ACF59

Function 6C62473A Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 104COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6C624744
memset.VCRUNTIME140(?,00000000,00000410,0000085C,6C622621), ref: 6C62475B
memset.VCRUNTIME140(?,00000000,00000410,?,00000000,00000410,0000085C,6C622621), ref: 6C624769
GetModuleFileNameW.KERNEL32(00000000,?,00000208), ref: 6C6247A3
wcsrchr.VCRUNTIME140(?,0000005C), ref: 6C6247BA
wcsrchr.VCRUNTIME140(?,0000002F), ref: 6C6247CE
__snprintf_s.LIBCMT ref: 6C6247F8
?u16to8@common@ierd_tgp@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@4@@Z.COMMON(?,?,?), ref: 6C624849
?file_get_version@common@ierd_tgp@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAUversion_t@12@@Z.COMMON(?,?,?), ref: 6C624877
?to_string@version_t@common@ierd_tgp@@QAE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ.COMMON(?,?), ref: 6C62488B

Strings

%s\tcls\protocolcenter.dll, xrefs: 6C6247E5

Memory Dump Source

Source File: 00000006.00000002.4141448948.000000006C591000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000006.00000002.4141374342.000000006C590000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142318714.000000006C825000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142662450.000000006C906000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142732140.000000006C907000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142791681.000000006C909000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142876110.000000006C911000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142956827.000000006C913000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143044653.000000006C91D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143105643.000000006C925000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c590000_wegame.jbxd

Similarity

API ID: D@std@@U?$char_traits@V?$allocator@V?$basic_string@$D@2@@std@@memsetwcsrchr$?file_get_version@common@ierd_tgp@@?to_string@version_t@common@ierd_tgp@@?u16to8@common@ierd_tgp@@D@2@@4@@FileH_prolog3_ModuleNameU?$char_traits@_Uversion_t@12@@V?$allocator@_V?$basic_string@_W@2@@std@@W@std@@__snprintf_s
String ID: %s\tcls\protocolcenter.dll
API String ID: 2055968945-498237658
Opcode ID: 94a3141b959b592e6991b8dd99e9fb14215a7385d162ef06a89250157fc8c9f8
Instruction ID: 85d4218848cdd106b6fb221253e8badd210c88f8e29ed38ab9104f92df40e417
Opcode Fuzzy Hash: 94a3141b959b592e6991b8dd99e9fb14215a7385d162ef06a89250157fc8c9f8
Instruction Fuzzy Hash: CE413F71C0021CDADB20DBA1CC84ADEB7F8BF05214F5445EAA599A7641DF349F88CFA4

Function 0045D406 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 103COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0045D40D

Part of subcall function 00467A3B: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,0040CE31,7FFFFFFE,?), ref: 00467A50

??0ShareMemory@Memory@ierd_tgp@@QAE@PB_WK@Z.COMMON(WEGMAE_QBLINK_SHARE_MEMORY_INFO,0000008C,00000058,0045BDBC,?,?), ref: 0045D43C
?Create@ShareMemory@Memory@ierd_tgp@@QAEHH@Z.COMMON(00000000,00000058,0045BDBC,?,?), ref: 0045D458
?get_log_instance@base@@YAPAVILogger@1@XZ.COMMON(00000000,00000058,0045BDBC,?,?), ref: 0045D461
??1ShareMemory@Memory@ierd_tgp@@QAE@XZ.COMMON(00000000,00000058,0045BDBC,?,?), ref: 0045D4C1
?GetBuffer@ShareMemory@Memory@ierd_tgp@@QBEPAEXZ.COMMON(00000000,00000058,0045BDBC,?,?), ref: 0045D4DC
_memcpy_s.PGOCR ref: 0045D506
_memcpy_s.PGOCR ref: 0045D527

Strings

[QBlink]share memory init fail., xrefs: 0045D49C
e:\dailybuild_fix_5.4\wegame_client\codes\main\tgp_daemon\src\tgp_daemon_main.cpp, xrefs: 0045D485
WEGMAE_QBLINK_SHARE_MEMORY_INFO, xrefs: 0045D435

Memory Dump Source

Source File: 00000006.00000002.4137209488.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.4137156906.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137406249.0000000000476000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137497400.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137574844.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137626631.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137684215.00000000004A3000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_wegame.jbxd

Similarity

API ID: Memory@Memory@ierd_tgp@@Share$_memcpy_s$?get_log_instance@base@@Buffer@Create@H_prolog3_Logger@1@malloc
String ID: WEGMAE_QBLINK_SHARE_MEMORY_INFO$[QBlink]share memory init fail.$e:\dailybuild_fix_5.4\wegame_client\codes\main\tgp_daemon\src\tgp_daemon_main.cpp
API String ID: 2485382025-2697181055
Opcode ID: 4faa1014223f11a8ead45baf547b471d2052c14312cc8892b1cbe9557baaf557
Instruction ID: c97e20f44ea1b37519472cca6d23bcba16e2697d1a2bde0b2ca7cde7497f6732
Opcode Fuzzy Hash: 4faa1014223f11a8ead45baf547b471d2052c14312cc8892b1cbe9557baaf557
Instruction Fuzzy Hash: C831D271A00705ABDB20EFA5C842B5E73B1BF44B09F10451EF915AB3C2EB78E9448B59

Function 6C5D8A8C Relevance: 18.1, APIs: 12, Instructions: 116COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6C5D8A96
?get_cfg_module_path@File_info@common@ierd_tgp@@SA?AVpath@filesystem@3@XZ.COMMON(?,0000008C,6C5D77BF,?,000001E8,6C5D732D,?,?), ref: 6C5D8AB0

Part of subcall function 6C5D74F1: __EH_prolog3_GS.LIBCMT ref: 6C5D74FB
Part of subcall function 6C5D74F1: memset.VCRUNTIME140(?,00000000,00000208,00000214,6C5D8AB5,?,0000008C,6C5D77BF,?,000001E8,6C5D732D,?,?), ref: 6C5D7521
Part of subcall function 6C5D74F1: GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 6C5D7536
Part of subcall function 6C5D74F1: PathRemoveFileSpecW.SHLWAPI(?), ref: 6C5D7543

Part of subcall function 6C5A6B70: ?_Execute_once@std@@YAHAAUonce_flag@1@P6GHPAX1PAPAX@Z1@Z.MSVCP140(6C91D054,6C5A6BB1,6C91D058,?,6C5AA235,00000000,?,00000010), ref: 6C5A6B81
Part of subcall function 6C5A6B70: terminate.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5A6B8D

?absolute@filesystem@ierd_tgp@@YA?AVpath@12@ABV312@0@Z.COMMON(?,?,?,?,0000008C,6C5D77BF,?,000001E8,6C5D732D,?,?), ref: 6C5D8AEB

Part of subcall function 6C5EFFAB: __EH_prolog3_GS.LIBCMT ref: 6C5EFFB5
Part of subcall function 6C5EFFAB: ?is_absolute@path@filesystem@ierd_tgp@@QBE_NXZ.COMMON ref: 6C5EFFD8
Part of subcall function 6C5EFFAB: ??0path@filesystem@ierd_tgp@@QAE@$$QAV012@@Z.COMMON(00000000), ref: 6C5F004D
Part of subcall function 6C5EFFAB: ?root_name@path@filesystem@ierd_tgp@@QBE?AV123@XZ.COMMON(?,00000000), ref: 6C5F00BE
Part of subcall function 6C5EFFAB: ?root_name@path@filesystem@ierd_tgp@@QBE?AV123@XZ.COMMON(?,?,00000000), ref: 6C5F00CE
Part of subcall function 6C5EFFAB: ?root_directory@path@filesystem@ierd_tgp@@QBE?AV123@XZ.COMMON(?,?,?,00000000), ref: 6C5F00DD
Part of subcall function 6C5EFFAB: ??0path@filesystem@ierd_tgp@@QAE@$$QAV012@@Z.COMMON(?,?,?,?,00000000), ref: 6C5F00F2

?has_parent_path@path@filesystem@ierd_tgp@@QBE_NXZ.COMMON ref: 6C5D8AF5
?parent_path@path@filesystem@ierd_tgp@@QBE?AV123@XZ.COMMON(?), ref: 6C5D8B09
?absolute@filesystem@ierd_tgp@@YA?AVpath@12@ABV312@0@Z.COMMON(00000000,?,?,00000000,?), ref: 6C5D8B3F
?exists@filesystem@ierd_tgp@@YA_NABVpath@12@AAVerror_code@std@@@Z.COMMON(?,?,?,?,?,?,0000008C,6C5D77BF,?,000001E8,6C5D732D,?,?), ref: 6C5D8B53
??0path@filesystem@ierd_tgp@@QAE@$$QAV012@@Z.COMMON(00000000,?,?,?,00000000,?), ref: 6C5D8B65
?get_cfg_module_path@File_info@common@ierd_tgp@@SA?AVpath@filesystem@3@XZ.COMMON(?), ref: 6C5D8BAD
?absolute@filesystem@ierd_tgp@@YA?AVpath@12@ABV312@0@Z.COMMON(00000000,?,00000000,?), ref: 6C5D8BBF

Part of subcall function 6C5EFFAB: ?current_path@filesystem@ierd_tgp@@YA?AVpath@12@XZ.COMMON(?), ref: 6C5F0012
Part of subcall function 6C5EFFAB: ?relative_path@path@filesystem@ierd_tgp@@QBE?AV123@XZ.COMMON(?), ref: 6C5F0146
Part of subcall function 6C5EFFAB: ?relative_path@path@filesystem@ierd_tgp@@QBE?AV123@XZ.COMMON(?,?), ref: 6C5F015B
Part of subcall function 6C5EFFAB: ?root_directory@path@filesystem@ierd_tgp@@QBE?AV123@XZ.COMMON(?,?,?), ref: 6C5F0170

?wstring@path@filesystem@ierd_tgp@@QBE?BV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@XZ.COMMON(?), ref: 6C5D8BD1

Part of subcall function 6C5AFACF: __EH_prolog3.LIBCMT ref: 6C5AFAD6

??0path@filesystem@ierd_tgp@@QAE@ABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z.COMMON(00000000,?), ref: 6C5D8BDD

Part of subcall function 6C5AA713: __EH_prolog3.LIBCMT ref: 6C5AA71A

Memory Dump Source

Source File: 00000006.00000002.4141448948.000000006C591000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000006.00000002.4141374342.000000006C590000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142318714.000000006C825000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142662450.000000006C906000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142732140.000000006C907000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142791681.000000006C909000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142876110.000000006C911000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142956827.000000006C913000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143044653.000000006C91D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143105643.000000006C925000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c590000_wegame.jbxd

Similarity

API ID: V123@$Vpath@12@$??0path@filesystem@ierd_tgp@@$?absolute@filesystem@ierd_tgp@@E@$$H_prolog3_V012@@V312@0@$?get_cfg_module_path@?relative_path@path@filesystem@ierd_tgp@@?root_directory@path@filesystem@ierd_tgp@@?root_name@path@filesystem@ierd_tgp@@FileFile_info@common@ierd_tgp@@H_prolog3U?$char_traits@_V?$allocator@_V?$basic_string@_Vpath@filesystem@3@W@std@@$?current_path@filesystem@ierd_tgp@@?exists@filesystem@ierd_tgp@@?has_parent_path@path@filesystem@ierd_tgp@@?is_absolute@path@filesystem@ierd_tgp@@?parent_path@path@filesystem@ierd_tgp@@?wstring@path@filesystem@ierd_tgp@@Execute_once@std@@ModuleNamePathRemoveSpecUonce_flag@1@Verror_code@std@@@W@2@@std@@W@2@@std@@@memsetterminate
String ID:
API String ID: 877234165-0
Opcode ID: f8d17c153743abf8139cb1dfe4fa1843b6a66803ed65467ffaf8b225bd686852
Instruction ID: bbabf4b8651246bf7627e219520ff27f96912ba477f58ec1382f41950fc6b621
Opcode Fuzzy Hash: f8d17c153743abf8139cb1dfe4fa1843b6a66803ed65467ffaf8b225bd686852
Instruction Fuzzy Hash: C14158B1C00298DADF11EBE4CD40BDDBBB8AF58308F44409AD541A7651EB309F4ECBA2

Function 6C5C3AC0 Relevance: 17.8, APIs: 5, Strings: 5, Instructions: 331stringCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6C5C3ACA

Part of subcall function 6C5C37A2: __EH_prolog3.LIBCMT ref: 6C5C37A9

_localtime64_s.API-MS-WIN-CRT-TIME-L1-1-0(?,?,?,?,?,?,?,6C829268,00000000,000002AC), ref: 6C5C3DAD
strftime.API-MS-WIN-CRT-TIME-L1-1-0(?,?,?,?,?,?,?,6C829268,00000000,000002AC), ref: 6C5C3DD4
strftime.API-MS-WIN-CRT-TIME-L1-1-0(?,?,?,?), ref: 6C5C3E26
_CxxThrowException.VCRUNTIME140(?,6C8C3234,missing '}' in format string,?,000002AC), ref: 6C5C3E94

Strings

%Y-%m-%d %H:%M:%S.%f, xrefs: 6C5C3B3D
000000000, xrefs: 6C5C3FB6
%Y-%m-%d %H-%M-%S.%f, xrefs: 6C5C3F52
000000000, xrefs: 6C5C3BA3
missing '}' in format string, xrefs: 6C5C3E79

Memory Dump Source

Source File: 00000006.00000002.4141448948.000000006C591000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000006.00000002.4141374342.000000006C590000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142318714.000000006C825000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142662450.000000006C906000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142732140.000000006C907000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142791681.000000006C909000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142876110.000000006C911000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142956827.000000006C913000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143044653.000000006C91D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143105643.000000006C925000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c590000_wegame.jbxd

Similarity

API ID: strftime$ExceptionH_prolog3H_prolog3_Throw_localtime64_s
String ID: %Y-%m-%d %H-%M-%S.%f$%Y-%m-%d %H:%M:%S.%f$000000000$000000000$missing '}' in format string
API String ID: 3645883216-1246186885
Opcode ID: dbebd8f88fb86e89ef0499b7a087decb25b1b23c4e653f4350abf1fd08ac0a69
Instruction ID: 566e979068a7ded0071911f25cabbfbb943a1253310d819de984c0f37caf4cc6
Opcode Fuzzy Hash: dbebd8f88fb86e89ef0499b7a087decb25b1b23c4e653f4350abf1fd08ac0a69
Instruction Fuzzy Hash: C6C1AD71B04259EFCB14CFA8CC94BDDB7B9AF49318F54059DE049A7680DB309E86CB62

Function 6C5C9EC1 Relevance: 17.8, APIs: 5, Strings: 5, Instructions: 309COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6C5C9ECB
SHCreateDirectoryExW.SHELL32(00000000,-00000024,00000000,?,?,?,?,wegame,000000A8), ref: 6C5CA022

Strings

\memlog, xrefs: 6C5C9FE4
mem, xrefs: 6C5CA03D, 6C5CA04D
.log, xrefs: 6C5CA1FF
wegame, xrefs: 6C5C9EF6, 6C5CA1B8
memlog, xrefs: 6C5C9FCC

Memory Dump Source

Source File: 00000006.00000002.4141448948.000000006C591000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000006.00000002.4141374342.000000006C590000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142318714.000000006C825000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142662450.000000006C906000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142732140.000000006C907000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142791681.000000006C909000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142876110.000000006C911000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142956827.000000006C913000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143044653.000000006C91D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143105643.000000006C925000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c590000_wegame.jbxd

Similarity

API ID: CreateDirectoryH_prolog3_
String ID: .log$\memlog$mem$memlog$wegame
API String ID: 286309480-2121784790
Opcode ID: 4b46f72d1ef16578d8070de4553f17d48336eee0427ac0ac21cbc566d1ec08e0
Instruction ID: 59bb2cab9af03ea5da2bcd2623b5a4b1ed0d5a28cae4894593be4299d5ba7f8b
Opcode Fuzzy Hash: 4b46f72d1ef16578d8070de4553f17d48336eee0427ac0ac21cbc566d1ec08e0
Instruction Fuzzy Hash: 0AC1BD71A05248EFDF14DBE4CC44BDEBBB8AF59308F14449DE485A7640DB349E49CBA2

Function 6C61426E Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 135fileCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6C614278
memset.VCRUNTIME140(?,00000000,00000100,00000394,6C614235,?,00000010,?), ref: 6C6142BE
__snprintf_s.LIBCMT ref: 6C6142D7
CreateFileA.KERNEL32(?,C0000000,00000003,00000000,00000003,00000000,00000000,?,?,?,00000394,6C614235,?,00000010,?), ref: 6C6142F4
memset.VCRUNTIME140(?,00000000,0000022D,?,?,?,00000394,6C614235,?,00000010,?), ref: 6C61431B
memcpy.VCRUNTIME140(?,SCSIDISK), ref: 6C614356
DeviceIoControl.KERNEL32(00000000,0004D008,?,0000003C,?,0000022D,?,00000000), ref: 6C614389
FindCloseChangeNotification.KERNEL32(00000000), ref: 6C614463

Part of subcall function 6C614139: __EH_prolog3.LIBCMT ref: 6C614140

Part of subcall function 6C59A3A0: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,6C5A62D8,00000000,6C5A6649,00000003,9C33995A,?,?,00000000,6C7FF594,000000FF,?,6C5A5B05,00000000), ref: 6C59A3E5

Strings

SCSIDISK, xrefs: 6C614332
\\.\Scsi%d:, xrefs: 6C6142C4

Memory Dump Source

Source File: 00000006.00000002.4141448948.000000006C591000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000006.00000002.4141374342.000000006C590000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142318714.000000006C825000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142662450.000000006C906000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142732140.000000006C907000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142791681.000000006C909000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142876110.000000006C911000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142956827.000000006C913000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143044653.000000006C91D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143105643.000000006C925000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c590000_wegame.jbxd

Similarity

API ID: memset$ChangeCloseControlCreateDeviceFileFindH_prolog3H_prolog3_Notification__snprintf_s_invalid_parameter_noinfo_noreturnmemcpy
String ID: SCSIDISK$\\.\Scsi%d:
API String ID: 1560948447-2176293039
Opcode ID: 90756bb77f161ecc8d6fdc5870053258def9ea8ce3002cbb08a7de0a884ca88e
Instruction ID: 71b5a30581e5fffe0db86ea22bd9c0d37151d3977af108c97f47f40af637f26e
Opcode Fuzzy Hash: 90756bb77f161ecc8d6fdc5870053258def9ea8ce3002cbb08a7de0a884ca88e
Instruction Fuzzy Hash: 1451A0B1A40328ABEB21DB64CC49BEDB77CAB15718F4001D5A518B76C0DBB05B89CF95

Function 00458A88 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 66COMMON

Download Yara Rule

APIs

?is_static_detail_log@common@ierd_tgp@@YA_NXZ.COMMON(?), ref: 00458A94
?GetLastLoginedWegameId@common@ierd_tgp@@YAIXZ.COMMON(?), ref: 00458AA0
SimpleUString::operator=.MSOBJ140-MSVCRT ref: 00458AC5
?get_client_version_type@overseas@ierd_tgp@@YAHXZ.COMMON(?,?,?,?,00452A0B,00000000,?), ref: 00458AD1
?get_client_version_type@overseas@ierd_tgp@@YAHXZ.COMMON(?,?,?,?,00452A0B,00000000,?), ref: 00458AE2
SimpleUString::operator=.MSOBJ140-MSVCRT ref: 00458AF4
?Instance@CrashReportLoader@crash_report@@SAAAV12@XZ.ADAPT_FOR_IMPORTS ref: 00458B1A
?Init@CrashReportLoader@crash_report@@QAEXPB_W_K1HP6GHPAUtagCrashReportHelperCallbackInfo@@@Z0@Z.ADAPT_FOR_IMPORTS(?,00000000,00000000,0000000A,00000004,00000000,00457BEC,?), ref: 00458B46
?stamp_point@@YAXPBD@Z.COMMON(CrashReportLoaderInit end), ref: 00458B51

Strings

CrashReportLoaderInit end, xrefs: 00458B4C
WeGameX, xrefs: 00458ADB

Memory Dump Source

Source File: 00000006.00000002.4137209488.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.4137156906.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137406249.0000000000476000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137497400.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137574844.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137626631.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137684215.00000000004A3000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_wegame.jbxd

Similarity

API ID: CrashReport$?get_client_version_type@overseas@ierd_tgp@@Loader@crash_report@@SimpleString::operator=$?is_static_detail_log@common@ierd_tgp@@?stamp_point@@CallbackHelperId@common@ierd_tgp@@Info@@@Init@Instance@LastLoginedUtagV12@Wegame
String ID: CrashReportLoaderInit end$WeGameX
API String ID: 2291668861-1424904570
Opcode ID: 9438a7860a760e314f14ad3bfa66e2cf8c8b8a654fd683f1d14d68b625ed5a97
Instruction ID: f0db8a050510f7fbb63159d565a8b13cbf4ecf7e28f14a3a97a9cdce98db52b9
Opcode Fuzzy Hash: 9438a7860a760e314f14ad3bfa66e2cf8c8b8a654fd683f1d14d68b625ed5a97
Instruction Fuzzy Hash: E3213330D04309DBDF14EBE9C856ADEB7B5AF04318F60815EE019771C1EB781A05CB99

Function 0045D18F Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 136COMMON

Download Yara Rule

APIs

Part of subcall function 00452794: __EH_prolog3.LIBCMT ref: 0045279B

Part of subcall function 004632E3: __EH_prolog3_GS.LIBCMT ref: 004632EA

Part of subcall function 0044D068: __EH_prolog3.LIBCMT ref: 0044D06F
Part of subcall function 0044D068: ?_Init@locale@std@@CAPAV_Locimp@12@_N@Z.MSVCP140(00000001,?,?,?,?,00000008,00000000,int __thiscall boost::property_tree::basic_ptree<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,struct std::less<class std::basic_s,e:\dailybuild_fix_5.4\wegame_client\dependences\boost_1_67_0\boost\property_tree\detail\ptree_implementation.hpp,000002A0), ref: 0044D086

?get_log_instance@base@@YAPAVILogger@1@XZ.COMMON(?,?,?,?,log), ref: 0045D215
?get_log_instance@base@@YAPAVILogger@1@XZ.COMMON(00000001,00000000,?,00000000,00000000,?,00000001,03200000,00000000,00000150), ref: 0045D245
?is_static_detail_log@common@ierd_tgp@@YA_NXZ.COMMON(?,?,?,?,?,?,?,?,?,?,0045CDD2,00000000,00452A2A), ref: 0045D253

Part of subcall function 00466016: __EH_prolog3.LIBCMT ref: 0046601D

Part of subcall function 0044BF47: __EH_prolog3.LIBCMT ref: 0044BF4E

Part of subcall function 00449E04: __EH_prolog3.LIBCMT ref: 00449E0B

?PushAsyncTask@common@ierd_tgp@@YAXV?$function@$$A6AXXZ@std@@K@Z.COMMON(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0045D2DE
??_0path@filesystem@ierd_tgp@@QAEAAV012@PB_W@Z.COMMON(tcls/log), ref: 0045D2FA
?PushAsyncTask@common@ierd_tgp@@YAXV?$function@$$A6AXXZ@std@@K@Z.COMMON ref: 0045D36D

Part of subcall function 0040BC90: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,0040E9C2,?,?), ref: 0040BCDD

Strings

is_crypt, xrefs: 0045D1B0
tcls/log, xrefs: 0045D2F2
!, xrefs: 0045D365

Memory Dump Source

Source File: 00000006.00000002.4137209488.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.4137156906.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137406249.0000000000476000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137497400.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137574844.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137626631.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137684215.00000000004A3000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_wegame.jbxd

Similarity

API ID: H_prolog3$?get_log_instance@base@@AsyncLogger@1@PushTask@common@ierd_tgp@@V?$function@$$Z@std@@$??_0path@filesystem@ierd_tgp@@?is_static_detail_log@common@ierd_tgp@@H_prolog3_Init@locale@std@@Locimp@12@_V012@_invalid_parameter_noinfo_noreturn
String ID: !$is_crypt$tcls/log
API String ID: 712499144-3576253943
Opcode ID: 66f85536b19f23b2d26a6ee70db5b8f43c0dfc778280031bffea1c407a2edd00
Instruction ID: 9628f76ab5560915a4ea01c547a6eaf0160ba1de549f3c2c2952f7679806ea3d
Opcode Fuzzy Hash: 66f85536b19f23b2d26a6ee70db5b8f43c0dfc778280031bffea1c407a2edd00
Instruction Fuzzy Hash: 2051AE70D05248EAEF04EBA5CD56BDDBBB5AF14308F1081DEE10927282EB781F49DB56

Function 6C62B383 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 133sleepCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6C62B38D
?get_log_instance@base@@YAPAVILogger@1@XZ.COMMON(00000110), ref: 6C62B394
GetTickCount.KERNEL32 ref: 6C62B3F3
GetTickCount.KERNEL32 ref: 6C62B411
?get_log_instance@base@@YAPAVILogger@1@XZ.COMMON ref: 6C62B43C
Sleep.KERNEL32(00000064), ref: 6C62B544

Part of subcall function 6C5AA5EF: __EH_prolog3.LIBCMT ref: 6C5AA5F6

Strings

[Qos_http_handler] wait for timeout,counting_stop_ms=%u, xrefs: 6C62B48B
e:\dailybuild_fix_5.4\wegame_client\codes\common\src\qos_http_handler.cpp, xrefs: 6C62B3B8, 6C62B468
[Qos_http_handler] worker start, xrefs: 6C62B3D4

Memory Dump Source

Source File: 00000006.00000002.4141448948.000000006C591000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000006.00000002.4141374342.000000006C590000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142318714.000000006C825000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142662450.000000006C906000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142732140.000000006C907000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142791681.000000006C909000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142876110.000000006C911000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142956827.000000006C913000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143044653.000000006C91D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143105643.000000006C925000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c590000_wegame.jbxd

Similarity

API ID: ?get_log_instance@base@@CountLogger@1@Tick$H_prolog3H_prolog3_Sleep
String ID: [Qos_http_handler] wait for timeout,counting_stop_ms=%u$[Qos_http_handler] worker start$e:\dailybuild_fix_5.4\wegame_client\codes\common\src\qos_http_handler.cpp
API String ID: 3273642127-3102551350
Opcode ID: bee0ff04fd6f22333cf92c072a1a6e8eb3c38ef71b755a3c385a18df10e2ae4d
Instruction ID: 3668f0ac948df2da90b068504f34d60b7defcd49bb2fa0af36ecb9f64b4002f3
Opcode Fuzzy Hash: bee0ff04fd6f22333cf92c072a1a6e8eb3c38ef71b755a3c385a18df10e2ae4d
Instruction Fuzzy Hash: 7B51E030A013459ACB29DBB4C9647DD77B1AF86308F14489CD156AB781DF789E89CF84

Function 6C625868 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 124threadCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6C625872
?get_log_instance@base@@YAPAVILogger@1@XZ.COMMON(00000098,6C5E6E07,?,00000001,?,?,0000008C,6C5E79F6,00000002,00000000,?), ref: 6C625881
?get_log_instance@base@@YAPAVILogger@1@XZ.COMMON(00000098,6C5E6E07,?,00000001,?,?,0000008C,6C5E79F6,00000002,00000000,?), ref: 6C6258DF
GetCurrentThreadId.KERNEL32 ref: 6C625963
?PushUniqueThreadAsyncTask@common@ierd_tgp@@YAIV?$function@$$A6AXXZ@std@@IK@Z.COMMON(?), ref: 6C6259F7

Part of subcall function 6C5AA5EF: __EH_prolog3.LIBCMT ref: 6C5AA5F6

Part of subcall function 6C5AE945: __EH_prolog3_catch_GS.LIBCMT ref: 6C5AE94C

?real_report@Qos@qos@adapt_for_imports@ierd_tgp@@QAE_NABUQos_data_base@234@@Z.COMMON(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,6C5E7AEF,0000000F), ref: 6C625A17

Part of subcall function 6C624E51: __EH_prolog3_GS.LIBCMT ref: 6C624E58
Part of subcall function 6C624E51: ?get_log_instance@base@@YAPAVILogger@1@XZ.COMMON(0000007C,6C625A1C,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C624E6A

Strings

[qos_t]Offline mode, disable QOS report: %d., xrefs: 6C6258BC
e:\dailybuild_fix_5.4\wegame_client\codes\common\src\qos_command.cpp, xrefs: 6C6258A5, 6C625904
[qos_t] qos report arrived, qos_kind = %d, xrefs: 6C625920

Memory Dump Source

Source File: 00000006.00000002.4141448948.000000006C591000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000006.00000002.4141374342.000000006C590000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142318714.000000006C825000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142662450.000000006C906000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142732140.000000006C907000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142791681.000000006C909000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142876110.000000006C911000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142956827.000000006C913000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143044653.000000006C91D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143105643.000000006C925000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c590000_wegame.jbxd

Similarity

API ID: ?get_log_instance@base@@Logger@1@$H_prolog3_Thread$?real_report@AsyncCurrentH_prolog3H_prolog3_catch_PushQos@qos@adapt_for_imports@ierd_tgp@@Qos_data_base@234@@Task@common@ierd_tgp@@UniqueV?$function@$$Z@std@@
String ID: [qos_t] qos report arrived, qos_kind = %d$[qos_t]Offline mode, disable QOS report: %d.$e:\dailybuild_fix_5.4\wegame_client\codes\common\src\qos_command.cpp
API String ID: 3831734066-150783011
Opcode ID: 522a01e7dd0459032b5c1afac29ed468ca261be851cf4ca782ebd829d2c32cd6
Instruction ID: 4d7a750e3c5bae41eb603ff903dabf08762682309a331d58048f291cd6d44db5
Opcode Fuzzy Hash: 522a01e7dd0459032b5c1afac29ed468ca261be851cf4ca782ebd829d2c32cd6
Instruction Fuzzy Hash: 5C41CF30901348EBDB20DBE0CD55BDD77B0AF41708F208588E0597BA81DB759E0ADF99

Function 0045C3F3 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 111COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0045C3FD

Part of subcall function 0045A71E: __EH_prolog3_GS.LIBCMT ref: 0045A728
Part of subcall function 0045A71E: memset.VCRUNTIME140(?,00000000,00000208,00000214,004635F1,?,F69FE839,?,?,?,?,?,0047458B,000000FF), ref: 0045A74B
Part of subcall function 0045A71E: GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 0045A760
Part of subcall function 0045A71E: PathRemoveFileSpecW.SHLWAPI(?), ref: 0045A76D

Part of subcall function 0040BC90: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,0040E9C2,?,?), ref: 0040BCDD

GetPrivateProfileStringW.KERNEL32(cmd_launcher_info,launcher,0047E4BC,?,00000410,?), ref: 0045C4FA
SimpleUString::operator=.MSOBJ140-MSVCRT ref: 0045C50D
?u16to8@common@ierd_tgp@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@4@@Z.COMMON(?,?), ref: 0045C51A
?get_log_instance@base@@YAPAVILogger@1@XZ.COMMON ref: 0045C521

Part of subcall function 0043DD1B: __EH_prolog3.LIBCMT ref: 0043DD22

Strings

[main]read_cmd_launcher_info, get launcher from cmd_start_for, launcher = %s, xrefs: 0045C567
e:\dailybuild_fix_5.4\wegame_client\codes\main\tgp_daemon\src\tgp_daemon_main.cpp, xrefs: 0045C545
cmd_launcher_info, xrefs: 0045C4F5
launcher, xrefs: 0045C4F0

Memory Dump Source

Source File: 00000006.00000002.4137209488.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.4137156906.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137406249.0000000000476000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137497400.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137574844.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137626631.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137684215.00000000004A3000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_wegame.jbxd

Similarity

API ID: FileH_prolog3_$?get_log_instance@base@@?u16to8@common@ierd_tgp@@D@2@@4@@D@std@@H_prolog3Logger@1@ModuleNamePathPrivateProfileRemoveSimpleSpecStringString::operator=U?$char_traits@U?$char_traits@_V?$allocator@V?$allocator@_V?$basic_string@V?$basic_string@_W@2@@std@@W@std@@_invalid_parameter_noinfo_noreturnmemset
String ID: [main]read_cmd_launcher_info, get launcher from cmd_start_for, launcher = %s$cmd_launcher_info$e:\dailybuild_fix_5.4\wegame_client\codes\main\tgp_daemon\src\tgp_daemon_main.cpp$launcher
API String ID: 3879750388-390552085
Opcode ID: 3b6dbe6369a35820b272f878bb4a01ad5728209df910199bbaea41ca36f27001
Instruction ID: 69aab85f27c2433cf4945bb33c937ce56145cb0ab4f3b582563a121739b720c2
Opcode Fuzzy Hash: 3b6dbe6369a35820b272f878bb4a01ad5728209df910199bbaea41ca36f27001
Instruction Fuzzy Hash: 85414770905258DADB20EF65C885BDDBBF4FB04704F5485EEA088A7282DF785B84CF99

Function 0045C386 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 27COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0045C38D
OutputDebugStringA.KERNEL32([TGP]ReadBugRptConfig.,0000001C), ref: 0045C397
?instance@Application@common@ierd_tgp@@SAPAV123@XZ.COMMON ref: 0045C39D
?get_workingdir_path_ex@Application@common@ierd_tgp@@SA?AVpath@filesystem@3@XZ.COMMON(?), ref: 0045C3A6
??_0path@filesystem@ierd_tgp@@QAEAAV012@PB_W@Z.COMMON(?), ref: 0045C3B9
GetPrivateProfileIntW.KERNEL32(BugRpt,report_qos,00000001,?), ref: 0045C3D6

Strings

BugRpt, xrefs: 0045C3D1
[TGP]ReadBugRptConfig., xrefs: 0045C392
report_qos, xrefs: 0045C3CC

Memory Dump Source

Source File: 00000006.00000002.4137209488.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.4137156906.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137406249.0000000000476000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137497400.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137574844.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137626631.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137684215.00000000004A3000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_wegame.jbxd

Similarity

API ID: Application@common@ierd_tgp@@$??_0path@filesystem@ierd_tgp@@?get_workingdir_path_ex@?instance@DebugH_prolog3_OutputPrivateProfileStringV012@V123@Vpath@filesystem@3@
String ID: BugRpt$[TGP]ReadBugRptConfig.$report_qos
API String ID: 3418139206-2276067687
Opcode ID: d53297421f035ef8f12599975b4361c17ae68e830489fb44a72172bf767a3deb
Instruction ID: 467e8fb53e5e562a4483d68ff9a8d02879b16a2eea96c33bb612cbd65ec87df5
Opcode Fuzzy Hash: d53297421f035ef8f12599975b4361c17ae68e830489fb44a72172bf767a3deb
Instruction Fuzzy Hash: 6EF01DB0944208EBDB00EBE5C846ADCB6B4AF04328F54402EE115A2191EB785A84CA3E

Function 6C59FD30 Relevance: 15.3, APIs: 10, Instructions: 254COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,7FFFFFFF,00000000,?,00000000,0000000F), ref: 6C59FDFA
memset.VCRUNTIME140(00000010,?,00000000,00000000,7FFFFFFF,00000000,?,00000000,0000000F), ref: 6C59FE08
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00000000,0000000F), ref: 6C59FE4B
memcpy.VCRUNTIME140(00000000,?,00000000,?,00000000,0000000F), ref: 6C59FE53
memset.VCRUNTIME140(7FFFFFFF,?,00000000,00000000,?,00000000,?,00000000,0000000F), ref: 6C59FE5F

Part of subcall function 6C6ABEB5: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,6C5A621D,0000002C,0000000C,6C5A5702,00000004,6C5A57B1,00000214), ref: 6C6ABECA

memcpy.VCRUNTIME140(00000000,7FFFFFFF,00000000,?,00000000), ref: 6C59FF43
memcpy.VCRUNTIME140(00000010,00000000,?,00000000,7FFFFFFF,00000000,?,00000000), ref: 6C59FF51
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00000000), ref: 6C59FF94
memcpy.VCRUNTIME140(00000000,?,00000000,?,00000000), ref: 6C59FF9C
memcpy.VCRUNTIME140(7FFFFFFF,00000000,?,00000000,?,00000000,?,00000000), ref: 6C59FFA8

Memory Dump Source

Source File: 00000006.00000002.4141448948.000000006C591000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000006.00000002.4141374342.000000006C590000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142318714.000000006C825000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142662450.000000006C906000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142732140.000000006C907000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142791681.000000006C909000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142876110.000000006C911000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142956827.000000006C913000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143044653.000000006C91D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143105643.000000006C925000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c590000_wegame.jbxd

Similarity

API ID: memcpy$_invalid_parameter_noinfo_noreturnmemset$malloc
String ID:
API String ID: 2179307412-0
Opcode ID: f425d4b20ff3ae3c8d311e17e939a58aeb09ec43a73803216b244af7036ed7b8
Instruction ID: 53602ee13a4e0b56953a44c7c6651ba8ad357e047273f134b7b11b18978e8272
Opcode Fuzzy Hash: f425d4b20ff3ae3c8d311e17e939a58aeb09ec43a73803216b244af7036ed7b8
Instruction Fuzzy Hash: BF81FF72A01248AFDB05CF6CCC8059EB7A6FF8A355B1447AAF8159B741E730DE128B91

Function 6C5C6C42 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 213COMMON

Download Yara Rule

APIs

Part of subcall function 6C5C467D: __EH_prolog3.LIBCMT ref: 6C5C4684

?c_str@path@filesystem@ierd_tgp@@QBEPB_WXZ.COMMON(?,?,00000000), ref: 6C5C6D18
~refcount_ptr.LIBCPMT ref: 6C5C6D2B
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000), ref: 6C5C6D30

Part of subcall function 6C5C3971: __EH_prolog3.LIBCMT ref: 6C5C3978

OutputDebugStringW.KERNEL32(00000000,?,00000000,00000000), ref: 6C5C6E0A
OutputDebugStringW.KERNEL32(00000000,?,00000000,00000000,?,?,?,?,00000000,00000000), ref: 6C5C6EA2

Strings

A, xrefs: 6C5C6CC7
forced abort due to illegal log prefix [{}], xrefs: 6C5C6CFC
Pl#, xrefs: 6C5C6D45

Memory Dump Source

Source File: 00000006.00000002.4141448948.000000006C591000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000006.00000002.4141374342.000000006C590000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142318714.000000006C825000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142662450.000000006C906000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142732140.000000006C907000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142791681.000000006C909000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142876110.000000006C911000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142956827.000000006C913000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143044653.000000006C91D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143105643.000000006C925000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c590000_wegame.jbxd

Similarity

API ID: DebugH_prolog3OutputString$?c_str@path@filesystem@ierd_tgp@@abort~refcount_ptr
String ID: Pl#$forced abort due to illegal log prefix [{}]$A
API String ID: 3296511426-3731117100
Opcode ID: 420dcf9a2352d050d302963fab3139a0a917e13912fc2a743fe3e0a8080cdcbd
Instruction ID: 9d17888c3ba07f3e5632fd67822a308509298fdef87c92a01363c3b3922ac265
Opcode Fuzzy Hash: 420dcf9a2352d050d302963fab3139a0a917e13912fc2a743fe3e0a8080cdcbd
Instruction Fuzzy Hash: 91818F71A04288EFDF14DBE4CD48BDE7FB8AF55308F14449DE001A7681DB759A0ACBA2

Function 6C62A2A3 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 141COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6C62A2AD
?get_qos_instance@qos@adapt_for_imports@ierd_tgp@@YAAAVQos@123@XZ.COMMON(?,?,?,?,?,?,?,?,?,?,?,?,00000140), ref: 6C62A34D

Part of subcall function 6C629C0E: __EH_prolog3.LIBCMT ref: 6C629C15

?report@Qos@qos@adapt_for_imports@ierd_tgp@@QAE_NABUQos_data_base@234@W4Qos_occasion@234@@Z.COMMON(00000000,00000001), ref: 6C62A390

Part of subcall function 6C625868: __EH_prolog3_GS.LIBCMT ref: 6C625872
Part of subcall function 6C625868: ?get_log_instance@base@@YAPAVILogger@1@XZ.COMMON(00000098,6C5E6E07,?,00000001,?,?,0000008C,6C5E79F6,00000002,00000000,?), ref: 6C625881

?get_log_instance@base@@YAPAVILogger@1@XZ.COMMON ref: 6C62A3A4

Strings

e:\dailybuild_fix_5.4\wegame_client\codes\common\src\qos_http_handler.cpp, xrefs: 6C62A3D0
success, xrefs: 6C62A40C
failed, xrefs: 6C62A3FD
[Qos_http_handler] qos report %s: qos_id=%d, seq=%d, response_code=%d, total_time=%.3f, conn_time=%.3f, xrefs: 6C62A3EF

Memory Dump Source

Source File: 00000006.00000002.4141448948.000000006C591000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000006.00000002.4141374342.000000006C590000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142318714.000000006C825000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142662450.000000006C906000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142732140.000000006C907000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142791681.000000006C909000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142876110.000000006C911000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142956827.000000006C913000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143044653.000000006C91D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143105643.000000006C925000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c590000_wegame.jbxd

Similarity

API ID: ?get_log_instance@base@@H_prolog3_Logger@1@$?get_qos_instance@qos@adapt_for_imports@ierd_tgp@@?report@H_prolog3Qos@123@Qos@qos@adapt_for_imports@ierd_tgp@@Qos_data_base@234@Qos_occasion@234@@
String ID: [Qos_http_handler] qos report %s: qos_id=%d, seq=%d, response_code=%d, total_time=%.3f, conn_time=%.3f$e:\dailybuild_fix_5.4\wegame_client\codes\common\src\qos_http_handler.cpp$failed$success
API String ID: 3901038974-880655951
Opcode ID: 88cb6bcc8ffbd34db654807b60028d39111b2bd13bde0db15b04af3f5dedabaa
Instruction ID: 578e9789637630cd0ec342abad616a20d1f97c42af713844bc3fe577cb8fbbca
Opcode Fuzzy Hash: 88cb6bcc8ffbd34db654807b60028d39111b2bd13bde0db15b04af3f5dedabaa
Instruction Fuzzy Hash: E9512271900218DBCF29DFA4CC95BED73B5AF89308F1006C8E4086B691EB749E88CF55

Function 0045D200 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 116COMMON

Download Yara Rule

APIs

?get_log_instance@base@@YAPAVILogger@1@XZ.COMMON(?,?,?,?,log), ref: 0045D215
?get_log_instance@base@@YAPAVILogger@1@XZ.COMMON(00000001,00000000,?,00000000,00000000,?,00000001,03200000,00000000,00000150), ref: 0045D245
?is_static_detail_log@common@ierd_tgp@@YA_NXZ.COMMON(?,?,?,?,?,?,?,?,?,?,0045CDD2,00000000,00452A2A), ref: 0045D253

Part of subcall function 00466016: __EH_prolog3.LIBCMT ref: 0046601D

Part of subcall function 0044BF47: __EH_prolog3.LIBCMT ref: 0044BF4E

Part of subcall function 00449E04: __EH_prolog3.LIBCMT ref: 00449E0B

?PushAsyncTask@common@ierd_tgp@@YAXV?$function@$$A6AXXZ@std@@K@Z.COMMON(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0045D2DE
??_0path@filesystem@ierd_tgp@@QAEAAV012@PB_W@Z.COMMON(tcls/log), ref: 0045D2FA
?PushAsyncTask@common@ierd_tgp@@YAXV?$function@$$A6AXXZ@std@@K@Z.COMMON ref: 0045D36D

Part of subcall function 0040BC90: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,0040E9C2,?,?), ref: 0040BCDD

Strings

tcls/log, xrefs: 0045D2F2
!, xrefs: 0045D365

Memory Dump Source

Source File: 00000006.00000002.4137209488.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.4137156906.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137406249.0000000000476000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137497400.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137574844.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137626631.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137684215.00000000004A3000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_wegame.jbxd

Similarity

API ID: H_prolog3$?get_log_instance@base@@AsyncLogger@1@PushTask@common@ierd_tgp@@V?$function@$$Z@std@@$??_0path@filesystem@ierd_tgp@@?is_static_detail_log@common@ierd_tgp@@V012@_invalid_parameter_noinfo_noreturn
String ID: !$tcls/log
API String ID: 2928327206-1193755044
Opcode ID: fde8617934704d016f4371f85e1f3facbe7b0ac077d8a5757f23673269abb58f
Instruction ID: 0391e7039c081f9b2a3f8601be9dd5579dea071138f01aad9288b4ac7cab2945
Opcode Fuzzy Hash: fde8617934704d016f4371f85e1f3facbe7b0ac077d8a5757f23673269abb58f
Instruction Fuzzy Hash: A6419D70D05248EBEB04EBA5CD96BDDBBB5AF14308F1481DDE10927282EB342F49DB56

Function 00450C7C Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 68fileCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00450C83

Part of subcall function 0045A8D2: GetCurrentProcessId.KERNEL32(?,?,00450C8F,00000004,00401E4B), ref: 0045A8D4
Part of subcall function 0045A8D2: memset.VCRUNTIME140(7800TPF_Share_Mem,00000000,00000040,?,?,00450C8F,00000004,00401E4B), ref: 0045A8E6
Part of subcall function 0045A8D2: wcscat_s.API-MS-WIN-CRT-STRING-L1-1-0(7800TPF_Share_Mem,00000020,TPF_Share_Mem,7800TPF_Share_Mem,00000020,%lu,00000000,7800TPF_Share_Mem,00000000,00000040,?,?,00450C8F,00000004,00401E4B), ref: 0045A901

CreateFileMappingW.KERNELBASE(000000FF,00000000,00000004,00000000,00000004,00000000,00000004,00401E4B), ref: 00450C9A
GetLastError.KERNEL32 ref: 00450CA7

Part of subcall function 00467337: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000001), ref: 00467340
Part of subcall function 00467337: __vfprintf_l.MSPDB140-MSVCRT ref: 0046734E

MapViewOfFile.KERNEL32(00000000,000F001F,00000000,00000000,00000004), ref: 00450CCB
GetLastError.KERNEL32 ref: 00450CD8

Strings

Could not map view of file (%lu)., xrefs: 00450CDF
Could not open file mapping object (%lu)., xrefs: 00450CAE

Memory Dump Source

Source File: 00000006.00000002.4137209488.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.4137156906.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137406249.0000000000476000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137497400.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137574844.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137626631.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137684215.00000000004A3000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_wegame.jbxd

Similarity

API ID: ErrorFileLast$CreateCurrentH_prolog3MappingProcessView__acrt_iob_func__vfprintf_lmemsetwcscat_s
String ID: Could not map view of file (%lu).$Could not open file mapping object (%lu).
API String ID: 3062832350-3732869390
Opcode ID: ef3e52f6f5e81b0158d27f5e2748283e1d84f887405bdd9aac9982a98d2fb024
Instruction ID: 0b94a05c0bd0e06c3e914e91a71433da7b27ee554ce2f92681667f295eb1768d
Opcode Fuzzy Hash: ef3e52f6f5e81b0158d27f5e2748283e1d84f887405bdd9aac9982a98d2fb024
Instruction Fuzzy Hash: 4D21D8B05447019ED7206F568C09E1ABEE4EF90724B20851FF958C72A2EBB8C440CB1D

Function 6C5D725C Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 165COMMON

Download Yara Rule

APIs

__EH_prolog3_catch_GS.LIBCMT ref: 6C5D7266
?split_path@common@ierd_tgp@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAV34@1@Z.COMMON(?,?,?), ref: 6C5D72CB

Part of subcall function 6C5D984D: __EH_prolog3_GS.LIBCMT ref: 6C5D9854

?get_file_path_by_key@common@ierd_tgp@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAVpath@filesystem@2@@Z.COMMON(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000094), ref: 6C5D7328

Part of subcall function 6C5D756C: __EH_prolog3_catch_GS.LIBCMT ref: 6C5D7573
Part of subcall function 6C5D756C: ?get_cfg@common@ierd_tgp@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABVpath@filesystem@2@AAV?$basic_ptree@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@property_tree@boost@@_N3@Z.COMMON(?,?,?,00000001,?,0000006C,6C5D7356,?,?,?,?), ref: 6C5D7596

?u16to8@common@ierd_tgp@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@4@@Z.COMMON(?,?), ref: 6C5D73B9
?get_log_instance@base@@YAPAVILogger@1@XZ.COMMON ref: 6C5D73C0

Part of subcall function 6C59A3A0: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,6C5A62D8,00000000,6C5A6649,00000003,9C33995A,?,?,00000000,6C7FF594,000000FF,?,6C5A5B05,00000000), ref: 6C59A3E5

Strings

e:\dailybuild_fix_5.4\wegame_client\codes\common\src\cfg_file.cpp, xrefs: 6C5D73E4
[cfg_mgr]get_cfg failed, path:%s, node_name:%s, xrefs: 6C5D7413

Memory Dump Source

Source File: 00000006.00000002.4141448948.000000006C591000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000006.00000002.4141374342.000000006C590000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142318714.000000006C825000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142662450.000000006C906000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142732140.000000006C907000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142791681.000000006C909000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142876110.000000006C911000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142956827.000000006C913000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143044653.000000006C91D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143105643.000000006C925000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c590000_wegame.jbxd

Similarity

API ID: D@std@@U?$char_traits@V?$allocator@V?$basic_string@$D@2@@std@@$H_prolog3_catch_$?get_cfg@common@ierd_tgp@@?get_file_path_by_key@common@ierd_tgp@@?get_log_instance@base@@?split_path@common@ierd_tgp@@?u16to8@common@ierd_tgp@@D@2@@4@@D@2@@std@@@2@@property_tree@boost@@_H_prolog3_Logger@1@U?$char_traits@_U?$less@V12@V34@1@V?$allocator@_V?$basic_ptree@V?$basic_string@_Vpath@filesystem@2@Vpath@filesystem@2@@W@2@@std@@W@std@@_invalid_parameter_noinfo_noreturn
String ID: [cfg_mgr]get_cfg failed, path:%s, node_name:%s$e:\dailybuild_fix_5.4\wegame_client\codes\common\src\cfg_file.cpp
API String ID: 868211161-3427424415
Opcode ID: d42a90b289879de1d6a07253f24d9c2ad0cd545a64f3b67e69c3a69d0eed09f3
Instruction ID: 3cc9d521ba0d2ce791b04ae8c96865d291a47c94f44702f674f70473878a19fa
Opcode Fuzzy Hash: d42a90b289879de1d6a07253f24d9c2ad0cd545a64f3b67e69c3a69d0eed09f3
Instruction Fuzzy Hash: D0616A70C06288EADF01CFE8C954BCDBBB4AF55308F64819DC045AB681DB746F49CB66

Function 6C7F8EC0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 124stringnetworkCOMMON

Download Yara Rule

APIs

strchr.VCRUNTIME140(?,0000003A,00000000,00000000,?,?), ref: 6C7F8EF9
memcpy.VCRUNTIME140(?,?,00000000,?,?), ref: 6C7F8F1E
atoi.API-MS-WIN-CRT-CONVERT-L1-1-0(-00000001), ref: 6C7F8F3D
htons.WS2_32(00000000), ref: 6C7F8F77
strspn.API-MS-WIN-CRT-STRING-L1-1-0(?,1234567890.), ref: 6C7F8F8B
gethostbyname.WS2_32(?), ref: 6C7F8FE3

Strings

1234567890., xrefs: 6C7F8F85

Memory Dump Source

Source File: 00000006.00000002.4141448948.000000006C591000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000006.00000002.4141374342.000000006C590000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142318714.000000006C825000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142662450.000000006C906000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142732140.000000006C907000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142791681.000000006C909000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142876110.000000006C911000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142956827.000000006C913000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143044653.000000006C91D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143105643.000000006C925000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c590000_wegame.jbxd

Similarity

API ID: atoigethostbynamehtonsmemcpystrchrstrspn
String ID: 1234567890.
API String ID: 4239400579-3734169883
Opcode ID: 5d35cf4e0a3ae67396a96a10997ca3cf6c63b1d3ed85307cd977108939797da6
Instruction ID: 330038bbf5f97acf455ca225f205eafb12e6f1115b6f0ceb8b240ace043609ad
Opcode Fuzzy Hash: 5d35cf4e0a3ae67396a96a10997ca3cf6c63b1d3ed85307cd977108939797da6
Instruction Fuzzy Hash: 303127756043419FEB10CF35DA84BAA77E9BF47318F048A2EE8A587B01EB31D60B8751

Function 6C62A9E8 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 106COMMON

Download Yara Rule

APIs

std::_Cnd_initX.LIBCPMT ref: 6C62AA29

Part of subcall function 6C5C1AC7: _Mtx_lock.MSVCP140(6C625A1C,00000000,?,6C62AA2E,00000000,9C33995A,?,?,00000001,00000000,6C814578,000000FF,O<]l,6C626047,00000001,?), ref: 6C5C1ACE
Part of subcall function 6C5C1AC7: ?_Throw_C_error@std@@YAXH@Z.MSVCP140(00000000,00000000,?,6C62AA2E,00000000,9C33995A,?,?,00000001,00000000,6C814578,000000FF,O<]l,6C626047,00000001,?), ref: 6C5C1ADB

memcpy.VCRUNTIME140(?,6C625A1C,00000000,9C33995A,?,?,00000001,00000000,6C814578,000000FF,O<]l,6C626047,00000001,?,00000000,00000003), ref: 6C62AA41
std::_Cnd_initX.LIBCPMT ref: 6C62AA6B

Part of subcall function 6C5C1AE6: _Mtx_unlock.MSVCP140(00000001,00000000,?,6C62AA70,00000000,00000001,?,0000007C,6C625A1C), ref: 6C5C1AED
Part of subcall function 6C5C1AE6: ?_Throw_C_error@std@@YAXH@Z.MSVCP140(00000000,00000000,?,6C62AA70,00000000,00000001,?,0000007C,6C625A1C), ref: 6C5C1AFA

?get_log_instance@base@@YAPAVILogger@1@XZ.COMMON(00000001,?,0000007C,6C625A1C), ref: 6C62AA71

Part of subcall function 6C5AA5EF: __EH_prolog3.LIBCMT ref: 6C5AA5F6

Part of subcall function 6C5BA99D: __EH_prolog3_GS.LIBCMT ref: 6C5BA9A4

Part of subcall function 6C5BF934: __EH_prolog3_GS.LIBCMT ref: 6C5BF93B

Strings

O<]l, xrefs: 6C62A9E8
e:\dailybuild_fix_5.4\wegame_client\codes\common\src\qos_http_handler.cpp, xrefs: 6C62AA9A
[Qos_http_handler]report qos id= %d, xrefs: 6C62AAB9

Memory Dump Source

Source File: 00000006.00000002.4141448948.000000006C591000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000006.00000002.4141374342.000000006C590000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142318714.000000006C825000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142662450.000000006C906000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142732140.000000006C907000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142791681.000000006C909000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142876110.000000006C911000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142956827.000000006C913000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143044653.000000006C91D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143105643.000000006C925000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c590000_wegame.jbxd

Similarity

API ID: C_error@std@@Cnd_initH_prolog3_Throw_std::_$?get_log_instance@base@@H_prolog3Logger@1@Mtx_lockMtx_unlockmemcpy
String ID: O<]l$[Qos_http_handler]report qos id= %d$e:\dailybuild_fix_5.4\wegame_client\codes\common\src\qos_http_handler.cpp
API String ID: 3283189590-2201940988
Opcode ID: 81f396f7a87b8fa0d328364729064a9e989a835858064656c9ee9743cd8b21ab
Instruction ID: 90e55303eccbb5709b0c05b3435bb616b8a665d6d75c8132638176063dc714b0
Opcode Fuzzy Hash: 81f396f7a87b8fa0d328364729064a9e989a835858064656c9ee9743cd8b21ab
Instruction Fuzzy Hash: 52410371904248EFCB14DBA4CD50BEEBBB4EF45318F1005ADD415A7782DB749E09CBA5

Function 0043E651 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 59threadCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0043E658
?StartThread@CThread@@QAEHPAXH@Z.COMMON(00000000,00000000,00000050), ref: 0043E661
?get_log_instance@base@@YAPAVILogger@1@XZ.COMMON(00000000,00000000,00000050), ref: 0043E66A

Part of subcall function 0043DD1B: __EH_prolog3.LIBCMT ref: 0043DD22

?get_log_instance@base@@YAPAVILogger@1@XZ.COMMON(00000000,00000000,00000050), ref: 0043E6A9

Strings

Start crash check thread success., xrefs: 0043E6A2
Start crash check thread FAIL., xrefs: 0043E6E1
e:\dailybuild_fix_5.4\wegame_client\codes\main\tgp_daemon\src\crashchecker.cpp, xrefs: 0043E68F, 0043E6CA

Memory Dump Source

Source File: 00000006.00000002.4137209488.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.4137156906.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137406249.0000000000476000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137497400.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137574844.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137626631.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137684215.00000000004A3000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_wegame.jbxd

Similarity

API ID: ?get_log_instance@base@@Logger@1@$H_prolog3H_prolog3_StartThread@Thread@@
String ID: Start crash check thread FAIL.$Start crash check thread success.$e:\dailybuild_fix_5.4\wegame_client\codes\main\tgp_daemon\src\crashchecker.cpp
API String ID: 2209094223-1436392397
Opcode ID: 2d44b0bbae7675d1e666060a27599292190b5ec11b8e4beb39f8dd44816734ac
Instruction ID: f74a922ceaa4674959bf6e6fc8e7b1264cb98a5daca72c39f295744a9476d5e7
Opcode Fuzzy Hash: 2d44b0bbae7675d1e666060a27599292190b5ec11b8e4beb39f8dd44816734ac
Instruction Fuzzy Hash: BB11E970F41A2162CB24B6928C47F9F37215FA5B08F61410EB8017B3C2DFAD9E06CA5D

Function 6C657072 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 33COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6C657079
?instance@Application@common@ierd_tgp@@SAPAV123@XZ.COMMON(0000001C,6C5EA915,?,?,?,?,?,?,?,00000000,00000009), ref: 6C65708E
?get_workingdir_path_ex@Application@common@ierd_tgp@@SA?AVpath@filesystem@3@XZ.COMMON(?,0000001C,6C5EA915,?,?,?,?,?,?,?,00000000,00000009), ref: 6C657097
??_0path@filesystem@ierd_tgp@@QAEAAV012@PB_W@Z.COMMON(?,0000001C,6C5EA915,?,?,?,?,?,?,?,00000000,00000009), ref: 6C6570AA
GetPrivateProfileIntW.KERNEL32(curl_certificate_info,is_certificate_open,00000000,?), ref: 6C6570C7

Strings

is_certificate_open, xrefs: 6C6570BD
curl_certificate_info, xrefs: 6C6570C2

Memory Dump Source

Source File: 00000006.00000002.4141448948.000000006C591000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000006.00000002.4141374342.000000006C590000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142318714.000000006C825000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142662450.000000006C906000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142732140.000000006C907000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142791681.000000006C909000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142876110.000000006C911000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142956827.000000006C913000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143044653.000000006C91D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143105643.000000006C925000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c590000_wegame.jbxd

Similarity

API ID: Application@common@ierd_tgp@@$??_0path@filesystem@ierd_tgp@@?get_workingdir_path_ex@?instance@H_prolog3_PrivateProfileV012@V123@Vpath@filesystem@3@
String ID: curl_certificate_info$is_certificate_open
API String ID: 4076247625-1679244404
Opcode ID: 9a741cd9045c9f6fc121510fd8db5e4800eefcd65a899296af708289e8ab3106
Instruction ID: bcf4764aef3b7811c521c8bef47712bbe447cebf71a4a75c9f14c317838e6c07
Opcode Fuzzy Hash: 9a741cd9045c9f6fc121510fd8db5e4800eefcd65a899296af708289e8ab3106
Instruction Fuzzy Hash: F4F0A471548288DEDF10DBE4C816BDC7BF4AB4A318FA86819D054B2A90DB30894DCB76

Function 6C5E7503 Relevance: 11.0, APIs: 4, Strings: 2, Instructions: 517threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C5E7506
__EH_prolog3_catch_GS.LIBCMT ref: 6C5E7CB5

Part of subcall function 6C5A9A0E: __EH_prolog3.LIBCMT ref: 6C5A9A15

?u8to16@common@ierd_tgp@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@4@@Z.COMMON(?,?), ref: 6C5E7D04

Part of subcall function 6C6336B8: __EH_prolog3_GS.LIBCMT ref: 6C6336BF

Part of subcall function 6C5ACEF4: memcpy.VCRUNTIME140(00000000,?,?,00000001,?,?,?,?,?,?,6C5AA734,?,00000004,6C5AA09E,?,9C33995A), ref: 6C5ACF53

?get_cfg@common@ierd_tgp@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABVpath@filesystem@2@AAV?$basic_ptree@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@property_tree@boost@@@Z.COMMON(?,?,?,?), ref: 6C5E7D53

Part of subcall function 6C5D71FA: ?get_cfg@common@ierd_tgp@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABVpath@filesystem@2@AAV?$basic_ptree@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@property_tree@boost@@_N3@Z.COMMON(?,?,?,00000001,00000000,?,6C5D77FD,?,00000000,?,files,00000005), ref: 6C5D720A

Part of subcall function 6C59A8F0: memcpy.VCRUNTIME140(?,?,9XZl,?,?,00000000,?,?,6C5A5839,?,?), ref: 6C59A917

Part of subcall function 6C5D53A7: __EH_prolog3.LIBCMT ref: 6C5D53AE

Part of subcall function 6C5D76DE: __EH_prolog3_GS.LIBCMT ref: 6C5D76E5

Part of subcall function 6C59A3A0: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,6C5A62D8,00000000,6C5A6649,00000003,9C33995A,?,?,00000000,6C7FF594,000000FF,?,6C5A5B05,00000000), ref: 6C59A3E5

Part of subcall function 6C5E6F50: __EH_prolog3_GS.LIBCMT ref: 6C5E6F5A

Strings

.lazy, xrefs: 6C5E838D
plugins, xrefs: 6C5E7D8B

Memory Dump Source

Source File: 00000006.00000002.4141448948.000000006C591000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000006.00000002.4141374342.000000006C590000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142318714.000000006C825000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142662450.000000006C906000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142732140.000000006C907000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142791681.000000006C909000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142876110.000000006C911000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142956827.000000006C913000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143044653.000000006C91D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143105643.000000006C925000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c590000_wegame.jbxd

Similarity

API ID: D@std@@U?$char_traits@V?$allocator@V?$basic_string@$D@2@@std@@$H_prolog3_$?get_cfg@common@ierd_tgp@@H_prolog3U?$less@V12@V?$basic_ptree@Vpath@filesystem@2@memcpy$?u8to16@common@ierd_tgp@@CurrentD@2@@std@@@2@@property_tree@boost@@@D@2@@std@@@2@@property_tree@boost@@_H_prolog3_catch_ThreadU?$char_traits@_V?$allocator@_V?$basic_string@_W@2@@4@@W@std@@_invalid_parameter_noinfo_noreturn
String ID: .lazy$plugins
API String ID: 2012799754-1263553738
Opcode ID: 448d396bdd89fa865a907c9335af9ae2d0e40c19b7b7450a6481878c1e0f40fd
Instruction ID: 23affa75dc773056445019739c1559dfead716f12b49d852b81553715b738e39
Opcode Fuzzy Hash: 448d396bdd89fa865a907c9335af9ae2d0e40c19b7b7450a6481878c1e0f40fd
Instruction Fuzzy Hash: EB4287B1C122ACDADB11CBA8CD447DDBBB4AF55308F6080E9D61867281D7741F88DFA6

Function 0046357D Relevance: 10.8, APIs: 1, Strings: 5, Instructions: 297COMMON

Download Yara Rule

APIs

SimpleUString::operator=.MSOBJ140-MSVCRT ref: 004635FF

Strings

VersionData, xrefs: 00463687
Version, xrefs: 0046369D
ClientConf, xrefs: 00463671
VersionUpdateData, xrefs: 00463657
I, xrefs: 004636B3

Memory Dump Source

Source File: 00000006.00000002.4137209488.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.4137156906.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137406249.0000000000476000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137497400.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137574844.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137626631.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137684215.00000000004A3000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_wegame.jbxd

Similarity

API ID: SimpleString::operator=
String ID: ClientConf$Version$VersionData$VersionUpdateData$I
API String ID: 356670603-2976995237
Opcode ID: c3604022b3135c6d75bf464dabf33f942d25c7526d2d43f696df58ca4fbf8de4
Instruction ID: 85bcec602356843fc59ab434abf010903aa00cce7c67f589a26fa0c168b97eb2
Opcode Fuzzy Hash: c3604022b3135c6d75bf464dabf33f942d25c7526d2d43f696df58ca4fbf8de4
Instruction Fuzzy Hash: 0CC1F671C0424CEEDB11DBA9C945EDEBBB8AF15304F6081AEE055B3181DF786B48CB69

Function 6C613F63 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 109COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6C613F6D

Part of subcall function 6C613EE5: __EH_prolog3_GS.LIBCMT ref: 6C613EEC
Part of subcall function 6C613EE5: memcpy.VCRUNTIME140(?,?,00000010,?,00000018,6C613FB1,?,00000010), ref: 6C613F27

?get_log_instance@base@@YAPAVILogger@1@XZ.COMMON ref: 6C613FB7

Part of subcall function 6C5AA5EF: __EH_prolog3.LIBCMT ref: 6C5AA5F6

Part of subcall function 6C5AE945: __EH_prolog3_catch_GS.LIBCMT ref: 6C5AE94C

memset.VCRUNTIME140(?,00000000,00000040), ref: 6C614030

Strings

e:\dailybuild_fix_5.4\wegame_client\codes\common\src\machine_guid.cpp, xrefs: 6C613FD8
get_qm_report_guid failed, xrefs: 6C613FEF
%02x, xrefs: 6C614043

Memory Dump Source

Source File: 00000006.00000002.4141448948.000000006C591000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000006.00000002.4141374342.000000006C590000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142318714.000000006C825000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142662450.000000006C906000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142732140.000000006C907000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142791681.000000006C909000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142876110.000000006C911000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142956827.000000006C913000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143044653.000000006C91D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143105643.000000006C925000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c590000_wegame.jbxd

Similarity

API ID: H_prolog3_$?get_log_instance@base@@H_prolog3H_prolog3_catch_Logger@1@memcpymemset
String ID: %02x$e:\dailybuild_fix_5.4\wegame_client\codes\common\src\machine_guid.cpp$get_qm_report_guid failed
API String ID: 4188371020-2467422685
Opcode ID: f03901e99000b46d61bc5932456d02d746ceaedd04757c2ecd614be02290fdae
Instruction ID: 00935b196c17805dde153b57ac1bc5ccb43de72f7b36c1316122927a6139642f
Opcode Fuzzy Hash: f03901e99000b46d61bc5932456d02d746ceaedd04757c2ecd614be02290fdae
Instruction Fuzzy Hash: 6F41B470904348AEEB20CFA8CC54FEDBB75BF45308F14099DD5496BB81D7B19A4ACB64

Function 6C62ADDD Relevance: 10.6, APIs: 7, Instructions: 104COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,00004EAE,9C33995A,?,?,?,?,6C814649,000000FF), ref: 6C62AE2C
std::_Cnd_initX.LIBCPMT ref: 6C62AE3B

Part of subcall function 6C5C1AC7: _Mtx_lock.MSVCP140(6C625A1C,00000000,?,6C62AA2E,00000000,9C33995A,?,?,00000001,00000000,6C814578,000000FF,O<]l,6C626047,00000001,?), ref: 6C5C1ACE
Part of subcall function 6C5C1AC7: ?_Throw_C_error@std@@YAXH@Z.MSVCP140(00000000,00000000,?,6C62AA2E,00000000,9C33995A,?,?,00000001,00000000,6C814578,000000FF,O<]l,6C626047,00000001,?), ref: 6C5C1ADB

memcpy.VCRUNTIME140(?,-00000008,00004EAE), ref: 6C62AE62
std::_Cnd_initX.LIBCPMT ref: 6C62AE87
std::_Cnd_initX.LIBCPMT ref: 6C62AEA4
memcpy.VCRUNTIME140(?,-00000008,00004EAE), ref: 6C62AECC
std::_Cnd_initX.LIBCPMT ref: 6C62AEF7

Memory Dump Source

Source File: 00000006.00000002.4141448948.000000006C591000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000006.00000002.4141374342.000000006C590000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142318714.000000006C825000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142662450.000000006C906000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142732140.000000006C907000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142791681.000000006C909000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142876110.000000006C911000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142956827.000000006C913000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143044653.000000006C91D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143105643.000000006C925000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c590000_wegame.jbxd

Similarity

API ID: Cnd_initstd::_$memcpy$C_error@std@@Mtx_lockThrow_memset
String ID:
API String ID: 3456110962-0
Opcode ID: 813faf6e4603c3d3bd79abffe755504c9e6c3348af16d4422b9072f57da6653f
Instruction ID: f1b039cf93b9786f4b728d0045bcc4aecba2b42522b062c3f48e42ef93da318c
Opcode Fuzzy Hash: 813faf6e4603c3d3bd79abffe755504c9e6c3348af16d4422b9072f57da6653f
Instruction Fuzzy Hash: 794194B2D00269AADF10DF94CC84BCEB7B8FF45318F10019AE614A76C1D7B4AE468F59

Function 6C643DF1 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 83COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6C643DFB
SHCreateDirectoryExW.SHELL32(00000000,00000008,00000000,0000010C,6C5DA12C,?,?,?,0000018C,6C5DA8B2,?,?,?,?,00000000,00000200), ref: 6C643E12
?get_log_instance@base@@YAPAVILogger@1@XZ.COMMON ref: 6C643E8A

Strings

e:\dailybuild_fix_5.4\wegame_client\codes\common\src\sys_wrapper.cpp, xrefs: 6C643EAE
create_directory_ex fail, error code:%1%, path:%2%, xrefs: 6C643E31
[Sys_wrapper]%s, xrefs: 6C643ECE

Memory Dump Source

Source File: 00000006.00000002.4141448948.000000006C591000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000006.00000002.4141374342.000000006C590000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142318714.000000006C825000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142662450.000000006C906000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142732140.000000006C907000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142791681.000000006C909000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142876110.000000006C911000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142956827.000000006C913000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143044653.000000006C91D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143105643.000000006C925000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c590000_wegame.jbxd

Similarity

API ID: ?get_log_instance@base@@CreateDirectoryH_prolog3_Logger@1@
String ID: [Sys_wrapper]%s$create_directory_ex fail, error code:%1%, path:%2%$e:\dailybuild_fix_5.4\wegame_client\codes\common\src\sys_wrapper.cpp
API String ID: 4165533739-161902549
Opcode ID: 6c6f7183527a751d2056b1b5724d6164247ba6451e9a1fe93e3d3690e934e122
Instruction ID: 92d987cac564f064888de9049bc29d49714dcc48584faf0774be9674e48ed66d
Opcode Fuzzy Hash: 6c6f7183527a751d2056b1b5724d6164247ba6451e9a1fe93e3d3690e934e122
Instruction Fuzzy Hash: 9021F770801218EBDB24DBA4CC16EDE7B74AF95708F10499DE50177B80DB309E4ACFA5

Function 6C5AC484 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 79COMMON

Download Yara Rule

APIs

__EH_prolog3_catch_GS.LIBCMT ref: 6C5AC48E

Part of subcall function 6C5A9A0E: __EH_prolog3.LIBCMT ref: 6C5A9A15

Part of subcall function 6C59A8F0: memcpy.VCRUNTIME140(?,?,9XZl,?,?,00000000,?,?,6C5A5839,?,?), ref: 6C59A917

?get_cfg_by_path@common@ierd_tgp@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAV?$basic_ptree@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@property_tree@boost@@_N@Z.COMMON(?,?,00000000,user_setting.settings.common.last_uin,00000025,?,?,?,?,?,?,00000094), ref: 6C5AC4DA

Part of subcall function 6C5D725C: __EH_prolog3_catch_GS.LIBCMT ref: 6C5D7266
Part of subcall function 6C5D725C: ?split_path@common@ierd_tgp@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAV34@1@Z.COMMON(?,?,?), ref: 6C5D72CB

?get_log_instance@base@@YAPAVILogger@1@XZ.COMMON ref: 6C5AC598

Part of subcall function 6C5A776B: __EH_prolog3.LIBCMT ref: 6C5A7772
Part of subcall function 6C5A776B: ?_Init@locale@std@@CAPAV_Locimp@12@_N@Z.MSVCP140(00000001,?,?,?,?,00000008,6C5AC504), ref: 6C5A7789

Strings

user_setting.settings.common.last_uin, xrefs: 6C5AC4C0
e:\dailybuild_fix_5.4\wegame_client\codes\common\src\qqlistfetcher.cpp, xrefs: 6C5AC5BC
[QQListFetcher]Get last login UIN: %llu success., xrefs: 6C5AC5D5

Memory Dump Source

Source File: 00000006.00000002.4141448948.000000006C591000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000006.00000002.4141374342.000000006C590000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142318714.000000006C825000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142662450.000000006C906000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142732140.000000006C907000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142791681.000000006C909000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142876110.000000006C911000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142956827.000000006C913000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143044653.000000006C91D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143105643.000000006C925000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c590000_wegame.jbxd

Similarity

API ID: D@std@@U?$char_traits@V?$allocator@V?$basic_string@$D@2@@std@@$H_prolog3H_prolog3_catch_$?get_cfg_by_path@common@ierd_tgp@@?get_log_instance@base@@?split_path@common@ierd_tgp@@D@2@@std@@@2@@property_tree@boost@@_Init@locale@std@@Locimp@12@_Logger@1@U?$less@V12@V34@1@V?$basic_ptree@memcpy
String ID: [QQListFetcher]Get last login UIN: %llu success.$e:\dailybuild_fix_5.4\wegame_client\codes\common\src\qqlistfetcher.cpp$user_setting.settings.common.last_uin
API String ID: 3148678746-288666540
Opcode ID: fcaaf020c263bc741837fac7e4773463052586eb2ffc7ed62bf0a7e8c9f59205
Instruction ID: 7ceda6ab5c8822cfc5ba265f2939193c6a0790c4be7f429bca37964505f740eb
Opcode Fuzzy Hash: fcaaf020c263bc741837fac7e4773463052586eb2ffc7ed62bf0a7e8c9f59205
Instruction Fuzzy Hash: 9131A431D00288DADB10DBE9CD84BDDBB755F99308F548499D11877782EB715E4ACF90

Function 00447DFB Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 74COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00447E02
?unsetf@ios_base@std@@QAEXH@Z.MSVCP140(00000001,00000018,00463631,?,?,00000020,00000040,00000001,?,F69FE839,?,?,?,?,?,0047458B), ref: 00447E25
?fail@ios_base@std@@QBE_NXZ.MSVCP140(00000001,?,?,?,?,?,0047458B,000000FF), ref: 00447E5B
?bad@ios_base@std@@QBE_NXZ.MSVCP140(?,?,?,?,?,0047458B,000000FF), ref: 00447E6C
_CxxThrowException.VCRUNTIME140(?,00493D50,error reading stream,?,?,?,?,?,0047458B,000000FF), ref: 00447EA8

Strings

error reading stream, xrefs: 00447E92

Memory Dump Source

Source File: 00000006.00000002.4137209488.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.4137156906.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137406249.0000000000476000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137497400.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137574844.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137626631.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137684215.00000000004A3000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_wegame.jbxd

Similarity

API ID: ?bad@ios_base@std@@?fail@ios_base@std@@?unsetf@ios_base@std@@ExceptionH_prolog3Throw
String ID: error reading stream
API String ID: 37477595-137694921
Opcode ID: 41bd21c0b18b89b90ae0c56d28c0598feb2e2d4f3e978d63459e809efa8868c2
Instruction ID: 7a9c694e2b30168f263a2047d2cb4d203cf9a4a54d5166ef0ffcc431b2daeaa1
Opcode Fuzzy Hash: 41bd21c0b18b89b90ae0c56d28c0598feb2e2d4f3e978d63459e809efa8868c2
Instruction Fuzzy Hash: CE317C716002089FCB04DFA8D944A9DBBF5BF18314B24849EF449DB352D73AEA01CF59

Function 6C5AC60A Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 69COMMON

Download Yara Rule

APIs

__EH_prolog3_catch_GS.LIBCMT ref: 6C5AC614

Part of subcall function 6C5A9A0E: __EH_prolog3.LIBCMT ref: 6C5A9A15

Part of subcall function 6C59A8F0: memcpy.VCRUNTIME140(?,?,9XZl,?,?,00000000,?,?,6C5A5839,?,?), ref: 6C59A917

?get_cfg_by_path@common@ierd_tgp@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAV?$basic_ptree@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@property_tree@boost@@_N@Z.COMMON(?,?,00000000,user_setting.settings.common.last_wegame_id,0000002B,?,?,?,?,?,?,00000090), ref: 6C5AC65B

Part of subcall function 6C5D725C: __EH_prolog3_catch_GS.LIBCMT ref: 6C5D7266
Part of subcall function 6C5D725C: ?split_path@common@ierd_tgp@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAV34@1@Z.COMMON(?,?,?), ref: 6C5D72CB

?get_log_instance@base@@YAPAVILogger@1@XZ.COMMON ref: 6C5AC68B

Part of subcall function 6C5A7657: __EH_prolog3.LIBCMT ref: 6C5A765E
Part of subcall function 6C5A7657: ?_Init@locale@std@@CAPAV_Locimp@12@_N@Z.MSVCP140(00000001,?,?,?,?,00000008,6C5AC681), ref: 6C5A7675

Strings

[QQListFetcher]GetLastLoginedWegameId: {}, xrefs: 6C5AC6CD
user_setting.settings.common.last_wegame_id, xrefs: 6C5AC641
e:\dailybuild_fix_5.4\wegame_client\codes\common\src\qqlistfetcher.cpp, xrefs: 6C5AC6AF

Memory Dump Source

Source File: 00000006.00000002.4141448948.000000006C591000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000006.00000002.4141374342.000000006C590000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142318714.000000006C825000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142662450.000000006C906000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142732140.000000006C907000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142791681.000000006C909000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142876110.000000006C911000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142956827.000000006C913000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143044653.000000006C91D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143105643.000000006C925000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c590000_wegame.jbxd

Similarity

API ID: D@std@@U?$char_traits@V?$allocator@V?$basic_string@$D@2@@std@@$H_prolog3H_prolog3_catch_$?get_cfg_by_path@common@ierd_tgp@@?get_log_instance@base@@?split_path@common@ierd_tgp@@D@2@@std@@@2@@property_tree@boost@@_Init@locale@std@@Locimp@12@_Logger@1@U?$less@V12@V34@1@V?$basic_ptree@memcpy
String ID: [QQListFetcher]GetLastLoginedWegameId: {}$e:\dailybuild_fix_5.4\wegame_client\codes\common\src\qqlistfetcher.cpp$user_setting.settings.common.last_wegame_id
API String ID: 3148678746-471727731
Opcode ID: 31a37bc205f6a3585130578607d026ce9f4be485ddc6348e25c57aa826c62aa3
Instruction ID: d599e6dc7fe7d98df1dce6e0afa50276708289e71d18dbd6eeb74d3b55f84fb0
Opcode Fuzzy Hash: 31a37bc205f6a3585130578607d026ce9f4be485ddc6348e25c57aa826c62aa3
Instruction Fuzzy Hash: DF218D30D01288DACB10DBE9CD94BDDBBB0AF55308F5484A9D009B7B81EB755E8EDB90

Function 6C658A36 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 59COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C658A3D
?unsetf@ios_base@std@@QAEXH@Z.MSVCP140(00000001,00000018,6C65B190,?,00000000,00000020,00000040,00000001,?,\mmog_data.xml,00000000,9C33995A,00000000,00000000,?), ref: 6C658A60
?fail@ios_base@std@@QBE_NXZ.MSVCP140(?,00000B08,00000B08,00000000,00000001,?,00000000,6C81A3E7,000000FF,O<]l,6C659DB6,00000000,?), ref: 6C658A96
?bad@ios_base@std@@QBE_NXZ.MSVCP140(?,00000000,6C81A3E7,000000FF,O<]l,6C659DB6,00000000,?), ref: 6C658AA7
_CxxThrowException.VCRUNTIME140(?,6C8E8B0C,error reading stream,?,00000000,6C81A3E7,000000FF,O<]l,6C659DB6,00000000,?), ref: 6C658AE3

Strings

error reading stream, xrefs: 6C658ACD

Memory Dump Source

Source File: 00000006.00000002.4141448948.000000006C591000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000006.00000002.4141374342.000000006C590000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142318714.000000006C825000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142662450.000000006C906000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142732140.000000006C907000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142791681.000000006C909000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142876110.000000006C911000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142956827.000000006C913000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143044653.000000006C91D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143105643.000000006C925000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c590000_wegame.jbxd

Similarity

API ID: ?bad@ios_base@std@@?fail@ios_base@std@@?unsetf@ios_base@std@@ExceptionH_prolog3Throw
String ID: error reading stream
API String ID: 37477595-137694921
Opcode ID: 524392f24c8723c810220ad31698ca24c2a7796d543bc0e2d1c0187412558cd9
Instruction ID: d283fa1bf536559faa4997682631de0b9d2f3d6a7b62d6ba3e4505f4b8e545bd
Opcode Fuzzy Hash: 524392f24c8723c810220ad31698ca24c2a7796d543bc0e2d1c0187412558cd9
Instruction Fuzzy Hash: 7121AF716012059FCF14CFA8C958AEDBBF0AF593047588859E055E7751CB31EA05CB98

Function 6C5C864A Relevance: 9.1, APIs: 6, Instructions: 102fileCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6C5C8651

Part of subcall function 6C5C7D5C: UnmapViewOfFile.KERNEL32(?,?,?,6C5C75B7,9C33995A,?,?,00000000,6C804DE8,000000FF,?,6C5C741F,?,?,?,6C804D0B), ref: 6C5C7D70
Part of subcall function 6C5C7D5C: CloseHandle.KERNEL32(?,?,6C5C75B7,9C33995A,?,?,00000000,6C804DE8,000000FF,?,6C5C741F,?,?,?,6C804D0B,000000FF), ref: 6C5C7D79
Part of subcall function 6C5C7D5C: CloseHandle.KERNEL32(000000FF), ref: 6C5C7D8B

CreateFileW.KERNEL32(?,C0000000,00000001,00000000,00000004,00000080,00000000,0000002C), ref: 6C5C8677
CreateFileMappingW.KERNELBASE(?,00000000,00000004,00000000,003000A2,00000000,00000000), ref: 6C5C86D5
MapViewOfFile.KERNEL32(00000000,00000007,00000000,00000000,003000A2), ref: 6C5C86E6
_memcpy_s.PGOCR ref: 6C5C8728
_memcpy_s.PGOCR ref: 6C5C875E

Memory Dump Source

Source File: 00000006.00000002.4141448948.000000006C591000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000006.00000002.4141374342.000000006C590000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142318714.000000006C825000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142662450.000000006C906000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142732140.000000006C907000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142791681.000000006C909000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142876110.000000006C911000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142956827.000000006C913000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143044653.000000006C91D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143105643.000000006C925000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c590000_wegame.jbxd

Similarity

API ID: File$CloseCreateHandleView_memcpy_s$H_prolog3_MappingUnmap
String ID:
API String ID: 998036934-0
Opcode ID: e7c8b5b808745b1fd90548d500c1cfa01a529e0351bfe954a22040563e20beaa
Instruction ID: 15eb6933f5759679b4fd704f381ef1829c94cba408935692ed13204cdff533fc
Opcode Fuzzy Hash: e7c8b5b808745b1fd90548d500c1cfa01a529e0351bfe954a22040563e20beaa
Instruction Fuzzy Hash: 55316071A01708EFEB24DFA4CD45F9E77B8EB45318F10462DE126A76D0D770A9048B65

Function 6C5C8572 Relevance: 9.1, APIs: 6, Instructions: 69synchronizationCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C5C8579
WaitForSingleObject.KERNEL32(?,000000FF,00000010,6C5C256B), ref: 6C5C8593
EnterCriticalSection.KERNEL32(?), ref: 6C5C85AB
LeaveCriticalSection.KERNEL32(?,?), ref: 6C5C85C3
WaitForSingleObject.KERNEL32(?,00000000), ref: 6C5C85E6
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C5C8627

Memory Dump Source

Source File: 00000006.00000002.4141448948.000000006C591000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000006.00000002.4141374342.000000006C590000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142318714.000000006C825000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142662450.000000006C906000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142732140.000000006C907000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142791681.000000006C909000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142876110.000000006C911000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142956827.000000006C913000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143044653.000000006C91D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143105643.000000006C925000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c590000_wegame.jbxd

Similarity

API ID: ObjectSingleWait$CriticalSection$EnterH_prolog3Leave
String ID:
API String ID: 2592546008-0
Opcode ID: ca407c7107a37dcf48a463bb04efec54df4aabf1e57ec51184c711cbc371efc1
Instruction ID: f39339cb38ca741eac42e98d8f3be7a9074b415c1a11111680000e1ea925b552
Opcode Fuzzy Hash: ca407c7107a37dcf48a463bb04efec54df4aabf1e57ec51184c711cbc371efc1
Instruction Fuzzy Hash: 85213B71A0521AAFDF00CFE4CC88AEEBB74BF06318F144129D121A7691D775AA46CBD6

Function 6C63EF9B Relevance: 9.1, APIs: 6, Instructions: 61filememoryCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000007,00000000,00000003,08000000,00000000), ref: 6C63EFBE
VirtualAlloc.KERNEL32(00000000,00100000,00001000,00000004), ref: 6C63EFDC
CloseHandle.KERNEL32(00000000), ref: 6C63EFE9
ReadFile.KERNEL32(00000000,00000000,00100000,?,00000000), ref: 6C63F00F
FindCloseChangeNotification.KERNEL32(00000000), ref: 6C63F016
VirtualFree.KERNELBASE(00000000,00000000,00008000), ref: 6C63F024

Memory Dump Source

Source File: 00000006.00000002.4141448948.000000006C591000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000006.00000002.4141374342.000000006C590000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142318714.000000006C825000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142662450.000000006C906000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142732140.000000006C907000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142791681.000000006C909000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142876110.000000006C911000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142956827.000000006C913000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143044653.000000006C91D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143105643.000000006C925000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c590000_wegame.jbxd

Similarity

API ID: CloseFileVirtual$AllocChangeCreateFindFreeHandleNotificationRead
String ID:
API String ID: 3913859839-0
Opcode ID: 26abcb3ad1d4bb74abac787d98ceec15915513cc90fc163acd2cff9a1897686b
Instruction ID: 47f804ac91b9cdc12bd31605e38503ee9124f12e5cd6cebddf30f42a57f806bd
Opcode Fuzzy Hash: 26abcb3ad1d4bb74abac787d98ceec15915513cc90fc163acd2cff9a1897686b
Instruction Fuzzy Hash: 4F018430285325BBD7214A589C9DF9B376CEB4A759F106028FA08AA181C7B89D4186F9

Function 6C5C8D89 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 141COMMON

Download Yara Rule

APIs

__EH_prolog3_catch_GS.LIBCMT ref: 6C5C8D93

Part of subcall function 6C5A30A0: ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ.MSVCP140(9C33995A,?), ref: 6C5A30E3
Part of subcall function 6C5A30A0: ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z.MSVCP140(?,00000000,00000000,9C33995A,?), ref: 6C5A3101
Part of subcall function 6C5A30A0: ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ.MSVCP140 ref: 6C5A312B

Part of subcall function 6C5A3BC0: ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ.MSVCP140(9C33995A,?,00000001), ref: 6C5A3C9D
Part of subcall function 6C5A3BC0: ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(00000004,00000000), ref: 6C5A3DB6
Part of subcall function 6C5A3BC0: ?uncaught_exception@std@@YA_NXZ.MSVCP140 ref: 6C5A3DC3

Part of subcall function 6C5CBB15: __EH_prolog3.LIBCMT ref: 6C5CBB1C
Part of subcall function 6C5CBB15: __alldvrm.LIBCMT ref: 6C5CBBB2

Part of subcall function 6C5C38B9: __EH_prolog3.LIBCMT ref: 6C5C38C0

Part of subcall function 6C5A3BC0: ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z.MSVCP140(?,00000001,9C33995A,?,00000001), ref: 6C5A3CFD
Part of subcall function 6C5A3BC0: ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ.MSVCP140 ref: 6C5A3DD1

Part of subcall function 6C5A3BC0: ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z.MSVCP140(?,?,00000000,00000001,9C33995A,?,00000001), ref: 6C5A3D26
Part of subcall function 6C5A3BC0: ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z.MSVCP140(?), ref: 6C5A3D52

Part of subcall function 6C5C8037: __EH_prolog3_GS.LIBCMT ref: 6C5C803E

?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@PBD_J@Z.MSVCP140(?,?,00000000,00000000,?,?,?,?,?,?,?,?,6C5C6EC6,00000000,00000000), ref: 6C5C8F25
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ.MSVCP140(?,?,?,?,?,?,?,?,6C5C6EC6,00000000,00000000), ref: 6C5C8F2E

Strings

log created at: , xrefs: 6C5C8E01
LOG format: [YYYY-MM-DD hh:mm:ss.xxx][tid][LEVEL][FILE(LINE)]FUNCTIONmessage, xrefs: 6C5C8E15

Memory Dump Source

Source File: 00000006.00000002.4141448948.000000006C591000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000006.00000002.4141374342.000000006C590000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142318714.000000006C825000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142662450.000000006C906000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142732140.000000006C907000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142791681.000000006C909000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142876110.000000006C911000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142956827.000000006C913000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143044653.000000006C91D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143105643.000000006C925000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c590000_wegame.jbxd

Similarity

API ID: U?$char_traits@$D@std@@@std@@$V12@$?flush@?$basic_ostream@?sputc@?$basic_streambuf@H_prolog3$??0?$basic_ios@??0?$basic_ostream@??0?$basic_streambuf@?setstate@?$basic_ios@?sputn@?$basic_streambuf@?uncaught_exception@std@@?write@?$basic_ostream@D@std@@@1@_H_prolog3_H_prolog3_catch_Osfx@?$basic_ostream@V?$basic_streambuf@__alldvrm
String ID: LOG format: [YYYY-MM-DD hh:mm:ss.xxx][tid][LEVEL][FILE(LINE)]FUNCTIONmessage$log created at:
API String ID: 3604644337-2265546226
Opcode ID: 11d0916925ec3f3cff80fc1b0c3331047396f1b1583e416e316440a59b0d471c
Instruction ID: 05288b969341cf4cf1b4e6eef44c5b11ecf0534e128017edb1bed28a9a23a565
Opcode Fuzzy Hash: 11d0916925ec3f3cff80fc1b0c3331047396f1b1583e416e316440a59b0d471c
Instruction Fuzzy Hash: 8A518A71D01248EEDB15CBE8CD45BDEBBB8AF55308F60809DD115A7681DB746F08CBA2

Function 6C65B6B8 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 104COMMON

Download Yara Rule

APIs

?u8to16@common@ierd_tgp@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@4@@Z.COMMON(?,?,9C33995A,?,?,00000000,?,?,6C81A520,000000FF,?,6C65B6A0,?,?), ref: 6C65B718

Part of subcall function 6C6336B8: __EH_prolog3_GS.LIBCMT ref: 6C6336BF

Part of subcall function 6C5D49FD: __EH_prolog3.LIBCMT ref: 6C5D4A04

Part of subcall function 6C658A36: __EH_prolog3.LIBCMT ref: 6C658A3D
Part of subcall function 6C658A36: ?unsetf@ios_base@std@@QAEXH@Z.MSVCP140(00000001,00000018,6C65B190,?,00000000,00000020,00000040,00000001,?,\mmog_data.xml,00000000,9C33995A,00000000,00000000,?), ref: 6C658A60
Part of subcall function 6C658A36: ?fail@ios_base@std@@QBE_NXZ.MSVCP140(?,00000B08,00000B08,00000000,00000001,?,00000000,6C81A3E7,000000FF,O<]l,6C659DB6,00000000,?), ref: 6C658A96
Part of subcall function 6C658A36: ?bad@ios_base@std@@QBE_NXZ.MSVCP140(?,00000000,6C81A3E7,000000FF,O<]l,6C659DB6,00000000,?), ref: 6C658AA7

Part of subcall function 6C658AE9: __EH_prolog3.LIBCMT ref: 6C658AF0

Part of subcall function 6C65B83F: __EH_prolog3_GS.LIBCMT ref: 6C65B846
Part of subcall function 6C65B83F: _CxxThrowException.VCRUNTIME140(?,6C8E0628,parent node is null), ref: 6C65B8E7
Part of subcall function 6C65B83F: __EH_prolog3_GS.LIBCMT ref: 6C65B8F7
Part of subcall function 6C65B83F: ?parent_path@path@filesystem@ierd_tgp@@QBE?AV123@XZ.COMMON(?,000000A0,tcls,00000000,?,000000A0,?,6C8E0628,parent node is null), ref: 6C65B9B9

Part of subcall function 6C65B83F: ?filename@path@filesystem@ierd_tgp@@QBE?AV123@XZ.COMMON(?,?,000000A0,tcls,00000000,?,000000A0,?,6C8E0628,parent node is null), ref: 6C65B9C8
Part of subcall function 6C65B83F: ?wstring@path@filesystem@ierd_tgp@@QBE?BV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@XZ.COMMON(?,?,?,000000A0,tcls,00000000,?,000000A0,?,6C8E0628,parent node is null), ref: 6C65B9DA
Part of subcall function 6C65B83F: ?parent_path@path@filesystem@ierd_tgp@@QBE?AV123@XZ.COMMON(?,000000A0,rail_files,?,?,?,000000A0,tcls,00000000,?,000000A0,?,6C8E0628,parent node is null), ref: 6C65BA37
Part of subcall function 6C65B83F: ?parent_path@path@filesystem@ierd_tgp@@QBE?AV123@XZ.COMMON(?,?,000000A0,rail_files,?,?,?,000000A0,tcls,00000000,?,000000A0,?,6C8E0628,parent node is null), ref: 6C65BA46
Part of subcall function 6C65B83F: ?wstring@path@filesystem@ierd_tgp@@QBE?BV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@XZ.COMMON(?,?,?,000000A0,rail_files,?,?,?,000000A0,tcls,00000000,?,000000A0,?,6C8E0628,parent node is null), ref: 6C65BA55

Strings

ClientConf, xrefs: 6C65B781
Version, xrefs: 6C65B797
VersionUpdateData, xrefs: 6C65B771
VersionData, xrefs: 6C65B78C

Memory Dump Source

Source File: 00000006.00000002.4141448948.000000006C591000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000006.00000002.4141374342.000000006C590000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142318714.000000006C825000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142662450.000000006C906000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142732140.000000006C907000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142791681.000000006C909000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142876110.000000006C911000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142956827.000000006C913000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143044653.000000006C91D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143105643.000000006C925000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c590000_wegame.jbxd

Similarity

API ID: V123@$?parent_path@path@filesystem@ierd_tgp@@H_prolog3H_prolog3_U?$char_traits@_V?$allocator@_V?$basic_string@_W@std@@$?wstring@path@filesystem@ierd_tgp@@W@2@@std@@$?bad@ios_base@std@@?fail@ios_base@std@@?filename@path@filesystem@ierd_tgp@@?u8to16@common@ierd_tgp@@?unsetf@ios_base@std@@D@2@@std@@D@std@@ExceptionThrowU?$char_traits@V?$allocator@V?$basic_string@W@2@@4@@
String ID: ClientConf$Version$VersionData$VersionUpdateData
API String ID: 2273524157-449731932
Opcode ID: c654d4f934c8d30166b2dd3733a05a87a0f8cdaf7e59041453e3c6c950141297
Instruction ID: 890c63c5f7f0772a7e1f3543e87b1b1b34f10474bf41469c60dcc35e5e2f1c17
Opcode Fuzzy Hash: c654d4f934c8d30166b2dd3733a05a87a0f8cdaf7e59041453e3c6c950141297
Instruction Fuzzy Hash: 17418170D04248EECB11DBA5CD40FDEBBB8EF59304F5084A9E049B7680DB746B48CBA9

Function 0044D17C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 64COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0044D183

Part of subcall function 00451621: __EH_prolog3.LIBCMT ref: 00451628

?get_cfg_by_path@common@ierd_tgp@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAV?$basic_ptree@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@property_tree@boost@@_N@Z.COMMON(?,00000008,00000000,0000006C,00000000,bool __thiscall boost::property_tree::basic_ptree<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,struct std::less<class std::basic_,e:\dailybuild_fix_5.4\wegame_client\dependences\boost_1_67_0\boost\property_tree\detail\ptree_implementation.hpp,000002A0,?,00000008,00000000,int __thiscall boost::property_tree::basic_ptree<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,struct std::less<class std::basic_s,e:\dailybuild_fix_5.4\wegame_client\dependences\boost_1_67_0\boost\property_tree\detail\ptree_implementation.hpp,000002A0), ref: 0044D1A2
?get_log_instance@base@@YAPAVILogger@1@XZ.COMMON(bool __thiscall boost::property_tree::basic_ptree<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,struct std::less<class std::basic_,e:\dailybuild_fix_5.4\wegame_client\dependences\boost_1_67_0\boost\property_tree\detail\ptree_implementation.hpp,000002A0,?,00000008,00000000,int __thiscall boost::property_tree::basic_ptree<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,struct std::less<class std::basic_s,e:\dailybuild_fix_5.4\wegame_client\dependences\boost_1_67_0\boost\property_tree\detail\ptree_implementation.hpp,000002A0), ref: 0044D1AE

Part of subcall function 0043DD1B: __EH_prolog3.LIBCMT ref: 0043DD22

Part of subcall function 0043F2BB: __EH_prolog3_catch_GS.LIBCMT ref: 0043F2C2

Strings

[gl]Get cfg failed. path:%s, xrefs: 0044D1F2
e:\dailybuild_fix_5.4\wegame_client\codes\common\inc\cfg_file.h, xrefs: 0044D1D2

Memory Dump Source

Source File: 00000006.00000002.4137209488.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.4137156906.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137406249.0000000000476000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137497400.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137574844.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137626631.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137684215.00000000004A3000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_wegame.jbxd

Similarity

API ID: D@std@@U?$char_traits@V?$allocator@V?$basic_string@$D@2@@std@@H_prolog3$?get_cfg_by_path@common@ierd_tgp@@?get_log_instance@base@@D@2@@std@@@2@@property_tree@boost@@_H_prolog3_H_prolog3_catch_Logger@1@U?$less@V12@V?$basic_ptree@
String ID: [gl]Get cfg failed. path:%s$e:\dailybuild_fix_5.4\wegame_client\codes\common\inc\cfg_file.h
API String ID: 1555206004-2941112485
Opcode ID: f69985085ac5b576a618455670a8573951faa050c5cbeb6701ca8c29c1c45f2b
Instruction ID: bd97073da7ab6cbd4876db07331a0314b41427891e5ac9953a707222a146b714
Opcode Fuzzy Hash: f69985085ac5b576a618455670a8573951faa050c5cbeb6701ca8c29c1c45f2b
Instruction Fuzzy Hash: 9421A171E05208EBDF01EFA5C851ADD7770AF14308F60809EF9156B282EB799E09CB99

Function 6C5D6194 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 64COMMON

Download Yara Rule

APIs

__EH_prolog3_catch_GS.LIBCMT ref: 6C5D619E
?GetWeGameAppDataPathW@Sys_wrapper@common@ierd_tgp@@SA_NAAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z.COMMON(?,6C829274), ref: 6C5D61EF

Part of subcall function 6C63D2A5: __EH_prolog3_GS.LIBCMT ref: 6C63D2AF
Part of subcall function 6C63D2A5: memset.VCRUNTIME140(?,00000000,00000208,000006A0,6C5D61F4,?,6C829274), ref: 6C63D2C6
Part of subcall function 6C63D2A5: memset.VCRUNTIME140(?,00000000,00000410,?,00000000,00000208,000006A0,6C5D61F4,?,6C829274), ref: 6C63D2D8
Part of subcall function 6C63D2A5: SHGetFolderPathW.SHELL32(00000000,0000801A,00000000,00000000,?), ref: 6C63D2EF
Part of subcall function 6C63D2A5: ?get_client_version_type@overseas@ierd_tgp@@YAHXZ.COMMON ref: 6C63D32F
Part of subcall function 6C63D2A5: swprintf.LIBCMT ref: 6C63D38A
Part of subcall function 6C63D2A5: ?exists@filesystem@ierd_tgp@@YA_NABVpath@12@AAVerror_code@std@@@Z.COMMON(?,00000000), ref: 6C63D3C8
Part of subcall function 6C63D2A5: ?create_directory_ex@Sys_wrapper@common@ierd_tgp@@SA_NABVpath@filesystem@3@@Z.COMMON(?), ref: 6C63D3DA

?get_log_instance@base@@YAPAVILogger@1@XZ.COMMON(6C829274), ref: 6C5D6218

Strings

e:\dailybuild_fix_5.4\wegame_client\codes\common\src\cfg_file.cpp, xrefs: 6C5D623C
appdata_project_folder failed, xrefs: 6C5D6250

Memory Dump Source

Source File: 00000006.00000002.4141448948.000000006C591000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000006.00000002.4141374342.000000006C590000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142318714.000000006C825000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142662450.000000006C906000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142732140.000000006C907000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142791681.000000006C909000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142876110.000000006C911000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142956827.000000006C913000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143044653.000000006C91D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143105643.000000006C925000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c590000_wegame.jbxd

Similarity

API ID: PathSys_wrapper@common@ierd_tgp@@memset$?create_directory_ex@?exists@filesystem@ierd_tgp@@?get_client_version_type@overseas@ierd_tgp@@?get_log_instance@base@@DataFolderGameH_prolog3_H_prolog3_catch_Logger@1@U?$char_traits@_V?$allocator@_V?$basic_string@_Verror_code@std@@@Vpath@12@Vpath@filesystem@3@@W@2@@std@@@W@std@@swprintf
String ID: appdata_project_folder failed$e:\dailybuild_fix_5.4\wegame_client\codes\common\src\cfg_file.cpp
API String ID: 1782788727-597959030
Opcode ID: 6a5b9afbf58dd3ebb5a9e72924fc00329b27f72ae39c75d85b5ea3cdf3dd63ae
Instruction ID: 63126e16c570fc806ff3190d51205e8b2a3c8082eb549c8468751ebfc251ed88
Opcode Fuzzy Hash: 6a5b9afbf58dd3ebb5a9e72924fc00329b27f72ae39c75d85b5ea3cdf3dd63ae
Instruction Fuzzy Hash: E4218E70901348DACB20DFE8C9547CCB7B1AF89308F60889DD115BBB81DB359E4ACB94

Function 6C5E73DF Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6C5E73E6

Part of subcall function 6C5A9A0E: __EH_prolog3.LIBCMT ref: 6C5A9A15

?is_profile_on@common@ierd_tgp@@YA_NXZ.COMMON(00000040), ref: 6C5E73FB
?enable_profile_on@common@ierd_tgp@@YAX_N@Z.COMMON(?), ref: 6C5E7477

Part of subcall function 6C59A8F0: memcpy.VCRUNTIME140(?,?,9XZl,?,?,00000000,?,?,6C5A5839,?,?), ref: 6C59A917

?get_cfg_by_path@common@ierd_tgp@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAV?$basic_ptree@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@property_tree@boost@@_N@Z.COMMON(?,?,00000000,?,?,?,initial.profile.on,00000012,00000040), ref: 6C5E743A

Part of subcall function 6C5D725C: __EH_prolog3_catch_GS.LIBCMT ref: 6C5D7266
Part of subcall function 6C5D725C: ?split_path@common@ierd_tgp@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAV34@1@Z.COMMON(?,?,?), ref: 6C5D72CB

Strings

initial.profile.on, xrefs: 6C5E7411

Memory Dump Source

Source File: 00000006.00000002.4141448948.000000006C591000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000006.00000002.4141374342.000000006C590000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142318714.000000006C825000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142662450.000000006C906000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142732140.000000006C907000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142791681.000000006C909000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142876110.000000006C911000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142956827.000000006C913000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143044653.000000006C91D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143105643.000000006C925000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c590000_wegame.jbxd

Similarity

API ID: D@std@@U?$char_traits@V?$allocator@V?$basic_string@$D@2@@std@@$?enable_profile_on@common@ierd_tgp@@?get_cfg_by_path@common@ierd_tgp@@?is_profile_on@common@ierd_tgp@@?split_path@common@ierd_tgp@@D@2@@std@@@2@@property_tree@boost@@_H_prolog3H_prolog3_H_prolog3_catch_U?$less@V12@V34@1@V?$basic_ptree@memcpy
String ID: initial.profile.on
API String ID: 2097012504-3868740645
Opcode ID: c9abfcd5b7b8942b5e211368e653e27d22102e7d0ab681fa4865a1a090866f7b
Instruction ID: 128d7a7802fb73b948bfdeafb39edfaddf70979406452727ae3d5370d5f796d6
Opcode Fuzzy Hash: c9abfcd5b7b8942b5e211368e653e27d22102e7d0ab681fa4865a1a090866f7b
Instruction Fuzzy Hash: DB11CAB0C00348DEEB00DFE48D417EDBBB09F48358F24046AC411A2B82EB785A4ADBA5

Function 6C639D2A Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 40timeCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6C639D31
GetSystemTimes.KERNEL32(6C91EEB8,6C91EEC0,6C91EEC8,00000050), ref: 6C639D47
?get_log_instance@base@@YAPAVILogger@1@XZ.COMMON(6C91EEB8,6C91EEC0,6C91EEC8,00000050), ref: 6C639D50

Part of subcall function 6C5AA5EF: __EH_prolog3.LIBCMT ref: 6C5AA5F6

Part of subcall function 6C5AE945: __EH_prolog3_catch_GS.LIBCMT ref: 6C5AE94C

Strings

e:\dailybuild_fix_5.4\wegame_client\codes\common\src\sys_wrapper.cpp, xrefs: 6C639D74
error, xrefs: 6C639D88

Memory Dump Source

Source File: 00000006.00000002.4141448948.000000006C591000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000006.00000002.4141374342.000000006C590000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142318714.000000006C825000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142662450.000000006C906000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142732140.000000006C907000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142791681.000000006C909000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142876110.000000006C911000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142956827.000000006C913000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143044653.000000006C91D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143105643.000000006C925000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c590000_wegame.jbxd

Similarity

API ID: ?get_log_instance@base@@H_prolog3H_prolog3_H_prolog3_catch_Logger@1@SystemTimes
String ID: e:\dailybuild_fix_5.4\wegame_client\codes\common\src\sys_wrapper.cpp$error
API String ID: 1984077098-3966742577
Opcode ID: 5da176f18b2a56e15a367a0cf57a255f947b9b1e3da6cfe955e9fa3e4453f194
Instruction ID: a1704509f2f9afeaef57d73e4ea02758a3e7218eb754e1f2b449f95e4e1d1b76
Opcode Fuzzy Hash: 5da176f18b2a56e15a367a0cf57a255f947b9b1e3da6cfe955e9fa3e4453f194
Instruction Fuzzy Hash: 55F0AF30A00624A7DB21A6E0CD12F9D32614FC171DF241904A4143BFC0DF62ED0B8AC9

Function 6C61F6EB Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32(80000002,HARDWARE\DESCRIPTION\System\CentralProcessor\0,00000000,00020019,?), ref: 6C61F712
RegQueryValueExA.KERNEL32(?,~MHz,00000000,00000000,?,00000004), ref: 6C61F72F
RegCloseKey.KERNEL32(?), ref: 6C61F73A

Strings

HARDWARE\DESCRIPTION\System\CentralProcessor\0, xrefs: 6C61F705
~MHz, xrefs: 6C61F727

Memory Dump Source

Source File: 00000006.00000002.4141448948.000000006C591000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000006.00000002.4141374342.000000006C590000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142318714.000000006C825000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142662450.000000006C906000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142732140.000000006C907000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142791681.000000006C909000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142876110.000000006C911000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142956827.000000006C913000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143044653.000000006C91D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143105643.000000006C925000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c590000_wegame.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: HARDWARE\DESCRIPTION\System\CentralProcessor\0$~MHz
API String ID: 3677997916-2226868861
Opcode ID: 4c4a4abccf5db0ef663419897dd6fd877d50d82f665f566f75293d807d3ad00b
Instruction ID: ab4c0d23e9043428e6588c9714503416880ac6c043ac68db7df49ddab8c4f31f
Opcode Fuzzy Hash: 4c4a4abccf5db0ef663419897dd6fd877d50d82f665f566f75293d807d3ad00b
Instruction Fuzzy Hash: 0DF04F72A04258BBDB209BD6DD48EDFFBBCEB81748F10816AEA01A2211D7349604DBD4

Function 0043AF70 Relevance: 7.6, APIs: 5, Instructions: 129COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,7FFFFFFF,00000000,00000001,00000001,0000000F), ref: 0043B03A
memset.VCRUNTIME140(00000010,00000001,00000001,00000000,7FFFFFFF,00000000,00000001,00000001,0000000F), ref: 0043B048
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00000001,00000001,0000000F), ref: 0043B08B
memcpy.VCRUNTIME140(00000000,?,00000000,00000001,00000001,0000000F), ref: 0043B093
memset.VCRUNTIME140(7FFFFFFF,00000001,00000001,00000000,?,00000000,00000001,00000001,0000000F), ref: 0043B09F

Part of subcall function 00467A3B: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,0040CE31,7FFFFFFE,?), ref: 00467A50

Memory Dump Source

Source File: 00000006.00000002.4137209488.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.4137156906.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137406249.0000000000476000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137497400.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137574844.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137626631.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137684215.00000000004A3000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_wegame.jbxd

Similarity

API ID: memcpymemset$_invalid_parameter_noinfo_noreturnmalloc
String ID:
API String ID: 3375828981-0
Opcode ID: d28a9f32444942617b800829e7433730446c28eee23f144d1ae84dc60d3382f6
Instruction ID: 2b844f03c5220c1cee67210a6749a71dfeb51bca0d62362da7d51cd1ec1dc8a5
Opcode Fuzzy Hash: d28a9f32444942617b800829e7433730446c28eee23f144d1ae84dc60d3382f6
Instruction Fuzzy Hash: 2F41E072A001049FCB09DF68CC806AFB7A6FF89310F24426AE955D7341E735DE629BD6

Function 6C5F4001 Relevance: 7.6, APIs: 5, Instructions: 101fileCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6C5F4008
GetFileAttributesW.KERNEL32(?,00000024,6C5F1E12,00000000,00000000,?,?,?,?,6C5F1DFA,00000000,00000000,?,?,?,?), ref: 6C5F4024
CreateFileW.KERNEL32(?,00000000,00000007,00000000,00000003,02000000,00000000,?,?,?,?,6C5F1DFA,00000000,00000000), ref: 6C5F4084

Part of subcall function 6C5F2958: CreateFileW.KERNEL32(00000000,00000008,00000007,00000000,00000003,02200000,00000000,9C33995A,?,00000000,00000000,6C80D455,000000FF,?,6C5F40B9,?), ref: 6C5F29A4
Part of subcall function 6C5F2958: DeviceIoControl.KERNEL32(00000000,000900A8,00000000,00000000,?,00004000,?,00000000), ref: 6C5F29D6
Part of subcall function 6C5F2958: CloseHandle.KERNEL32(00000000,?,6C5F40B9,?,?,?,?,6C5F1DFA,00000000,00000000,?,?,?,?,6C8C31F0,?), ref: 6C5F2A04

CloseHandle.KERNEL32(000000FF,?,?,?,6C5F1DFA,00000000,00000000,?,?,?,?,6C8C31F0,?,?,?,?), ref: 6C5F40D7
CloseHandle.KERNEL32(000000FF,?,?,?,6C5F1DFA,00000000,00000000,?,?,?,?,6C8C31F0,?,?,?,?), ref: 6C5F40E6

Part of subcall function 6C5F2F4E: __EH_prolog3_GS.LIBCMT ref: 6C5F2F55
Part of subcall function 6C5F2F4E: ?extension@path@filesystem@ierd_tgp@@QBE?AV123@XZ.COMMON(?,0000001C,6C5F4108,?,00000000,?,?,?,6C5F1DFA,00000000,00000000,?,?,?,?,6C8C31F0), ref: 6C5F2F72

Memory Dump Source

Source File: 00000006.00000002.4141448948.000000006C591000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000006.00000002.4141374342.000000006C590000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142318714.000000006C825000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142662450.000000006C906000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142732140.000000006C907000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142791681.000000006C909000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142876110.000000006C911000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142956827.000000006C913000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143044653.000000006C91D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143105643.000000006C925000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c590000_wegame.jbxd

Similarity

API ID: CloseFileHandle$CreateH_prolog3_$?extension@path@filesystem@ierd_tgp@@AttributesControlDeviceV123@
String ID:
API String ID: 3244417928-0
Opcode ID: 97fbb9014ed8ac500579b01e2cd0e00928ce3369deea984c0d7ec68abf667810
Instruction ID: b9b3bbb6843bdd42cbff41fd1a1d8abbf19b8b1cfb417104cf4ffaedb3b41d2f
Opcode Fuzzy Hash: 97fbb9014ed8ac500579b01e2cd0e00928ce3369deea984c0d7ec68abf667810
Instruction Fuzzy Hash: 71316F70905204EFEB18CFA8DD49BDD77B8EF4A328F108219E821A76D0DB755946CF61

Function 6C5EF9BD Relevance: 7.6, APIs: 5, Instructions: 84COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6C5EF9C4
?u8to16@common@ierd_tgp@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@4@@Z.COMMON(?,?,00000038,6C62487C,?,?,?), ref: 6C5EF9EF

Part of subcall function 6C6336B8: __EH_prolog3_GS.LIBCMT ref: 6C6336BF

GetFileVersionInfoSizeW.VERSION(?,00000000,00000038,6C62487C,?,?,?), ref: 6C5EFA15

Part of subcall function 6C5EF899: __EH_prolog3_catch.LIBCMT ref: 6C5EF8A0

Part of subcall function 6C5B901E: __EH_prolog3_catch.LIBCMT ref: 6C5B9025

GetFileVersionInfoW.VERSION(?,00000000,00000000,00000008,00000000,00000008,00000000,?,?,00000000,00000038,6C62487C,?,?,?), ref: 6C5EFA56
VerQueryValueA.VERSION(00000000,6C82DE1C,?,00000034,?,00000000,00000000,00000008,00000000,00000008,00000000,?,?,00000000,00000038,6C62487C), ref: 6C5EFA6F

Memory Dump Source

Source File: 00000006.00000002.4141448948.000000006C591000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000006.00000002.4141374342.000000006C590000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142318714.000000006C825000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142662450.000000006C906000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142732140.000000006C907000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142791681.000000006C909000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142876110.000000006C911000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142956827.000000006C913000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143044653.000000006C91D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143105643.000000006C925000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c590000_wegame.jbxd

Similarity

API ID: FileH_prolog3_H_prolog3_catchInfoVersion$?u8to16@common@ierd_tgp@@D@2@@std@@D@std@@QuerySizeU?$char_traits@U?$char_traits@_V?$allocator@V?$allocator@_V?$basic_string@V?$basic_string@_ValueW@2@@4@@W@std@@
String ID:
API String ID: 3447756801-0
Opcode ID: 39cd25b2f6fc591b5548965b20fc59fb9eaf065f1dd829e50f0593ea5c94835b
Instruction ID: 18811bdb6b9ace7fdc85099cb2144d5811318b57cb9c7df4331600335e97ea8c
Opcode Fuzzy Hash: 39cd25b2f6fc591b5548965b20fc59fb9eaf065f1dd829e50f0593ea5c94835b
Instruction Fuzzy Hash: 35317E74901249EECB00DFE4D9509DEBBB8EF1D214F64501DE814BB650EB319A4ACB28

Function 6C616053 Relevance: 7.5, APIs: 5, Instructions: 41COMMON

Download Yara Rule

APIs

InterlockedCompareExchange.KERNEL32(6C924010,000000FF,00000000), ref: 6C616069
memcpy.VCRUNTIME140(?,6C924000,00000010,?,6C613F1C,?,00000018,6C613FB1,?,00000010), ref: 6C6160B1

Part of subcall function 6C6160C2: __EH_prolog3_GS.LIBCMT ref: 6C6160CC
Part of subcall function 6C6160C2: memset.VCRUNTIME140(?,00000000,00000006,00000358,6C616080,6C924000,?,6C613F1C,?,00000018,6C613FB1,?,00000010), ref: 6C6160E5

memcpy.VCRUNTIME140(?,6C924000,00000010,6C924000,?,6C613F1C,?,00000018,6C613FB1,?,00000010), ref: 6C616086
InterlockedExchange.KERNEL32(6C924010,00000001), ref: 6C616091

Memory Dump Source

Source File: 00000006.00000002.4141448948.000000006C591000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000006.00000002.4141374342.000000006C590000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142318714.000000006C825000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142662450.000000006C906000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142732140.000000006C907000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142791681.000000006C909000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142876110.000000006C911000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142956827.000000006C913000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143044653.000000006C91D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143105643.000000006C925000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c590000_wegame.jbxd

Similarity

API ID: ExchangeInterlockedmemcpy$CompareH_prolog3_memset
String ID:
API String ID: 1722332608-0
Opcode ID: 41185681c7abbd7ef8b07f3d4d4653f8a6726dbf34e35ef24017d50e6b789f49
Instruction ID: 83ea514ac9c076976b4b59af42b0c79b5af3017883cd1e5e37b27012106fb893
Opcode Fuzzy Hash: 41185681c7abbd7ef8b07f3d4d4653f8a6726dbf34e35ef24017d50e6b789f49
Instruction Fuzzy Hash: ABF0F6B1285204BBD730161AAC4DF9B7A3AD78271AF004539F00859E81C7B7D89199E4

Function 004632E3 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 53COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 004632EA

Part of subcall function 0045273B: __EH_prolog3.LIBCMT ref: 00452742

Part of subcall function 00465EC0: __EH_prolog3_GS.LIBCMT ref: 00465EC7

Strings

e:\dailybuild_fix_5.4\wegame_client\dependences\boost_1_67_0\boost\property_tree\detail\ptree_implementation.hpp, xrefs: 0046334F
No such node, xrefs: 00463328
class boost::property_tree::basic_ptree<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,struct std::less<class std::basic_string<cha, xrefs: 00463354

Memory Dump Source

Source File: 00000006.00000002.4137209488.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.4137156906.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137406249.0000000000476000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137497400.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137574844.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137626631.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137684215.00000000004A3000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_wegame.jbxd

Similarity

API ID: H_prolog3_$H_prolog3
String ID: No such node$class boost::property_tree::basic_ptree<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,struct std::less<class std::basic_string<cha$e:\dailybuild_fix_5.4\wegame_client\dependences\boost_1_67_0\boost\property_tree\detail\ptree_implementation.hpp
API String ID: 3952504126-1389044551
Opcode ID: 2c085e8fb64ba43ec8b3451f331cbe249d3b9ae1953d04ef49b5eb9d2ea425b7
Instruction ID: eab306ff6f85f342bd78206a4b9b0b03aa3a1a96ec2fa6356e256176be0395b5
Opcode Fuzzy Hash: 2c085e8fb64ba43ec8b3451f331cbe249d3b9ae1953d04ef49b5eb9d2ea425b7
Instruction Fuzzy Hash: 2611E531A00218A7CB04EAE5D842FEE77A49F50718F44801FB504A7182DF78AE05879D

Function 0045A34D Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 45COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0045A354

Part of subcall function 00456E02: __EH_prolog3_GS.LIBCMT ref: 00456E0C
Part of subcall function 00456E02: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00456E86
Part of subcall function 00456E02: Process32First.KERNEL32(00000000,?), ref: 00456EA8
Part of subcall function 00456E02: memset.VCRUNTIME140(?,00000000,00000410), ref: 00456EBC
Part of subcall function 00456E02: OpenProcess.KERNEL32(00000411,00000000,?), ref: 00456EDF
Part of subcall function 00456E02: GetModuleFileNameExW.PSAPI(00000000,00000000,?,00000208), ref: 00456EFE
Part of subcall function 00456E02: SimpleUString::operator=.MSOBJ140-MSVCRT ref: 00456F35
Part of subcall function 00456E02: memset.VCRUNTIME140(?,00000000,00000208,?,?,?,?), ref: 00456F98

?get_log_instance@base@@YAPAVILogger@1@XZ.COMMON(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000058,0045970E), ref: 0045A376

Part of subcall function 0043DD1B: __EH_prolog3.LIBCMT ref: 0043DD22

Strings

[main]assistant is running, exit, xrefs: 0045A3B6
e:\dailybuild_fix_5.4\wegame_client\codes\main\tgp_daemon\src\tgp_daemon_main.cpp, xrefs: 0045A39A

Memory Dump Source

Source File: 00000006.00000002.4137209488.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.4137156906.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137406249.0000000000476000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137497400.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137574844.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137626631.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137684215.00000000004A3000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_wegame.jbxd

Similarity

API ID: H_prolog3_memset$?get_log_instance@base@@CreateFileFirstH_prolog3Logger@1@ModuleNameOpenProcessProcess32SimpleSnapshotString::operator=Toolhelp32
String ID: [main]assistant is running, exit$e:\dailybuild_fix_5.4\wegame_client\codes\main\tgp_daemon\src\tgp_daemon_main.cpp
API String ID: 1363618106-1685103524
Opcode ID: 000e6dee096b5e5c1099facf2e31dfbc6a5a8a2b9c07e6e97fd2e66899551c0f
Instruction ID: e4d67c421e46890e8ac1e296b90a38843252ce8407b9fa66224a65ad42be0429
Opcode Fuzzy Hash: 000e6dee096b5e5c1099facf2e31dfbc6a5a8a2b9c07e6e97fd2e66899551c0f
Instruction Fuzzy Hash: DD01B531A05705A7DB10EA90CC56BDD73B0AF4171AF60420BE8056F1C2DBAC5D19CB4E

Function 6C5D76DE Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 38COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6C5D76E5

Part of subcall function 6C5D534E: __EH_prolog3.LIBCMT ref: 6C5D5355

Part of subcall function 6C5D9A73: __EH_prolog3_GS.LIBCMT ref: 6C5D9A7A

Strings

e:\dailybuild_fix_5.4\wegame_client\dependences\boost_1_67_0\boost\property_tree\detail\ptree_implementation.hpp, xrefs: 6C5D774A
No such node, xrefs: 6C5D7723
class boost::property_tree::basic_ptree<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,struct std::less<class std::basic_string<cha, xrefs: 6C5D774F

Memory Dump Source

Source File: 00000006.00000002.4141448948.000000006C591000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000006.00000002.4141374342.000000006C590000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142318714.000000006C825000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142662450.000000006C906000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142732140.000000006C907000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142791681.000000006C909000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142876110.000000006C911000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142956827.000000006C913000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143044653.000000006C91D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143105643.000000006C925000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c590000_wegame.jbxd

Similarity

API ID: H_prolog3_$H_prolog3
String ID: No such node$class boost::property_tree::basic_ptree<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,struct std::less<class std::basic_string<cha$e:\dailybuild_fix_5.4\wegame_client\dependences\boost_1_67_0\boost\property_tree\detail\ptree_implementation.hpp
API String ID: 3952504126-1389044551
Opcode ID: e1b50f80a2b01aa7050fb1542c113faa2e5af5bc81653a610a81ad78e7500c68
Instruction ID: 8259fae3b96b1a0bfe4316203333d904a013a45de3d7eefbdf717262d50a9897
Opcode Fuzzy Hash: e1b50f80a2b01aa7050fb1542c113faa2e5af5bc81653a610a81ad78e7500c68
Instruction Fuzzy Hash: 8501D131C01258EBCB10D794CD18FED7734AF90708F450558A102A7A80CB74AE4AD79D

Function 6C62A4BD Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 36COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6C62A4C4
?get_log_instance@base@@YAPAVILogger@1@XZ.COMMON(00000050), ref: 6C62A4CB

Part of subcall function 6C5AA5EF: __EH_prolog3.LIBCMT ref: 6C5AA5F6

Strings

e:\dailybuild_fix_5.4\wegame_client\codes\common\src\qos_http_handler.cpp, xrefs: 6C62A4EF
[Qos_http_handler] OnEnd., xrefs: 6C62A50B

Memory Dump Source

Source File: 00000006.00000002.4141448948.000000006C591000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000006.00000002.4141374342.000000006C590000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142318714.000000006C825000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142662450.000000006C906000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142732140.000000006C907000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142791681.000000006C909000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142876110.000000006C911000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142956827.000000006C913000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143044653.000000006C91D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143105643.000000006C925000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c590000_wegame.jbxd

Similarity

API ID: ?get_log_instance@base@@H_prolog3H_prolog3_Logger@1@
String ID: [Qos_http_handler] OnEnd.$e:\dailybuild_fix_5.4\wegame_client\codes\common\src\qos_http_handler.cpp
API String ID: 52498757-1413972177
Opcode ID: 7bf098b8c544396020bd050adac020dc1b79b29a67eb13cf5a9b378e9c679b11
Instruction ID: 2a65fb2bdff8f1f695b8b32a4843aa42d16624e9f07bbfe7a605937723a844ff
Opcode Fuzzy Hash: 7bf098b8c544396020bd050adac020dc1b79b29a67eb13cf5a9b378e9c679b11
Instruction Fuzzy Hash: ECF0F630A0121097CB259AE0CC20BED73225FC1718F24495894153FBC6CF698E0B9BC9

Function 0045A662 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 25COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0045A669
?get_comp_mgr_instance@common@ierd_tgp@@YAAAVComponent_mgr@12@XZ.COMMON(0000001C,00452BB4), ref: 0045A66E

Part of subcall function 00420F10: memcpy.VCRUNTIME140(00000000,00000000,00000000,004204D1,00000000,00000000,00000000,?,00423FD2,00000000,00000001), ref: 00420F37

?load_config@Component_mgr@common@ierd_tgp@@QAEXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z.COMMON(?,Config\client_plugin_config.info,00000020,0000001C,00452BB4), ref: 0045A6A2

Strings

Config\client_plugin_config.info, xrefs: 0045A682

Memory Dump Source

Source File: 00000006.00000002.4137209488.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.4137156906.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137406249.0000000000476000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137497400.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137574844.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137626631.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137684215.00000000004A3000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_wegame.jbxd

Similarity

API ID: ?get_comp_mgr_instance@common@ierd_tgp@@?load_config@Component_mgr@12@Component_mgr@common@ierd_tgp@@D@2@@std@@@D@std@@H_prolog3_U?$char_traits@V?$allocator@V?$basic_string@memcpy
String ID: Config\client_plugin_config.info
API String ID: 2408731581-3669469243
Opcode ID: 6de5095e5d9340096b3351e8b3bdc18df1428784bcaaf18c88484d96a3141e9e
Instruction ID: 8543e5f95a508339b6105aa0f72e3f13c18f736c1db5970a315dd290028d6b6f
Opcode Fuzzy Hash: 6de5095e5d9340096b3351e8b3bdc18df1428784bcaaf18c88484d96a3141e9e
Instruction Fuzzy Hash: 86F0A730E00209DBCB01EFE5C4826DDBE70AF08318F94012FE21577182E67C0B4487AA

Function 6C5CB03A Relevance: 6.2, APIs: 4, Instructions: 230COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6C5CB044
EnterCriticalSection.KERNEL32(-00000039,?), ref: 6C5CB1DD
LeaveCriticalSection.KERNEL32(-00000039,?), ref: 6C5CB1FE
ReleaseSemaphore.KERNEL32(?,00000001,00000000), ref: 6C5CB20D

Memory Dump Source

Source File: 00000006.00000002.4141448948.000000006C591000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000006.00000002.4141374342.000000006C590000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142318714.000000006C825000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142662450.000000006C906000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142732140.000000006C907000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142791681.000000006C909000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142876110.000000006C911000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142956827.000000006C913000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143044653.000000006C91D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143105643.000000006C925000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c590000_wegame.jbxd

Similarity

API ID: CriticalSection$EnterH_prolog3_LeaveReleaseSemaphore
String ID:
API String ID: 1606114100-0
Opcode ID: b24d53d084f5d7d7f1fdbf2b2e7295966348ddbeace226f5b9d0230f3a9197b8
Instruction ID: cec7bbfd55a9d90b3b09af49738753d71cde932db2a0d21215c8d21871f2119d
Opcode Fuzzy Hash: b24d53d084f5d7d7f1fdbf2b2e7295966348ddbeace226f5b9d0230f3a9197b8
Instruction Fuzzy Hash: C0A18F71D00299EFCB15CFE4C984AEEBBB4BF45308F1481ADD045A7A42EB316E49DB61

Function 6C5A34B0 Relevance: 6.2, APIs: 4, Instructions: 164COMMON

Download Yara Rule

APIs

?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ.MSVCP140 ref: 6C5A34EE

Memory Dump Source

Source File: 00000006.00000002.4141448948.000000006C591000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000006.00000002.4141374342.000000006C590000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142318714.000000006C825000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142662450.000000006C906000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142732140.000000006C907000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142791681.000000006C909000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142876110.000000006C911000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142956827.000000006C913000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143044653.000000006C91D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143105643.000000006C925000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c590000_wegame.jbxd

Similarity

API ID: D@std@@@std@@Pninc@?$basic_streambuf@U?$char_traits@
String ID:
API String ID: 3551493264-0
Opcode ID: 4949b6dfce9747df32266decb2ee2f4b5091cb276d494c8478c68bdad4592c0d
Instruction ID: cb4e9eceda747a0d517f163ab8d897af734bfdcdf85e591db2320afa82e105c6
Opcode Fuzzy Hash: 4949b6dfce9747df32266decb2ee2f4b5091cb276d494c8478c68bdad4592c0d
Instruction Fuzzy Hash: 3B51A171A006059FC714CFADD9D49ACFBB0FF4A328B14476AD9158BB91D731E825CB90

Function 6C5C87E2 Relevance: 6.1, APIs: 4, Instructions: 85COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6C5C87EC
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,?,00000003,00000001,000000E8), ref: 6C5C88F4

Memory Dump Source

Source File: 00000006.00000002.4141448948.000000006C591000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000006.00000002.4141374342.000000006C590000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142318714.000000006C825000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142662450.000000006C906000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142732140.000000006C907000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142791681.000000006C909000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142876110.000000006C911000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142956827.000000006C913000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143044653.000000006C91D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143105643.000000006C925000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c590000_wegame.jbxd

Similarity

API ID: ??1?$basic_ios@D@std@@@std@@H_prolog3_U?$char_traits@
String ID:
API String ID: 3551674400-0
Opcode ID: e543d02ccb5484e62ce4aa37678ff4b9d5e1911d4b54135522d525885e0502be
Instruction ID: 2bf8f91c6a12216a758893f8c476d920980905f28d74f2a79f750e0f952f64a5
Opcode Fuzzy Hash: e543d02ccb5484e62ce4aa37678ff4b9d5e1911d4b54135522d525885e0502be
Instruction Fuzzy Hash: 64316A70901249EFDF10CFA4CD44BEEBBB4AF56308F5484A9E105B3681DB745B49CBA2

Function 00447CD7 Relevance: 6.1, APIs: 4, Instructions: 51COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00447CDE
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ.MSVCP140(00000008,00447CAD,?,?,?,00000008,00000004,0046361B,?,00000020,00000040,00000001,?,F69FE839), ref: 00447CFB
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z.MSVCP140(?,00000000,00000000,00000008,00447CAD,?,?,?,00000008,00000004,0046361B,?,00000020,00000040,00000001,?), ref: 00447D13
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(00000002,00000000,?,?,?,00000000,?,?,?,?,?,0047458B,000000FF), ref: 00447D66

Memory Dump Source

Source File: 00000006.00000002.4137209488.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.4137156906.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137406249.0000000000476000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137497400.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137574844.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137626631.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137684215.00000000004A3000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_wegame.jbxd

Similarity

API ID: U?$char_traits@$D@std@@@std@@$??0?$basic_ios@??0?$basic_istream@?setstate@?$basic_ios@D@std@@@1@_H_prolog3V?$basic_streambuf@
String ID:
API String ID: 3697353692-0
Opcode ID: cf61fd4a88d0e5b7fcc44c08c0a2c4da3d51ea240d835eb41bfb43ec03d667af
Instruction ID: 3b5254fee8fe787d2e3695070dda8bd151c4c2c4c2bdcdd1db219ff313265cf8
Opcode Fuzzy Hash: cf61fd4a88d0e5b7fcc44c08c0a2c4da3d51ea240d835eb41bfb43ec03d667af
Instruction Fuzzy Hash: C4119EB0600206EFDB05CF58C889AADBBB6FF44308F54811EF8199B391D7759E15CB54

Function 6C5D4AF5 Relevance: 6.1, APIs: 4, Instructions: 51COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C5D4AFC
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ.MSVCP140(00000008,6C5D4A28,?,?,?,0000000F,00000004,6C5DA8CF,?,00000020,00000040,00000001,?,?,?,?), ref: 6C5D4B19
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z.MSVCP140(00000005,00000000,00000000,00000008,6C5D4A28,?,?,?,0000000F,00000004,6C5DA8CF,?,00000020,00000040,00000001,?), ref: 6C5D4B31
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(00000002,00000000,00000008,?,?,00000000), ref: 6C5D4B84

Memory Dump Source

Source File: 00000006.00000002.4141448948.000000006C591000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000006.00000002.4141374342.000000006C590000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142318714.000000006C825000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142662450.000000006C906000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142732140.000000006C907000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142791681.000000006C909000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142876110.000000006C911000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142956827.000000006C913000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143044653.000000006C91D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143105643.000000006C925000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c590000_wegame.jbxd

Similarity

API ID: U?$char_traits@$D@std@@@std@@$??0?$basic_ios@??0?$basic_istream@?setstate@?$basic_ios@D@std@@@1@_H_prolog3V?$basic_streambuf@
String ID:
API String ID: 3697353692-0
Opcode ID: dcc79296acc98bc6672b580d6f7d08348eda394901c17b35893958c8ff07fd36
Instruction ID: b8a11c2d2b996f42dcf4568b99970912c629b856be0a3df0ff26671e40a42025
Opcode Fuzzy Hash: dcc79296acc98bc6672b580d6f7d08348eda394901c17b35893958c8ff07fd36
Instruction Fuzzy Hash: 14116AB0701306EFDB15CFA8C988AAEBBB5FF48308F508118E8159B391C774AE15DB91

Function 00467A3B Relevance: 6.0, APIs: 4, Instructions: 38COMMONLIBRARYCODE

Download Yara Rule

APIs

_callnewh.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,0040CE31,7FFFFFFE,?), ref: 00467A43
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,0040CE31,7FFFFFFE,?), ref: 00467A50
_CxxThrowException.VCRUNTIME140(?,0049391C,?), ref: 00468D71
_CxxThrowException.VCRUNTIME140(?,00493954,?), ref: 00468D8E

Memory Dump Source

Source File: 00000006.00000002.4137209488.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.4137156906.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137406249.0000000000476000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137497400.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137574844.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137626631.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137684215.00000000004A3000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_wegame.jbxd

Similarity

API ID: ExceptionThrow$_callnewhmalloc
String ID:
API String ID: 4113974480-0
Opcode ID: 5cf0e4b0ba0334e0a1513f0d3b6e68300482bb4c0424494b5bf97bd22a907add
Instruction ID: 396182cfa8eabb11b98a5de121aea4eb349765fce9f790bd180bc1f6b1dc60e5
Opcode Fuzzy Hash: 5cf0e4b0ba0334e0a1513f0d3b6e68300482bb4c0424494b5bf97bd22a907add
Instruction Fuzzy Hash: F1F0242080470DB2CF04FAA6EC0699E7B6C9910318B20422BB914A14D1FF78DB2989AF

Function 6C6ABEB5 Relevance: 6.0, APIs: 4, Instructions: 38COMMON

Download Yara Rule

APIs

_callnewh.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,6C5A621D,0000002C,0000000C,6C5A5702,00000004,6C5A57B1,00000214), ref: 6C6ABEBD
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,6C5A621D,0000002C,0000000C,6C5A5702,00000004,6C5A57B1,00000214), ref: 6C6ABECA
_CxxThrowException.VCRUNTIME140(?,6C8E84BC), ref: 6C6AD91D
_CxxThrowException.VCRUNTIME140(?,6C8E84D8), ref: 6C6AD93A

Memory Dump Source

Source File: 00000006.00000002.4141448948.000000006C591000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000006.00000002.4141374342.000000006C590000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142318714.000000006C825000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142662450.000000006C906000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142732140.000000006C907000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142791681.000000006C909000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142876110.000000006C911000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142956827.000000006C913000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143044653.000000006C91D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143105643.000000006C925000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c590000_wegame.jbxd

Similarity

API ID: ExceptionThrow$_callnewhmalloc
String ID:
API String ID: 4113974480-0
Opcode ID: c52d868ad0aa1e9cec1996b4fb7da65564b58a0d9ca5665caa1ef25b9f4cc45b
Instruction ID: eec4f32732177b13f1fa8a210ab6f3dd811096d83c978fdcb403777993cc8469
Opcode Fuzzy Hash: c52d868ad0aa1e9cec1996b4fb7da65564b58a0d9ca5665caa1ef25b9f4cc45b
Instruction Fuzzy Hash: 2AF0963580020DB68B00AAE5ED8C9DE776C5B02358B504921ED3451F91EB70E91B85D8

Function 0043DBA0 Relevance: 6.0, APIs: 4, Instructions: 34threadCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0043DBA7
??0CThread@@QAE@XZ.COMMON(00000024), ref: 0043DBB4
?appdata_project_folder@File_info@common@ierd_tgp@@SA?AVpath@filesystem@3@XZ.COMMON(?,?,?,?,?,?,?,?,?,?,?,?,?,00000024), ref: 0043DBDE
SimpleUString::operator=.MSOBJ140-MSVCRT ref: 0043DBFA

Memory Dump Source

Source File: 00000006.00000002.4137209488.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.4137156906.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137406249.0000000000476000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137497400.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137574844.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137626631.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137684215.00000000004A3000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_wegame.jbxd

Similarity

API ID: ?appdata_project_folder@File_info@common@ierd_tgp@@H_prolog3_SimpleString::operator=Thread@@Vpath@filesystem@3@
String ID:
API String ID: 2304671556-0
Opcode ID: ea09c602fe60cecb8b6a3b6d60d02080736d0df4a690ee80b21876d2a9f256d7
Instruction ID: 1f2cd335378c2763e42b05a3579391575f4e152258618037fcbcc48b82d7691d
Opcode Fuzzy Hash: ea09c602fe60cecb8b6a3b6d60d02080736d0df4a690ee80b21876d2a9f256d7
Instruction Fuzzy Hash: 9B016D31A04248DADB10EFA9C4497DDBBF4AF05318F14815EE044B72C2EBBC5A45CBAA

Function 0045D39E Relevance: 6.0, APIs: 4, Instructions: 32COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0045D3A5
?get_exe_path@Application@common@ierd_tgp@@SA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ.COMMON(?,?,?,00000034,0045CDCB,00000000,00452A2A), ref: 0045D3C8
?extract_path@common@ierd_tgp@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAV34@@Z.COMMON(00000000,?,?,?,?,00000034,0045CDCB,00000000,00452A2A), ref: 0045D3D6
?set_app_path@Application@common@ierd_tgp@@QAE_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z.COMMON(?), ref: 0045D3EF

Part of subcall function 00420D40: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,0043DEC9,F69FE839,?,?,?,0046D880,000000FF,?,0043DE1E,F69FE839,?,?,?,0046D82F,000000FF), ref: 00420D85

Memory Dump Source

Source File: 00000006.00000002.4137209488.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.4137156906.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137406249.0000000000476000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137497400.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137574844.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137626631.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137684215.00000000004A3000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_wegame.jbxd

Similarity

API ID: D@std@@U?$char_traits@V?$allocator@V?$basic_string@$Application@common@ierd_tgp@@D@2@@std@@$?extract_path@common@ierd_tgp@@?get_exe_path@?set_app_path@D@2@@std@@@H_prolog3_V34@@_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3206918494-0
Opcode ID: 875555e85afff9c2484fca7fb572b6bbeaaf125d310e015bf7a4cd830db8437a
Instruction ID: a268bd609e880b144a8247f209c7489eed376c3efe7cf4751300ea1051cd7aa4
Opcode Fuzzy Hash: 875555e85afff9c2484fca7fb572b6bbeaaf125d310e015bf7a4cd830db8437a
Instruction Fuzzy Hash: AEF08171D05248DBCB00EFE5C4865DDBF74AF14318F94416ED10577242E6785B44CB66

Function 6C6140FD Relevance: 6.0, APIs: 4, Instructions: 18COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6C614104
?get_qm_report_guid@common@ierd_tgp@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ.COMMON(?,0000001C), ref: 6C61410D

Part of subcall function 6C613F63: __EH_prolog3_GS.LIBCMT ref: 6C613F6D
Part of subcall function 6C613F63: ?get_log_instance@base@@YAPAVILogger@1@XZ.COMMON ref: 6C613FB7

?get_qos_instance@qos@adapt_for_imports@ierd_tgp@@YAAAVQos@123@XZ.COMMON(0000001C), ref: 6C614117
?set_qm_report_guid@Qos@qos@adapt_for_imports@ierd_tgp@@QAEXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z.COMMON(?,0000001C), ref: 6C614122

Memory Dump Source

Source File: 00000006.00000002.4141448948.000000006C591000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000006.00000002.4141374342.000000006C590000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142318714.000000006C825000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142662450.000000006C906000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142732140.000000006C907000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142791681.000000006C909000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142876110.000000006C911000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142956827.000000006C913000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143044653.000000006C91D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143105643.000000006C925000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c590000_wegame.jbxd

Similarity

API ID: D@std@@H_prolog3_U?$char_traits@V?$allocator@V?$basic_string@$?get_log_instance@base@@?get_qm_report_guid@common@ierd_tgp@@?get_qos_instance@qos@adapt_for_imports@ierd_tgp@@?set_qm_report_guid@D@2@@std@@D@2@@std@@@Logger@1@Qos@123@Qos@qos@adapt_for_imports@ierd_tgp@@
String ID:
API String ID: 2250616750-0
Opcode ID: 3703cdeee20858b0ae6640e59c7c6ee138716dfa4ae7f09fa64b1ff97de98f06
Instruction ID: caa2223cbec933010d10c25848f67ebee9e09393a4390949146c1cea5896c32d
Opcode Fuzzy Hash: 3703cdeee20858b0ae6640e59c7c6ee138716dfa4ae7f09fa64b1ff97de98f06
Instruction Fuzzy Hash: 85E08C31A04208EBCB08D7F4C851ADCB6749F4A338F981628D111A3AD0DB288A4D8A2C

Function 6C7F8DF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60networkCOMMON

Download Yara Rule

APIs

socket.WS2_32(00000002,00000001,00000000), ref: 6C7F91C6
socket.WS2_32(00000002,00000002,00000000), ref: 6C7F91D6

Strings

type, xrefs: 6C7F8E0E

Memory Dump Source

Source File: 00000006.00000002.4141448948.000000006C591000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000006.00000002.4141374342.000000006C590000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142318714.000000006C825000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142662450.000000006C906000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142732140.000000006C907000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142791681.000000006C909000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142876110.000000006C911000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142956827.000000006C913000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143044653.000000006C91D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143105643.000000006C925000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c590000_wegame.jbxd

Similarity

API ID: socket
String ID: type
API String ID: 98920635-2363381545
Opcode ID: e7a43f8e51e7e28bcee8801a9674c60b2d65131ad05e1cbd455cdd540c847081
Instruction ID: b7b8ed6fcfd4d608f30f395464a4bee108083db194b4115932eb9e2ed266cdb0
Opcode Fuzzy Hash: e7a43f8e51e7e28bcee8801a9674c60b2d65131ad05e1cbd455cdd540c847081
Instruction Fuzzy Hash: A4116BB17482009ADF100B269FCEB967F6AAF53758F4505B2E879CFB91C353D80AC591

Function 6C5F0D92 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37fileCOMMON

Download Yara Rule

APIs

CopyFileW.KERNEL32(00000000,6C5DA1AD,00000000,00000000,?,?,6C5F0E09,00000000,6C5DA1AD,00000000,00000000,?,?,?,6C5DA1AD), ref: 6C5F0DBC
GetLastError.KERNEL32(?,6C5F0E09,00000000,6C5DA1AD,00000000,00000000,?,?,?,6C5DA1AD), ref: 6C5F0DC6

Strings

ierd_tgp::filesystem::copy_file, xrefs: 6C5F0DD0

Memory Dump Source

Source File: 00000006.00000002.4141448948.000000006C591000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000006.00000002.4141374342.000000006C590000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142318714.000000006C825000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142662450.000000006C906000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142732140.000000006C907000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142791681.000000006C909000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142876110.000000006C911000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142956827.000000006C913000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143044653.000000006C91D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143105643.000000006C925000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c590000_wegame.jbxd

Similarity

API ID: CopyErrorFileLast
String ID: ierd_tgp::filesystem::copy_file
API String ID: 374144340-1011023781
Opcode ID: e294351f9ed5c12f492d59ea9cdbebcb99695aa56fd4d8a11e375df19ce989b2
Instruction ID: 7cf206e59549dc1726d97f239f8f154cc86dae2b8daaa262dda77d7a3765b895
Opcode Fuzzy Hash: e294351f9ed5c12f492d59ea9cdbebcb99695aa56fd4d8a11e375df19ce989b2
Instruction Fuzzy Hash: 98F09A75212254AB8B14AE25DC088673B7DFBCA266708882AF805D3604E730E962CAF1

Function 6C6C1940 Relevance: 4.7, APIs: 3, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4141448948.000000006C591000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000006.00000002.4141374342.000000006C590000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142318714.000000006C825000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142662450.000000006C906000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142732140.000000006C907000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142791681.000000006C909000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142876110.000000006C911000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142956827.000000006C913000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143044653.000000006C91D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143105643.000000006C925000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c590000_wegame.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a56a36e06e948ff1a068d17d6f70fb34e928515856be915a691ccb98664c7a6
Instruction ID: 770ff99a9470f3e3c53977c700192f722be6ddcb0d6c2e009ccc93fa7358235a
Opcode Fuzzy Hash: 8a56a36e06e948ff1a068d17d6f70fb34e928515856be915a691ccb98664c7a6
Instruction Fuzzy Hash: C48105B0605F418AE3208F39C9497C3BAE0BF42319F108A1DD5FE5A281DBB66188CF95

Function 6C65C58C Relevance: 4.6, APIs: 3, Instructions: 59COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6C65C596

Part of subcall function 6C6ABEB5: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,6C5A621D,0000002C,0000000C,6C5A5702,00000004,6C5A57B1,00000214), ref: 6C6ABECA

??0path@filesystem@ierd_tgp@@QAE@ABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z.COMMON(?,00000000,6C65D828,00000218,6C65CDA5,?,?), ref: 6C65C5D9
_Open_dir.MSVCP140(?,?,?,?,?,00000000,6C65D828,00000218,6C65CDA5,?,?), ref: 6C65C612

Memory Dump Source

Source File: 00000006.00000002.4141448948.000000006C591000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000006.00000002.4141374342.000000006C590000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142318714.000000006C825000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142662450.000000006C906000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142732140.000000006C907000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142791681.000000006C909000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142876110.000000006C911000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142956827.000000006C913000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143044653.000000006C91D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143105643.000000006C925000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c590000_wegame.jbxd

Similarity

API ID: ??0path@filesystem@ierd_tgp@@H_prolog3_Open_dirU?$char_traits@_V?$allocator@_V?$basic_string@_W@2@@std@@@W@std@@malloc
String ID:
API String ID: 2906514752-0
Opcode ID: 0dac64ed440378581ad4f9205a26a7876ec391e46e335c9871c5e892ecc562de
Instruction ID: bfce40b7ba6dc7e38757b0176192aa30e6de4e3bdfbc8a8a82dae1b6e957b5c1
Opcode Fuzzy Hash: 0dac64ed440378581ad4f9205a26a7876ec391e46e335c9871c5e892ecc562de
Instruction Fuzzy Hash: C321D2B1940618EBCB21DF98CC84ACEBBF8AF99304F600099E14697750CB309E55CF98

Function 6C5CA2A5 Relevance: 4.6, APIs: 3, Instructions: 57COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6C5CA2AC
_time64.API-MS-WIN-CRT-TIME-L1-1-0(00000000,0000001C,6C5C6A6F), ref: 6C5CA2C7

Part of subcall function 6C5C8355: __EH_prolog3_GS.LIBCMT ref: 6C5C835F
Part of subcall function 6C5C8355: memset.VCRUNTIME140(?,00000000,00000040,000000A0,6C5CA301,?,?,?), ref: 6C5C83C0

_memcpy_s.PGOCR ref: 6C5CA32B

Memory Dump Source

Source File: 00000006.00000002.4141448948.000000006C591000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000006.00000002.4141374342.000000006C590000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142318714.000000006C825000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142662450.000000006C906000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142732140.000000006C907000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142791681.000000006C909000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142876110.000000006C911000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142956827.000000006C913000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143044653.000000006C91D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143105643.000000006C925000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c590000_wegame.jbxd

Similarity

API ID: H_prolog3_$_memcpy_s_time64memset
String ID:
API String ID: 2258469228-0
Opcode ID: bbbd6377becb3ebacc6b3cd03a91c3bb403233574dce31155cdbf2ed1cf18c71
Instruction ID: 934d45ecfdb83432735dad26a0ca5b34a1e6073b1015ae56bdf30f74aa6c0160
Opcode Fuzzy Hash: bbbd6377becb3ebacc6b3cd03a91c3bb403233574dce31155cdbf2ed1cf18c71
Instruction Fuzzy Hash: 8A219F71901744DFCB20DFE4C9405DEBFF4AF09214F94095EC1A6A3A91D730AA49CB66

Function 6C6141BD Relevance: 4.6, APIs: 3, Instructions: 53COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6C6141C7
memset.VCRUNTIME140(?,00000000,00000094,0000009C,6C6161A2,?,?,?,?,?,00000000,00000006,00000358,6C616080,6C924000), ref: 6C6141EA
GetVersionExA.KERNEL32(00000094), ref: 6C614203

Part of subcall function 6C61468C: __EH_prolog3_GS.LIBCMT ref: 6C614696
Part of subcall function 6C61468C: memset.VCRUNTIME140(?,00000000,00000100,000003B0,6C61421F,?,00000010,?), ref: 6C6146DC
Part of subcall function 6C61468C: __snprintf_s.LIBCMT ref: 6C6146F5
Part of subcall function 6C61468C: CreateFileA.KERNEL32(?,C0000000,00000003,00000000,00000003,00000000,00000000), ref: 6C614712
Part of subcall function 6C61468C: memset.VCRUNTIME140(?,00000000,00000018), ref: 6C614735
Part of subcall function 6C61468C: DeviceIoControl.KERNEL32(00000000,00074080,00000000,00000000,?,00000018,?,00000000), ref: 6C614756
Part of subcall function 6C61468C: memset.VCRUNTIME140(?,00000000,00000021), ref: 6C61478A
Part of subcall function 6C61468C: memset.VCRUNTIME140(?,00000000,00000210,?,00000000,00000021), ref: 6C61479D

Part of subcall function 6C61426E: __EH_prolog3_GS.LIBCMT ref: 6C614278
Part of subcall function 6C61426E: memset.VCRUNTIME140(?,00000000,00000100,00000394,6C614235,?,00000010,?), ref: 6C6142BE
Part of subcall function 6C61426E: __snprintf_s.LIBCMT ref: 6C6142D7
Part of subcall function 6C61426E: CreateFileA.KERNEL32(?,C0000000,00000003,00000000,00000003,00000000,00000000,?,?,?,00000394,6C614235,?,00000010,?), ref: 6C6142F4
Part of subcall function 6C61426E: memset.VCRUNTIME140(?,00000000,0000022D,?,?,?,00000394,6C614235,?,00000010,?), ref: 6C61431B
Part of subcall function 6C61426E: memcpy.VCRUNTIME140(?,SCSIDISK), ref: 6C614356
Part of subcall function 6C61426E: DeviceIoControl.KERNEL32(00000000,0004D008,?,0000003C,?,0000022D,?,00000000), ref: 6C614389

Part of subcall function 6C614908: __EH_prolog3_GS.LIBCMT ref: 6C614912
Part of subcall function 6C614908: memset.VCRUNTIME140(?,00000000,00000100,00000C68,6C61424B,?,00000010,?), ref: 6C61494C
Part of subcall function 6C614908: __snprintf_s.LIBCMT ref: 6C614965
Part of subcall function 6C614908: CreateFileA.KERNEL32(?,00000000,00000003,00000000,00000003,00000000,00000000,?,?,?,00000C68,6C61424B,?,00000010,?), ref: 6C61497E
Part of subcall function 6C614908: memset.VCRUNTIME140(?,00000000,0000000C), ref: 6C6149A1
Part of subcall function 6C614908: memset.VCRUNTIME140(?,00000000,00000800,?,00000000,0000000C), ref: 6C6149C1
Part of subcall function 6C614908: DeviceIoControl.KERNEL32(00000000,002D1400,?,0000000C,?,00000800,?,00000000), ref: 6C6149ED
Part of subcall function 6C614908: memset.VCRUNTIME140(?,00000000,00000100,?,?,?,?,?,?,?,?,?,00000C68,6C61424B,?,00000010), ref: 6C614A09
Part of subcall function 6C614908: memset.VCRUNTIME140(?,00000000,00000100,?,00000000,00000100,?,?,?,?,?,?,?,?,?,00000C68), ref: 6C614A1C
Part of subcall function 6C614908: memset.VCRUNTIME140(?,00000000,00000100,?,00000000,00000100,?,00000000,00000100), ref: 6C614A2F

Part of subcall function 6C61448D: __EH_prolog3_GS.LIBCMT ref: 6C614497
Part of subcall function 6C61448D: memset.VCRUNTIME140(?,00000000,00000100,0000017C,6C614261,?,00000010,?), ref: 6C6144D7
Part of subcall function 6C61448D: __snprintf_s.LIBCMT ref: 6C6144F0
Part of subcall function 6C61448D: CreateFileA.KERNEL32(?,C0000000,00000007,00000000,00000003,00000000,00000000,?,?,?,0000017C,6C614261,?,00000010,?), ref: 6C61450E
Part of subcall function 6C61448D: memset.VCRUNTIME140(?,00000000,00000018,?,?,?,0000017C,6C614261,?,00000010,?), ref: 6C614531
Part of subcall function 6C61448D: DeviceIoControl.KERNEL32(00000000,00074080,00000000,00000000,?,00000018,?,00000000), ref: 6C614552
Part of subcall function 6C61448D: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000221,?,?,?,?,?,?,0000017C,6C614261,?,00000010,?), ref: 6C614565
Part of subcall function 6C61448D: DeviceIoControl.KERNEL32(00000000,0007C088,00000000,00000021,00000000,00000221,00000000,00000000), ref: 6C614599

Memory Dump Source

Source File: 00000006.00000002.4141448948.000000006C591000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000006.00000002.4141374342.000000006C590000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142318714.000000006C825000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142662450.000000006C906000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142732140.000000006C907000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142791681.000000006C909000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142876110.000000006C911000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142956827.000000006C913000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143044653.000000006C91D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143105643.000000006C925000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c590000_wegame.jbxd

Similarity

API ID: memset$ControlDeviceH_prolog3_$CreateFile__snprintf_s$Versionmallocmemcpy
String ID:
API String ID: 3554163442-0
Opcode ID: 5c00c0aa6440af59228604a1ab728bcdf95625843893766673c6e7999bf0fbbd
Instruction ID: 0f9090bd430f2993e69d9a5cd331cc85d04fba6e4f207c483853eab0de1e18ef
Opcode Fuzzy Hash: 5c00c0aa6440af59228604a1ab728bcdf95625843893766673c6e7999bf0fbbd
Instruction Fuzzy Hash: 5B01A531E492546ECF205E604C04FCE37789F8730CF4800A0F98C5BA01D7754B8D8B9A

Function 6C5B7D77 Relevance: 4.6, APIs: 3, Instructions: 52COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6C5B7D7E
?u8to16@common@ierd_tgp@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@4@@Z.COMMON(?,?,?,?,?,?,?,0000003C), ref: 6C5B7DA6

Part of subcall function 6C6336B8: __EH_prolog3_GS.LIBCMT ref: 6C6336BF

Part of subcall function 6C5ACEF4: memcpy.VCRUNTIME140(00000000,?,?,00000001,?,?,?,?,?,?,6C5AA734,?,00000004,6C5AA09E,?,9C33995A), ref: 6C5ACF53

Part of subcall function 6C5A6B70: ?_Execute_once@std@@YAHAAUonce_flag@1@P6GHPAX1PAPAX@Z1@Z.MSVCP140(6C91D054,6C5A6BB1,6C91D058,?,6C5AA235,00000000,?,00000010), ref: 6C5A6B81
Part of subcall function 6C5A6B70: terminate.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5A6B8D

?current_path@filesystem@ierd_tgp@@YAXABVpath@12@AAVerror_code@std@@@Z.COMMON(?,?,?,?,?,?,?,?,0000003C), ref: 6C5B7DDA

Memory Dump Source

Source File: 00000006.00000002.4141448948.000000006C591000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000006.00000002.4141374342.000000006C590000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142318714.000000006C825000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142662450.000000006C906000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142732140.000000006C907000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142791681.000000006C909000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142876110.000000006C911000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142956827.000000006C913000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143044653.000000006C91D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143105643.000000006C925000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c590000_wegame.jbxd

Similarity

API ID: H_prolog3_$?current_path@filesystem@ierd_tgp@@?u8to16@common@ierd_tgp@@D@2@@std@@D@std@@Execute_once@std@@U?$char_traits@U?$char_traits@_Uonce_flag@1@V?$allocator@V?$allocator@_V?$basic_string@V?$basic_string@_Verror_code@std@@@Vpath@12@W@2@@4@@W@std@@memcpyterminate
String ID:
API String ID: 3258242387-0
Opcode ID: 27dc5985bf68770d9a78d5bc31879fb66d3946d54278a1107c90dd107424fca0
Instruction ID: 5c36efe60a4cd3d40d3dda73de654b4f9ea98643bf1ebd09a287691277dfde66
Opcode Fuzzy Hash: 27dc5985bf68770d9a78d5bc31879fb66d3946d54278a1107c90dd107424fca0
Instruction Fuzzy Hash: 7E1158B1C0424CDECB04DFE4C8819DEBBB4BF09318F64412ED115AB690DB31AE0ACBA4

Function 6C5CA897 Relevance: 4.5, APIs: 3, Instructions: 45COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6C5CA89E
?rdstate@ios_base@std@@QBEHXZ.MSVCP140(?,00000032,00000040,00000024,6C5C90A6,?,?,?,00000004,6C5C6DB7,00000000,?,00000000), ref: 6C5CA8CC
OutputDebugStringW.KERNEL32(00000000,?,?,?,00000000), ref: 6C5CA8FC

Memory Dump Source

Source File: 00000006.00000002.4141448948.000000006C591000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000006.00000002.4141374342.000000006C590000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142318714.000000006C825000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142662450.000000006C906000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142732140.000000006C907000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142791681.000000006C909000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142876110.000000006C911000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142956827.000000006C913000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143044653.000000006C91D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143105643.000000006C925000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c590000_wegame.jbxd

Similarity

API ID: ?rdstate@ios_base@std@@DebugH_prolog3_OutputString
String ID:
API String ID: 3811627321-0
Opcode ID: 6eafb51265d982fe901c13146b65128636696f025a134b2088fba3ce02857337
Instruction ID: 49791d277cf9c887dfbff3ddf493c9d272294dd943c68d99f71142a778d6aa84
Opcode Fuzzy Hash: 6eafb51265d982fe901c13146b65128636696f025a134b2088fba3ce02857337
Instruction Fuzzy Hash: 43016D70B00204DFDB10DF98CD49ADD7BB4BF49314F448558E551ABA90C734DA4ACBA6

Function 6C6AF060 Relevance: 4.5, APIs: 3, Instructions: 41threadCOMMON

Download Yara Rule

APIs

_beginthreadex.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,00000000,6C6AF0C0,?,00000004,00000000,?,00000000,6C5BF917,00000030,6C629929,0000000C,6C62A16B,00000010), ref: 6C6AF076
CloseHandle.KERNEL32(?,00000000,6C62A16B,00000010), ref: 6C6AF0A2
ResumeThread.KERNEL32(?,00000000,6C62A16B,00000010), ref: 6C6AF0B0

Memory Dump Source

Source File: 00000006.00000002.4141448948.000000006C591000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000006.00000002.4141374342.000000006C590000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142318714.000000006C825000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142662450.000000006C906000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142732140.000000006C907000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142791681.000000006C909000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142876110.000000006C911000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142956827.000000006C913000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143044653.000000006C91D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143105643.000000006C925000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c590000_wegame.jbxd

Similarity

API ID: CloseHandleResumeThread_beginthreadex
String ID:
API String ID: 3482405168-0
Opcode ID: eb884037d313c12c54ae1e28528b3c406477776afe47a8eaa83e1645e3e0ee62
Instruction ID: 1b3185c6bac90d780fe30a233ccd965004941711621e3d3ea7912eaff275391f
Opcode Fuzzy Hash: eb884037d313c12c54ae1e28528b3c406477776afe47a8eaa83e1645e3e0ee62
Instruction Fuzzy Hash: CEF04F71240301ABDB209E99C884B5673F8EF4932AB24466AF554D7691C770A882DBD5

Function 00448F63 Relevance: 4.5, APIs: 3, Instructions: 36COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00448F6A
?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z.MSVCP140(?,?,?,?,?,?,?,?,?,00000008,00447D58,?,?,?,00000000), ref: 00448F80

Part of subcall function 0044894C: ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ.MSVCP140 ref: 00448964
Part of subcall function 0044894C: _get_stream_buffer_pointers.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,?,?), ref: 00448987

?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ.MSVCP140(?), ref: 00448F9C

Part of subcall function 00447B9B: __EH_prolog3.LIBCMT ref: 00447BA2
Part of subcall function 00447B9B: ??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000,00000018,00448F55,?), ref: 00447BAD
Part of subcall function 00447B9B: ??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 00447BC4
Part of subcall function 00447B9B: std::locale::_Getfacet.LIBCPMT ref: 00447BCE
Part of subcall function 00447B9B: ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?), ref: 00447BE7
Part of subcall function 00447B9B: std::_Facet_Register.LIBCPMT ref: 00447BFF
Part of subcall function 00447B9B: ??1_Lockit@std@@QAE@XZ.MSVCP140 ref: 00447C22

Part of subcall function 004489C8: ?always_noconv@codecvt_base@std@@QBE_NXZ.MSVCP140 ref: 004489D4

Memory Dump Source

Source File: 00000006.00000002.4137209488.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.4137156906.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137406249.0000000000476000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137497400.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137574844.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137626631.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137684215.00000000004A3000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_wegame.jbxd

Similarity

API ID: D@std@@@std@@H_prolog3Lockit@std@@U?$char_traits@$??0_??1_?always_noconv@codecvt_base@std@@?getloc@?$basic_streambuf@Bid@locale@std@@Facet_Fiopen@std@@Getcat@?$codecvt@GetfacetInit@?$basic_streambuf@Mbstatet@@@std@@RegisterU_iobuf@@V42@@Vfacet@locale@2@Vlocale@2@_get_stream_buffer_pointersstd::_std::locale::_
String ID:
API String ID: 3501216582-0
Opcode ID: 096e44f3e615a789f3eb8fde2e55476b8c6f9a5c0f6229021a0155442362d445
Instruction ID: 8c95ece3a048c9d21eaee8865d37abdf52e202c2c8b2585fb1a53adb9555d454
Opcode Fuzzy Hash: 096e44f3e615a789f3eb8fde2e55476b8c6f9a5c0f6229021a0155442362d445
Instruction Fuzzy Hash: D0F0F670600204AFEF10ABA1CC0AB6E3A65BF14718F00401EB414E61D1EF7C8F05CB1E

Function 6C5CA7EC Relevance: 4.5, APIs: 3, Instructions: 36COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C5CA7F3
?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z.MSVCP140(00000008,?,?,00000008,6C5D4B76,00000008,?,?,00000000), ref: 6C5CA809

Part of subcall function 6C5C8BB5: ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ.MSVCP140(?,?,00000000,?,?,6C5C664A,00000008,00000000), ref: 6C5C8BCD
Part of subcall function 6C5C8BB5: _get_stream_buffer_pointers.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,?,?,?,?,00000000,?,?,6C5C664A,00000008,00000000), ref: 6C5C8BF0

?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ.MSVCP140(0000000F,00000000,00000001,?,?,?), ref: 6C5CA825

Part of subcall function 6C5C4EA1: __EH_prolog3.LIBCMT ref: 6C5C4EA8
Part of subcall function 6C5C4EA1: ??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000,00000018,6C5CA835,00000000,?,?,?), ref: 6C5C4EB3
Part of subcall function 6C5C4EA1: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?), ref: 6C5C4ECA
Part of subcall function 6C5C4EA1: std::locale::_Getfacet.LIBCPMT ref: 6C5C4ED4
Part of subcall function 6C5C4EA1: ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,00000008,00000000,?,?,?), ref: 6C5C4EED
Part of subcall function 6C5C4EA1: std::_Facet_Register.LIBCPMT ref: 6C5C4F05
Part of subcall function 6C5C4EA1: ??1_Lockit@std@@QAE@XZ.MSVCP140(00000000,?,?,?), ref: 6C5C4F28

Part of subcall function 6C5C8C31: ?always_noconv@codecvt_base@std@@QBE_NXZ.MSVCP140(?,?,?,6C5CA83E,00000000,?,?,?), ref: 6C5C8C3D

Memory Dump Source

Source File: 00000006.00000002.4141448948.000000006C591000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000006.00000002.4141374342.000000006C590000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142318714.000000006C825000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142662450.000000006C906000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142732140.000000006C907000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142791681.000000006C909000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142876110.000000006C911000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142956827.000000006C913000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143044653.000000006C91D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143105643.000000006C925000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c590000_wegame.jbxd

Similarity

API ID: D@std@@@std@@H_prolog3Lockit@std@@U?$char_traits@$??0_??1_?always_noconv@codecvt_base@std@@?getloc@?$basic_streambuf@Bid@locale@std@@Facet_Fiopen@std@@Getcat@?$codecvt@GetfacetInit@?$basic_streambuf@Mbstatet@@@std@@RegisterU_iobuf@@V42@@Vfacet@locale@2@Vlocale@2@_get_stream_buffer_pointersstd::_std::locale::_
String ID:
API String ID: 3501216582-0
Opcode ID: 8c5626dd0573cdfdecb6790f5d1de29cea989a6cf70f508b956c9320c8ecc08d
Instruction ID: 0a3bc744f17a26bf3910f71b21859e4c65049a7be649dc18dc80bcd95ff93026
Opcode Fuzzy Hash: 8c5626dd0573cdfdecb6790f5d1de29cea989a6cf70f508b956c9320c8ecc08d
Instruction Fuzzy Hash: 2CF0C270700208DBCF10DBE0CD05BDE7A75AF85318F10812CE40196A90DB748E0BCB6A

Function 6C624DE4 Relevance: 4.5, APIs: 3, Instructions: 30COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C624DEB
??0Qos@qos@adapt_for_imports@ierd_tgp@@QAE@XZ.COMMON(00000000,6C5E6DF7,?,?,0000008C,6C5E79F6,00000002,00000000,?), ref: 6C624E34
__Init_thread_footer.LIBCMT ref: 6C624E48

Memory Dump Source

Source File: 00000006.00000002.4141448948.000000006C591000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000006.00000002.4141374342.000000006C590000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142318714.000000006C825000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142662450.000000006C906000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142732140.000000006C907000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142791681.000000006C909000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142876110.000000006C911000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142956827.000000006C913000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143044653.000000006C91D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143105643.000000006C925000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c590000_wegame.jbxd

Similarity

API ID: H_prolog3Init_thread_footerQos@qos@adapt_for_imports@ierd_tgp@@
String ID:
API String ID: 3158337806-0
Opcode ID: b8add0b07416cf2ffa4d965c391a398f89e96713e7843a530f3aac269acf1f8b
Instruction ID: a934c0c9f822b937dc09fd1781459e30783d7573f5cd070a2e07b2990af05575
Opcode Fuzzy Hash: b8add0b07416cf2ffa4d965c391a398f89e96713e7843a530f3aac269acf1f8b
Instruction Fuzzy Hash: 85F0BB723085059BDB15EB948496A6D73619746338F285549E0114BFD0CB395D078D8D

Function 6C61F52B Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 35COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C61F532

Part of subcall function 6C61F6EB: RegOpenKeyExA.KERNEL32(80000002,HARDWARE\DESCRIPTION\System\CentralProcessor\0,00000000,00020019,?), ref: 6C61F712
Part of subcall function 6C61F6EB: RegQueryValueExA.KERNEL32(?,~MHz,00000000,00000000,?,00000004), ref: 6C61F72F
Part of subcall function 6C61F6EB: RegCloseKey.KERNEL32(?), ref: 6C61F73A

Part of subcall function 6C6ABEB5: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,6C5A621D,0000002C,0000000C,6C5A5702,00000004,6C5A57B1,00000214), ref: 6C6ABECA

Strings

Root, xrefs: 6C61F553

Memory Dump Source

Source File: 00000006.00000002.4141448948.000000006C591000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000006.00000002.4141374342.000000006C590000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142318714.000000006C825000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142662450.000000006C906000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142732140.000000006C907000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142791681.000000006C909000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142876110.000000006C911000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142956827.000000006C913000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143044653.000000006C91D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143105643.000000006C925000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c590000_wegame.jbxd

Similarity

API ID: CloseH_prolog3OpenQueryValuemalloc
String ID: Root
API String ID: 248731187-3066451557
Opcode ID: 868183eda76a31cd0c0fc06e7280f36235de6260f22c02474758fa90460e673b
Instruction ID: 98f2f4597975488e4e810c60617484270d1a4903e68682fed872bcf969fb0559
Opcode Fuzzy Hash: 868183eda76a31cd0c0fc06e7280f36235de6260f22c02474758fa90460e673b
Instruction Fuzzy Hash: 700119B0904B008BC724CF6E854064AFAF4AF95714B508A1E90A687FA1CBB5D9068B8D

Function 0043ED54 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 20COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0043ED5B

Part of subcall function 00467A3B: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,0040CE31,7FFFFFFE,?), ref: 00467A50

Part of subcall function 0043DBA0: __EH_prolog3_GS.LIBCMT ref: 0043DBA7
Part of subcall function 0043DBA0: ??0CThread@@QAE@XZ.COMMON(00000024), ref: 0043DBB4
Part of subcall function 0043DBA0: ?appdata_project_folder@File_info@common@ierd_tgp@@SA?AVpath@filesystem@3@XZ.COMMON(?,?,?,?,?,?,?,?,?,?,?,?,?,00000024), ref: 0043DBDE
Part of subcall function 0043DBA0: SimpleUString::operator=.MSOBJ140-MSVCRT ref: 0043DBFA

Strings

8Du, xrefs: 0043ED60, 0043ED88

Memory Dump Source

Source File: 00000006.00000002.4137209488.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.4137156906.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137406249.0000000000476000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137497400.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137574844.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137626631.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137684215.00000000004A3000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_wegame.jbxd

Similarity

API ID: ?appdata_project_folder@File_info@common@ierd_tgp@@H_prolog3H_prolog3_SimpleString::operator=Thread@@Vpath@filesystem@3@malloc
String ID: 8Du
API String ID: 658492096-1631806088
Opcode ID: cb426c42499e45f6dca787c77eac28a0c3aac57cab4fdd6352319e81047a4549
Instruction ID: b8a3c143bcbdd0cd1c60f2bcb5c0afaf313ef9d7e519cbd68020e43ace9f815b
Opcode Fuzzy Hash: cb426c42499e45f6dca787c77eac28a0c3aac57cab4fdd6352319e81047a4549
Instruction Fuzzy Hash: 24E046B0B05206CACB18EFBA980661D2AA56B08368F10867FB010C72C0EB388A01860E

Function 6C5CBCC7 Relevance: 3.2, APIs: 2, Instructions: 221COMMON

Download Yara Rule

APIs

__EH_prolog3_catch_GS.LIBCMT ref: 6C5CBCD1

Part of subcall function 6C5A30A0: ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ.MSVCP140(9C33995A,?), ref: 6C5A30E3
Part of subcall function 6C5A30A0: ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z.MSVCP140(?,00000000,00000000,9C33995A,?), ref: 6C5A3101
Part of subcall function 6C5A30A0: ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ.MSVCP140 ref: 6C5A312B

Part of subcall function 6C5CA720: __EH_prolog3.LIBCMT ref: 6C5CA727

Part of subcall function 6C5C9B58: __EH_prolog3.LIBCMT ref: 6C5C9B5F

Part of subcall function 6C5CA695: __EH_prolog3.LIBCMT ref: 6C5CA69C

Part of subcall function 6C5C9329: __EH_prolog3.LIBCMT ref: 6C5C9330

Part of subcall function 6C5CA5AA: __EH_prolog3.LIBCMT ref: 6C5CA5B1

Part of subcall function 6C5C38B9: __EH_prolog3.LIBCMT ref: 6C5C38C0

Part of subcall function 6C5A3BC0: ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ.MSVCP140(9C33995A,?,00000001), ref: 6C5A3C9D
Part of subcall function 6C5A3BC0: ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(00000004,00000000), ref: 6C5A3DB6
Part of subcall function 6C5A3BC0: ?uncaught_exception@std@@YA_NXZ.MSVCP140 ref: 6C5A3DC3

Part of subcall function 6C5A3BC0: ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z.MSVCP140(?,00000001,9C33995A,?,00000001), ref: 6C5A3CFD
Part of subcall function 6C5A3BC0: ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ.MSVCP140 ref: 6C5A3DD1

Part of subcall function 6C5C2807: ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@I@Z.MSVCP140(00000000,?,6C5CBDC5,00000000,?,6C82959C), ref: 6C5C2810

Part of subcall function 6C5A3BC0: ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z.MSVCP140(?,?,00000000,00000001,9C33995A,?,00000001), ref: 6C5A3D26
Part of subcall function 6C5A3BC0: ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z.MSVCP140(?), ref: 6C5A3D52

Part of subcall function 6C59A3A0: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,6C5A62D8,00000000,6C5A6649,00000003,9C33995A,?,?,00000000,6C7FF594,000000FF,?,6C5A5B05,00000000), ref: 6C59A3E5

Part of subcall function 6C5C8037: __EH_prolog3_GS.LIBCMT ref: 6C5C803E

?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@PBD_J@Z.MSVCP140(?,?,00000000), ref: 6C5CBF77

Memory Dump Source

Source File: 00000006.00000002.4141448948.000000006C591000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000006.00000002.4141374342.000000006C590000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142318714.000000006C825000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142662450.000000006C906000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142732140.000000006C907000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142791681.000000006C909000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142876110.000000006C911000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142956827.000000006C913000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143044653.000000006C91D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143105643.000000006C925000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c590000_wegame.jbxd

Similarity

API ID: U?$char_traits@$D@std@@@std@@$H_prolog3$?sputc@?$basic_streambuf@V12@$??0?$basic_ios@??0?$basic_ostream@??0?$basic_streambuf@??6?$basic_ostream@?flush@?$basic_ostream@?setstate@?$basic_ios@?sputn@?$basic_streambuf@?uncaught_exception@std@@?write@?$basic_ostream@D@std@@@1@_H_prolog3_H_prolog3_catch_Osfx@?$basic_ostream@V01@V?$basic_streambuf@_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1209532415-0
Opcode ID: 5757fd5522da2964584d0f74e327546f795b2955b3aec1ac227d039c63319ff3
Instruction ID: 3ce0126611fb7a0fcb24b5d57f95805ef2b9aa719f0aa678ff6cf09d0ef4e45d
Opcode Fuzzy Hash: 5757fd5522da2964584d0f74e327546f795b2955b3aec1ac227d039c63319ff3
Instruction Fuzzy Hash: 83918931D05288EEEB14DBE5CD48BDDBBB4AF95208F2080DDD009A7681DB745F49CB62

Function 6C594E10 Relevance: 3.2, APIs: 1, Strings: 1, Instructions: 206COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,?), ref: 6C59509A

Strings

8, xrefs: 6C594E2A

Memory Dump Source

Source File: 00000006.00000002.4141448948.000000006C591000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000006.00000002.4141374342.000000006C590000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142318714.000000006C825000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142662450.000000006C906000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142732140.000000006C907000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142791681.000000006C909000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142876110.000000006C911000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142956827.000000006C913000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143044653.000000006C91D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143105643.000000006C925000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c590000_wegame.jbxd

Similarity

API ID: memset
String ID: 8
API String ID: 2221118986-4194326291
Opcode ID: 5763368b714e235ef5f8b95d3d23d8d373f1efc6eed0431c3f45a868cc5b2893
Instruction ID: c5175517abec5313c35c117ea5c4d1bb7b3d51f9e3be7c24ebbd2d199bc3f2d5
Opcode Fuzzy Hash: 5763368b714e235ef5f8b95d3d23d8d373f1efc6eed0431c3f45a868cc5b2893
Instruction Fuzzy Hash: 519104B1600A42ABD724CF29D845792FBF1FF48319F54832AD5A986A90D776B4A4CFC0

Function 6C69F800 Relevance: 3.2, APIs: 2, Instructions: 162COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C69F86F
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?), ref: 6C69F8EF

Memory Dump Source

Source File: 00000006.00000002.4141448948.000000006C591000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000006.00000002.4141374342.000000006C590000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142318714.000000006C825000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142662450.000000006C906000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142732140.000000006C907000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142791681.000000006C909000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142876110.000000006C911000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142956827.000000006C913000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143044653.000000006C91D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143105643.000000006C925000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c590000_wegame.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: c7a7f269afdf7a669879d99f7b9d69314bdeabd24bc812fb8e62b41ad8f01c96
Instruction ID: a2082e565868335756629eb603e7e03d1ff90811f597e3714f44608bbfe069e8
Opcode Fuzzy Hash: c7a7f269afdf7a669879d99f7b9d69314bdeabd24bc812fb8e62b41ad8f01c96
Instruction Fuzzy Hash: A1412632200105ABD728CF19D9D4BAAB7FAEFC2354F15452DF84A8B780DB71E949C794

Function 6C5C8355 Relevance: 3.1, APIs: 2, Instructions: 81COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6C5C835F

Part of subcall function 6C5C84E1: __EH_prolog3_GS.LIBCMT ref: 6C5C84E8

memset.VCRUNTIME140(?,00000000,00000040,000000A0,6C5CA301,?,?,?), ref: 6C5C83C0

Part of subcall function 6C59A8F0: memcpy.VCRUNTIME140(?,?,9XZl,?,?,00000000,?,?,6C5A5839,?,?), ref: 6C59A917

Part of subcall function 6C59A8F0: memcpy.VCRUNTIME140(00000000,?,9XZl,?,?,00000000,?,?,6C5A5839,?,?), ref: 6C59A9BB

Memory Dump Source

Source File: 00000006.00000002.4141448948.000000006C591000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000006.00000002.4141374342.000000006C590000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142318714.000000006C825000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142662450.000000006C906000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142732140.000000006C907000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142791681.000000006C909000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142876110.000000006C911000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142956827.000000006C913000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143044653.000000006C91D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143105643.000000006C925000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c590000_wegame.jbxd

Similarity

API ID: H_prolog3_memcpy$memset
String ID:
API String ID: 4275824283-0
Opcode ID: d87dcd86ff7bcb5af2a6bf870c300180d744a5ce53e2d6227c31263e75ac7f5b
Instruction ID: 9630facaa130a9e23ba7a2d74fc4cce2f32cc740d0f7431c6729e868d21f93d2
Opcode Fuzzy Hash: d87dcd86ff7bcb5af2a6bf870c300180d744a5ce53e2d6227c31263e75ac7f5b
Instruction Fuzzy Hash: EC21B672A0031DAFDF10DAE0CC84FDE7379BF05308F40449AA618A7640DB74AA4D8B62

Function 6C63F2C7 Relevance: 3.1, APIs: 2, Instructions: 72COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6C63F2CE

Part of subcall function 6C59A8F0: memcpy.VCRUNTIME140(?,?,9XZl,?,?,00000000,?,?,6C5A5839,?,?), ref: 6C59A917

?ReadPrivateProfile@Sys_wrapper@common@ierd_tgp@@SA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@00AAV45@1@Z.COMMON(?,?,?), ref: 6C63F32F

Part of subcall function 6C63F031: __EH_prolog3_GS.LIBCMT ref: 6C63F03B
Part of subcall function 6C63F031: ?u8to16@common@ierd_tgp@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@4@@Z.COMMON(?,?,000002DC), ref: 6C63F0F5
Part of subcall function 6C63F031: ?u8to16@common@ierd_tgp@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@4@@Z.COMMON(?,?,?,?,000002DC), ref: 6C63F107
Part of subcall function 6C63F031: ?u8to16@common@ierd_tgp@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@4@@Z.COMMON(?,?,?,?,?,?,000002DC), ref: 6C63F114
Part of subcall function 6C63F031: ?u8to16@common@ierd_tgp@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@4@@Z.COMMON(?,?,?,?,?,?,?,?,000002DC), ref: 6C63F126
Part of subcall function 6C63F031: memset.VCRUNTIME140(?,00000000,00000208,?,?,?,?,?,?,?,?,000002DC), ref: 6C63F139
Part of subcall function 6C63F031: GetPrivateProfileStringW.KERNEL32(?,?,?,?), ref: 6C63F1A1
Part of subcall function 6C63F031: ?get_log_instance@base@@YAPAVILogger@1@XZ.COMMON(?,?,?,?,?,00000104,?,?,?,?,?,?), ref: 6C63F1AB

Memory Dump Source

Source File: 00000006.00000002.4141448948.000000006C591000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000006.00000002.4141374342.000000006C590000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142318714.000000006C825000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142662450.000000006C906000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142732140.000000006C907000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142791681.000000006C909000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142876110.000000006C911000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142956827.000000006C913000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143044653.000000006C91D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143105643.000000006C925000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c590000_wegame.jbxd

Similarity

API ID: D@std@@U?$char_traits@V?$allocator@V?$basic_string@$?u8to16@common@ierd_tgp@@D@2@@std@@U?$char_traits@_V?$allocator@_V?$basic_string@_W@2@@4@@W@std@@$H_prolog3_Private$?get_log_instance@base@@D@2@@std@@00Logger@1@ProfileProfile@ReadStringSys_wrapper@common@ierd_tgp@@V45@1@memcpymemset
String ID:
API String ID: 2990728887-0
Opcode ID: 7909e85a083134050c20a4849f4bebc4360ea2fba0af9366f715c2569ee5f524
Instruction ID: fa302dcc6efda7dc11105ada4872719046122334036890b576c7908e1df958dc
Opcode Fuzzy Hash: 7909e85a083134050c20a4849f4bebc4360ea2fba0af9366f715c2569ee5f524
Instruction Fuzzy Hash: B92137B1C05358EEDB10CFE8C8806DEBFB4AF09314F14506AE914B7780E7355A8ACBA5

Function 6C5C1FA9 Relevance: 3.1, APIs: 2, Instructions: 66COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6C5C1FB0
GetTickCount.KERNEL32 ref: 6C5C1FE6

Memory Dump Source

Source File: 00000006.00000002.4141448948.000000006C591000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000006.00000002.4141374342.000000006C590000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142318714.000000006C825000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142662450.000000006C906000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142732140.000000006C907000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142791681.000000006C909000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142876110.000000006C911000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142956827.000000006C913000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143044653.000000006C91D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143105643.000000006C925000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c590000_wegame.jbxd

Similarity

API ID: CountH_prolog3_Tick
String ID:
API String ID: 2349883465-0
Opcode ID: 326c07e3599abb7e424f41241637dfc1ec8b49888517ea8885b8feed72ff09cd
Instruction ID: 3abf7be3e9ca3164e1dd18493a75f804e10bc54f525be02697d8f1b02ffcd26e
Opcode Fuzzy Hash: 326c07e3599abb7e424f41241637dfc1ec8b49888517ea8885b8feed72ff09cd
Instruction Fuzzy Hash: 29219C30B04288DEEB15CBE0CC18BDD7BB0AF81308F18555ED041ABB91CBB99E49CB52

Function 6C62B2B3 Relevance: 3.1, APIs: 2, Instructions: 60sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000064), ref: 6C62B341
select.WS2_32(00000100,?,?,?,?), ref: 6C62B369

Memory Dump Source

Source File: 00000006.00000002.4141448948.000000006C591000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000006.00000002.4141374342.000000006C590000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142318714.000000006C825000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142662450.000000006C906000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142732140.000000006C907000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142791681.000000006C909000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142876110.000000006C911000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142956827.000000006C913000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143044653.000000006C91D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143105643.000000006C925000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c590000_wegame.jbxd

Similarity

API ID: Sleepselect
String ID:
API String ID: 3651608395-0
Opcode ID: e16c43817b8b86fd3a7945f837fa2cf68284c9fcf0a812610428b6ff49fe935c
Instruction ID: bbfad6e76fe82f2fb24ffa0c667562c00a2e5dd33cee8464fc1888011304a585
Opcode Fuzzy Hash: e16c43817b8b86fd3a7945f837fa2cf68284c9fcf0a812610428b6ff49fe935c
Instruction Fuzzy Hash: D321727191021C9BCB1ADF64CC44BDEB3BCEB09314F1042EEA11AE7580EA749B85CFA4

Function 00450F37 Relevance: 3.1, APIs: 2, Instructions: 59COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00450F41

Part of subcall function 00467A3B: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,0040CE31,7FFFFFFE,?), ref: 00467A50

_Open_dir.MSVCP140(?,?,?,?,?,?,?,00000000,Function_0005FAB3,00000218), ref: 00450FBD

Memory Dump Source

Source File: 00000006.00000002.4137209488.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.4137156906.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137406249.0000000000476000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137497400.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137574844.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137626631.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137684215.00000000004A3000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_wegame.jbxd

Similarity

API ID: H_prolog3_Open_dirmalloc
String ID:
API String ID: 1858716368-0
Opcode ID: 123f55cd98a8706ec7bebc4e309a737adb9a666c7c7c659c952a3550f23ac866
Instruction ID: d6bb794b45b5a7391e9c4ac68beefcd862c0194f30bfe624a3d9ccc41e127133
Opcode Fuzzy Hash: 123f55cd98a8706ec7bebc4e309a737adb9a666c7c7c659c952a3550f23ac866
Instruction Fuzzy Hash: 5121AEB1A00218DBCB21DF95C884ACEBBF8AF58304F10419FA04997242DB788E44CF99

Function 6C5C2078 Relevance: 3.1, APIs: 2, Instructions: 56COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6C5C207F
GetTickCount.KERNEL32 ref: 6C5C20C6

Memory Dump Source

Source File: 00000006.00000002.4141448948.000000006C591000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000006.00000002.4141374342.000000006C590000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142318714.000000006C825000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142662450.000000006C906000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142732140.000000006C907000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142791681.000000006C909000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142876110.000000006C911000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142956827.000000006C913000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143044653.000000006C91D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143105643.000000006C925000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c590000_wegame.jbxd

Similarity

API ID: CountH_prolog3_Tick
String ID:
API String ID: 2349883465-0
Opcode ID: e716a5d67b8c62d751d1e365285365525c9f0c64be9973e24cc9f7318ac420e3
Instruction ID: 885ed7a198713fb81638120ef0806d7373593debffe6b78208f0844f9b1b2557
Opcode Fuzzy Hash: e716a5d67b8c62d751d1e365285365525c9f0c64be9973e24cc9f7318ac420e3
Instruction Fuzzy Hash: A4218C31A04288EBDF16DBE0CD147DD7BB1AF91308F18415DD4426BB81DBB99E4ACB92

Function 00460589 Relevance: 3.0, APIs: 2, Instructions: 42COMMON

Download Yara Rule

APIs

_Read_dir.MSVCP140(?,F69FE839,?), ref: 004605B7
_Close_dir.MSVCP140(00000000), ref: 004605CA

Memory Dump Source

Source File: 00000006.00000002.4137209488.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.4137156906.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137406249.0000000000476000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137497400.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137574844.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137626631.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137684215.00000000004A3000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_wegame.jbxd

Similarity

API ID: Close_dirRead_dir
String ID:
API String ID: 543304316-0
Opcode ID: 11a28e5d4044b70e28804a20523a76b798d1b7aaeedfde320563cb5d7a6d3ad7
Instruction ID: 675adcbb75498aabfa24416117f51dd546774fc3446529a53f7021bef3da0441
Opcode Fuzzy Hash: 11a28e5d4044b70e28804a20523a76b798d1b7aaeedfde320563cb5d7a6d3ad7
Instruction Fuzzy Hash: 76014F71540118ABCF21DF59D8459AAB7F8EF14304F1104ABE44597260EAB45E84CF99

Function 6C613EE5 Relevance: 3.0, APIs: 2, Instructions: 35COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6C613EEC

Part of subcall function 6C616053: InterlockedCompareExchange.KERNEL32(6C924010,000000FF,00000000), ref: 6C616069
Part of subcall function 6C616053: memcpy.VCRUNTIME140(?,6C924000,00000010,6C924000,?,6C613F1C,?,00000018,6C613FB1,?,00000010), ref: 6C616086
Part of subcall function 6C616053: InterlockedExchange.KERNEL32(6C924010,00000001), ref: 6C616091

memcpy.VCRUNTIME140(?,?,00000010,?,00000018,6C613FB1,?,00000010), ref: 6C613F27

Memory Dump Source

Source File: 00000006.00000002.4141448948.000000006C591000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000006.00000002.4141374342.000000006C590000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142318714.000000006C825000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142662450.000000006C906000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142732140.000000006C907000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142791681.000000006C909000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142876110.000000006C911000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142956827.000000006C913000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143044653.000000006C91D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143105643.000000006C925000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c590000_wegame.jbxd

Similarity

API ID: ExchangeInterlockedmemcpy$CompareH_prolog3_
String ID:
API String ID: 3028338079-0
Opcode ID: 894e389aebcab2e2db77622d6f3d1e3562db441019d10271157bbc4fd51dbc5c
Instruction ID: ace930dc9f226ae0633fd9b536960ba10ec378ede85025a4f0e4eb1ab357f3fd
Opcode Fuzzy Hash: 894e389aebcab2e2db77622d6f3d1e3562db441019d10271157bbc4fd51dbc5c
Instruction Fuzzy Hash: 86F0F03180451CAADF00DBA8C9419DDF374AF0D20DF904565D602BBAA0EB309F0ECBA9

Function 6C6308F5 Relevance: 3.0, APIs: 2, Instructions: 28fileCOMMON

Download Yara Rule

APIs

CreateFileMappingW.KERNELBASE(000000FF,00000000,00000004,00000000,?,?,?,?,6C6308AB), ref: 6C630906
MapViewOfFile.KERNEL32(00000000,00000002,00000000,00000000,?,?,?,?,6C6308AB), ref: 6C63091B

Memory Dump Source

Source File: 00000006.00000002.4141448948.000000006C591000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000006.00000002.4141374342.000000006C590000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142318714.000000006C825000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142662450.000000006C906000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142732140.000000006C907000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142791681.000000006C909000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142876110.000000006C911000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142956827.000000006C913000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143044653.000000006C91D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143105643.000000006C925000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c590000_wegame.jbxd

Similarity

API ID: File$CreateMappingView
String ID:
API String ID: 3452162329-0
Opcode ID: 6d50ee0b5b64a89083501f1b31029e37ed11c87e318bd6e47df79ebdc27628f3
Instruction ID: 919584614fb4c78f0d580e3781bd02a092d510390d323a0485824327fef6029d
Opcode Fuzzy Hash: 6d50ee0b5b64a89083501f1b31029e37ed11c87e318bd6e47df79ebdc27628f3
Instruction Fuzzy Hash: 4DE012B22057516BDB350A669C0DE077EFDEFC6B30710D52DB565C25D4DA70D440CA64

Function 6C5CA858 Relevance: 3.0, APIs: 2, Instructions: 25COMMON

Download Yara Rule

APIs

Part of subcall function 6C5CA7EC: __EH_prolog3.LIBCMT ref: 6C5CA7F3
Part of subcall function 6C5CA7EC: ?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z.MSVCP140(00000008,?,?,00000008,6C5D4B76,00000008,?,?,00000000), ref: 6C5CA809
Part of subcall function 6C5CA7EC: ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ.MSVCP140(0000000F,00000000,00000001,?,?,?), ref: 6C5CA825

?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(00000002,00000000,00000000,6C5C6DB7,?,?,6C5CA8BF,?,00000032,00000040,00000024,6C5C90A6,?,?,?,00000004), ref: 6C5CA883
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(00000000,00000000,00000000,6C5C6DB7,?,?,6C5CA8BF,?,00000032,00000040,00000024,6C5C90A6,?,?,?,00000004), ref: 6C5CA88D

Memory Dump Source

Source File: 00000006.00000002.4141448948.000000006C591000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000006.00000002.4141374342.000000006C590000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142318714.000000006C825000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142662450.000000006C906000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142732140.000000006C907000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142791681.000000006C909000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142876110.000000006C911000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142956827.000000006C913000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143044653.000000006C91D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143105643.000000006C925000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c590000_wegame.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@?getloc@?$basic_streambuf@?setstate@?$basic_ios@Fiopen@std@@H_prolog3U_iobuf@@Vlocale@2@
String ID:
API String ID: 736196837-0
Opcode ID: c96c0d3b13123f443ebe28a46916e5f168a1d2f78c0a38fd0a700f2d7d838b32
Instruction ID: 81469ba63f2f86f0a125b317c65683d441104b6659859084e46e3a5098949a6b
Opcode Fuzzy Hash: c96c0d3b13123f443ebe28a46916e5f168a1d2f78c0a38fd0a700f2d7d838b32
Instruction Fuzzy Hash: D6E09234340314EBDB148F94CC49F9ABF78EB05718F00842CFA0986681CB319811CAD1

Function 6C630930 Relevance: 3.0, APIs: 2, Instructions: 24fileCOMMON

Download Yara Rule

APIs

OpenFileMappingW.KERNEL32(00000006,00000000,?,?,6C6308E1,?,6C630892), ref: 6C630939
MapViewOfFile.KERNEL32(00000000,00000002,00000000,00000000,00000000,?,?,6C6308E1,?,6C630892), ref: 6C630952

Memory Dump Source

Source File: 00000006.00000002.4141448948.000000006C591000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000006.00000002.4141374342.000000006C590000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142318714.000000006C825000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142662450.000000006C906000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142732140.000000006C907000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142791681.000000006C909000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142876110.000000006C911000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142956827.000000006C913000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143044653.000000006C91D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143105643.000000006C925000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c590000_wegame.jbxd

Similarity

API ID: File$MappingOpenView
String ID:
API String ID: 3439327939-0
Opcode ID: 87e72291bf64e2a87c5e08b0cc4e01d79fcb887e12b3d478fbe8e6168b6f370e
Instruction ID: af5dc86959a2e31ed815bb6599e17cc55da8ec2bc8d873704e0f0d3c374fde5d
Opcode Fuzzy Hash: 87e72291bf64e2a87c5e08b0cc4e01d79fcb887e12b3d478fbe8e6168b6f370e
Instruction Fuzzy Hash: C2E086713807116BEB300B68AC0AF4676E49F08730F10C42EB556DA5C4D6B0D8509A84

Function 0044ECB5 Relevance: 3.0, APIs: 2, Instructions: 18COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0044ECBC

Part of subcall function 0044C460: __EH_prolog3.LIBCMT ref: 0044C467

Part of subcall function 0044C39E: __EH_prolog3.LIBCMT ref: 0044C3A5

_CxxThrowException.VCRUNTIME140(?,0049371C,?,00000054,?,00493640,?,00000054,0044EDF6,00000000,?,?,-00000030,?,00000000,00000030), ref: 0044ECE7

Memory Dump Source

Source File: 00000006.00000002.4137209488.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.4137156906.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137406249.0000000000476000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137497400.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137574844.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137626631.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137684215.00000000004A3000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_wegame.jbxd

Similarity

API ID: H_prolog3$ExceptionThrow
String ID:
API String ID: 2323905274-0
Opcode ID: cf5341fc4ef6eaf046c02b7a315e76972d4351963195febe9eabe241d8bea922
Instruction ID: fb04dd8227efe9270f002b1c281e68caa89853755b8f71f55e303d32d0b17674
Opcode Fuzzy Hash: cf5341fc4ef6eaf046c02b7a315e76972d4351963195febe9eabe241d8bea922
Instruction Fuzzy Hash: 80E0ECB294220CB6DF00FAE1CC8AEEE766CAB0030DF18481A7208A6042E63D96184A19

Function 6C5D4464 Relevance: 3.0, APIs: 2, Instructions: 18COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C5D446B

Part of subcall function 6C5D2D47: __EH_prolog3.LIBCMT ref: 6C5D2D4E

Part of subcall function 6C5D2CE7: __EH_prolog3.LIBCMT ref: 6C5D2CEE

_CxxThrowException.VCRUNTIME140(?,6C8CBFF0,?,00000054,?,6C8CC078,?,000000B4,6C5D4507,00000000), ref: 6C5D4496

Memory Dump Source

Source File: 00000006.00000002.4141448948.000000006C591000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000006.00000002.4141374342.000000006C590000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142318714.000000006C825000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142662450.000000006C906000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142732140.000000006C907000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142791681.000000006C909000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142876110.000000006C911000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142956827.000000006C913000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143044653.000000006C91D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143105643.000000006C925000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c590000_wegame.jbxd

Similarity

API ID: H_prolog3$ExceptionThrow
String ID:
API String ID: 2323905274-0
Opcode ID: 29d4b8f690c57638409536bdaf400e6238b9dc67bde8918d86973494538679f0
Instruction ID: 44903ff81c088c7858ff44ae92773a60960093101127dca8ae6ce602dfb63139
Opcode Fuzzy Hash: 29d4b8f690c57638409536bdaf400e6238b9dc67bde8918d86973494538679f0
Instruction Fuzzy Hash: 07E0EC72D1420DA6DF00EBE4CD4CEDE726D6F14208F044C156114AAA11DB35AE0D5A25

Function 6C5B75A2 Relevance: 3.0, APIs: 2, Instructions: 12COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C5B75A9
?get_first_mac@common@ierd_tgp@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ.COMMON(?,?,?,?,?,00000004), ref: 6C5B75B5

Part of subcall function 6C61722F: __EH_prolog3_catch_GS.LIBCMT ref: 6C617239

Memory Dump Source

Source File: 00000006.00000002.4141448948.000000006C591000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000006.00000002.4141374342.000000006C590000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142318714.000000006C825000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142662450.000000006C906000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142732140.000000006C907000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142791681.000000006C909000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142876110.000000006C911000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142956827.000000006C913000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143044653.000000006C91D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143105643.000000006C925000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c590000_wegame.jbxd

Similarity

API ID: ?get_first_mac@common@ierd_tgp@@D@2@@std@@D@std@@H_prolog3H_prolog3_catch_U?$char_traits@V?$allocator@V?$basic_string@
String ID:
API String ID: 3954339525-0
Opcode ID: 92c227eb9606e319c572a6e4b51a7f63c0e067a6721510b602da1c8fad56ca39
Instruction ID: 3149c6c714f31b5790e9b8209d08129f7001e7bed3a84200e56ba067728d55ac
Opcode Fuzzy Hash: 92c227eb9606e319c572a6e4b51a7f63c0e067a6721510b602da1c8fad56ca39
Instruction Fuzzy Hash: 41D0C9715101099BEF009FA4C8057DD76B0BF4171EF545414E5205EBA0CBBA9E4ACB8C

Function 6C5DA614 Relevance: 1.6, APIs: 1, Instructions: 135COMMON

Download Yara Rule

APIs

__EH_prolog3_catch_GS.LIBCMT ref: 6C5DA61E

Part of subcall function 6C5ACEF4: memcpy.VCRUNTIME140(00000000,?,?,00000001,?,?,?,?,?,?,6C5AA734,?,00000004,6C5AA09E,?,9C33995A), ref: 6C5ACF53

Part of subcall function 6C5A9A0E: __EH_prolog3.LIBCMT ref: 6C5A9A15

Part of subcall function 6C5DA7E6: __EH_prolog3_GS.LIBCMT ref: 6C5DA7F0
Part of subcall function 6C5DA7E6: ?u16to8@common@ierd_tgp@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@4@@Z.COMMON(?,00000000,?,?,?,00000000,00000200,6C5DA71B,?,?,00000000,?,000000A0,6C5D7256,?), ref: 6C5DA890
Part of subcall function 6C5DA7E6: ?decode_stream@common@ierd_tgp@@YA?AV?$optional@V?$reference_wrapper@V?$basic_istringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@std@@@std@@AAV?$basic_istream@DU?$char_traits@D@std@@@4@AAV?$basic_istringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@4@@Z.COMMON(?,?,?,00000001,00000001,?,00000020,00000040,00000001,?,?,?,?,00000000,00000200,6C5DA71B), ref: 6C5DA904
Part of subcall function 6C5DA7E6: ?get_log_instance@base@@YAPAVILogger@1@XZ.COMMON(?,?,?), ref: 6C5DA913

Memory Dump Source

Source File: 00000006.00000002.4141448948.000000006C591000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000006.00000002.4141374342.000000006C590000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142318714.000000006C825000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142662450.000000006C906000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142732140.000000006C907000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142791681.000000006C909000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142876110.000000006C911000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142956827.000000006C913000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143044653.000000006C91D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143105643.000000006C925000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c590000_wegame.jbxd

Similarity

API ID: U?$char_traits@$D@std@@V?$allocator@$D@2@@4@@V?$basic_istringstream@$?decode_stream@common@ierd_tgp@@?get_log_instance@base@@?u16to8@common@ierd_tgp@@D@2@@std@@@std@@@std@@D@std@@@4@H_prolog3H_prolog3_H_prolog3_catch_Logger@1@U?$char_traits@_V?$allocator@_V?$basic_istream@V?$basic_string@V?$basic_string@_V?$optional@V?$reference_wrapper@W@2@@std@@W@std@@memcpy
String ID:
API String ID: 4167492144-0
Opcode ID: dc5643745c96132c84da9ee763e804b4ff0fc16ea4c0cff956214444e746efcf
Instruction ID: ee9d79f7f4575fe59ac8b7da84fe91bb7617ca6c3b13e7a6da19027d9a38cd49
Opcode Fuzzy Hash: dc5643745c96132c84da9ee763e804b4ff0fc16ea4c0cff956214444e746efcf
Instruction Fuzzy Hash: 78518D7080438CEACF05DBA8CD40BDDBBB4AF55308F554099E045A7691DB706F4DCB66

Function 6C69E4B0 Relevance: 1.6, APIs: 1, Instructions: 102COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,00000000,?,6C69EF5B,00000000,00000000,?,?,?,00000000,?,00000000,?,?,00000000,?), ref: 6C69E511

Memory Dump Source

Source File: 00000006.00000002.4141448948.000000006C591000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000006.00000002.4141374342.000000006C590000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142318714.000000006C825000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142662450.000000006C906000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142732140.000000006C907000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142791681.000000006C909000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142876110.000000006C911000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142956827.000000006C913000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143044653.000000006C91D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143105643.000000006C925000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c590000_wegame.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: 38d6dacc7db169f30b8363b67c84c7e665dae89f5c6c33179b81d43b2e6d5bf0
Instruction ID: b5a1be61328ccbe615adf5659c80ae5fd7dc3a61f222c0448b7d7b7efa069f24
Opcode Fuzzy Hash: 38d6dacc7db169f30b8363b67c84c7e665dae89f5c6c33179b81d43b2e6d5bf0
Instruction Fuzzy Hash: EA2128735015125BD7108E1CDC4079DB3A5FF41369F258719E97897B80E772ED8087D8

Function 0043F2BB Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

__EH_prolog3_catch_GS.LIBCMT ref: 0043F2C2

Part of subcall function 0043F52C: __stdio_common_vsprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,?,00000000,?), ref: 0043F54B

Memory Dump Source

Source File: 00000006.00000002.4137209488.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.4137156906.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137406249.0000000000476000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137497400.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137574844.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137626631.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137684215.00000000004A3000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_wegame.jbxd

Similarity

API ID: H_prolog3_catch___stdio_common_vsprintf
String ID:
API String ID: 2700776485-0
Opcode ID: ef55414255651ae28f6947fc2191b45f377bec7a8bc96d72c4006e1d3ba3ce01
Instruction ID: a01793549ff6bee8cb8b9be72e83f0c1bfbcc773d372da5ed327e987202eff2d
Opcode Fuzzy Hash: ef55414255651ae28f6947fc2191b45f377bec7a8bc96d72c4006e1d3ba3ce01
Instruction Fuzzy Hash: 8F115E71D04209EBCF00DFE9C8915EEBBB4BF18314FA4842EE525A7142D6389A08CF65

Function 6C5AE945 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

__EH_prolog3_catch_GS.LIBCMT ref: 6C5AE94C

Part of subcall function 6C5AFB37: __stdio_common_vsprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,00000000,00000000,?,?,6C5AE9A3,?,?,?,00000010,?,00000000,00000020), ref: 6C5AFB56

Memory Dump Source

Source File: 00000006.00000002.4141448948.000000006C591000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000006.00000002.4141374342.000000006C590000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142318714.000000006C825000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142662450.000000006C906000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142732140.000000006C907000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142791681.000000006C909000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142876110.000000006C911000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142956827.000000006C913000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143044653.000000006C91D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143105643.000000006C925000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c590000_wegame.jbxd

Similarity

API ID: H_prolog3_catch___stdio_common_vsprintf
String ID:
API String ID: 2700776485-0
Opcode ID: c8cf660e54a4c2e9eb2a2b696fb4e1ebccfba201f5cf295389699f3459d8e8b0
Instruction ID: f3a736946b0e312daee17e629246768b58b319babe9904331e0dc0da2ecb995f
Opcode Fuzzy Hash: c8cf660e54a4c2e9eb2a2b696fb4e1ebccfba201f5cf295389699f3459d8e8b0
Instruction Fuzzy Hash: D0110772D00289EEDF01DFE9CC909DEBBB4AF59344FA48569E125A7640D7309A09CBA1

Function 6C62A127 Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C62A12E

Part of subcall function 6C6ABEB5: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,6C5A621D,0000002C,0000000C,6C5A5702,00000004,6C5A57B1,00000214), ref: 6C6ABECA

Part of subcall function 6C6298F3: __EH_prolog3.LIBCMT ref: 6C6298FA

Memory Dump Source

Source File: 00000006.00000002.4141448948.000000006C591000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000006.00000002.4141374342.000000006C590000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142318714.000000006C825000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142662450.000000006C906000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142732140.000000006C907000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142791681.000000006C909000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142876110.000000006C911000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142956827.000000006C913000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143044653.000000006C91D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143105643.000000006C925000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c590000_wegame.jbxd

Similarity

API ID: H_prolog3$malloc
String ID:
API String ID: 1703742926-0
Opcode ID: 57bd4221569cba2f70fa35afe4aa330e4b78f6a8d41aa7daa3483d916be3a3e8
Instruction ID: 47f13cf6dd016df26a27f7a94537807e3302ee655d284d946c0d42d18c63cb08
Opcode Fuzzy Hash: 57bd4221569cba2f70fa35afe4aa330e4b78f6a8d41aa7daa3483d916be3a3e8
Instruction Fuzzy Hash: 06016DB090130BDFDB04DFE489502EEB7B1AF84718F20452DD121A7B81DB784A0ACF5A

Function 6C6C6EE0 Relevance: 1.5, APIs: 1, Instructions: 42COMMON

Download Yara Rule

APIs

closesocket.WS2_32(?), ref: 6C6C6F17

Memory Dump Source

Source File: 00000006.00000002.4141448948.000000006C591000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000006.00000002.4141374342.000000006C590000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142318714.000000006C825000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142662450.000000006C906000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142732140.000000006C907000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142791681.000000006C909000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142876110.000000006C911000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142956827.000000006C913000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143044653.000000006C91D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143105643.000000006C925000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c590000_wegame.jbxd

Similarity

API ID: closesocket
String ID:
API String ID: 2781271927-0
Opcode ID: 243192b01f44691bdd218b96ed6d9cd2e31d8553032df2d44d561e01f1d0ee96
Instruction ID: f64c8c1989cc190f1dc7b3adbcb756fc5c70b9ff0cee4a89dd70441b638f375a
Opcode Fuzzy Hash: 243192b01f44691bdd218b96ed6d9cd2e31d8553032df2d44d561e01f1d0ee96
Instruction Fuzzy Hash: 1EF0A4327155207BDB225625EC04BEABB66FF82329F140015F524B3640C331B465C7DE

Function 6C5B3A28 Relevance: 1.5, APIs: 1, Instructions: 38COMMON

Download Yara Rule

APIs

_beginthreadex.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,00000000,6C5B3AE5,?,?,?), ref: 6C5B3A59

Memory Dump Source

Source File: 00000006.00000002.4141448948.000000006C591000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000006.00000002.4141374342.000000006C590000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142318714.000000006C825000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142662450.000000006C906000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142732140.000000006C907000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142791681.000000006C909000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142876110.000000006C911000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142956827.000000006C913000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143044653.000000006C91D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143105643.000000006C925000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c590000_wegame.jbxd

Similarity

API ID: _beginthreadex
String ID:
API String ID: 3014514943-0
Opcode ID: 93c20767cbdc6fca0ea9e298759ff787df38683d7f352c3e0d0492faae0dade5
Instruction ID: ff6464a71b2c0886eb2d8caba47b04981da0f1f5004372e6bbbc41f8b21bb1ce
Opcode Fuzzy Hash: 93c20767cbdc6fca0ea9e298759ff787df38683d7f352c3e0d0492faae0dade5
Instruction Fuzzy Hash: 9DF09672614605BB9704DF29CC45853FFE9FE85324320C73AA429E3A40E730E155CBE0

Function 6C5C69F0 Relevance: 1.5, APIs: 1, Instructions: 36COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C5C69F7

Part of subcall function 6C5C6A7D: memset.VCRUNTIME140 ref: 6C5C6AAE

Part of subcall function 6C5CA2A5: __EH_prolog3_GS.LIBCMT ref: 6C5CA2AC
Part of subcall function 6C5CA2A5: _time64.API-MS-WIN-CRT-TIME-L1-1-0(00000000,0000001C,6C5C6A6F), ref: 6C5CA2C7

Memory Dump Source

Source File: 00000006.00000002.4141448948.000000006C591000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000006.00000002.4141374342.000000006C590000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142318714.000000006C825000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142662450.000000006C906000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142732140.000000006C907000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142791681.000000006C909000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142876110.000000006C911000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142956827.000000006C913000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143044653.000000006C91D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143105643.000000006C925000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c590000_wegame.jbxd

Similarity

API ID: H_prolog3H_prolog3__time64memset
String ID:
API String ID: 3469414599-0
Opcode ID: f0f4714c2c2f9f166fab7f566eac752c66c87ceb0e0caaf41942d07f31f80c89
Instruction ID: b76d5dfb06d18b4e8d00693adb5d9234dd2c1ea64ab47ade3669c464b3b1ea47
Opcode Fuzzy Hash: f0f4714c2c2f9f166fab7f566eac752c66c87ceb0e0caaf41942d07f31f80c89
Instruction Fuzzy Hash: 5C011771945B84CAC321CFA984407CAFFF1BF69200F54895ED0EA97761C7706A09CB66

Function 6C5C2BE9 Relevance: 1.5, APIs: 1, Instructions: 35COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6C5C2BF0

Memory Dump Source

Source File: 00000006.00000002.4141448948.000000006C591000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000006.00000002.4141374342.000000006C590000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142318714.000000006C825000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142662450.000000006C906000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142732140.000000006C907000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142791681.000000006C909000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142876110.000000006C911000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142956827.000000006C913000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143044653.000000006C91D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143105643.000000006C925000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c590000_wegame.jbxd

Similarity

API ID: H_prolog3_
String ID:
API String ID: 2427045233-0
Opcode ID: 6dbe8f66bb74a1d9626c8fb6492bdca02ec8801e9128e7286c19f7f5cd8e3874
Instruction ID: 895e59360e4849541d5bae99f6b657912a27461b8a2ea6392dea1b63a433246e
Opcode Fuzzy Hash: 6dbe8f66bb74a1d9626c8fb6492bdca02ec8801e9128e7286c19f7f5cd8e3874
Instruction Fuzzy Hash: 4001EE75901208EFCF04DF94D8809DDBBB1FF89324F148059E921A73A0C730AA16CF64

Function 6C5C467D Relevance: 1.5, APIs: 1, Instructions: 34COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C5C4684

Part of subcall function 6C6ABEB5: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,6C5A621D,0000002C,0000000C,6C5A5702,00000004,6C5A57B1,00000214), ref: 6C6ABECA

Memory Dump Source

Source File: 00000006.00000002.4141448948.000000006C591000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000006.00000002.4141374342.000000006C590000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142318714.000000006C825000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142662450.000000006C906000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142732140.000000006C907000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142791681.000000006C909000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142876110.000000006C911000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142956827.000000006C913000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143044653.000000006C91D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143105643.000000006C925000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c590000_wegame.jbxd

Similarity

API ID: H_prolog3malloc
String ID:
API String ID: 266865037-0
Opcode ID: 41d66db008a84b62aec910faf6d7909d61aac7d424c195e0fa0006f608a2d2a5
Instruction ID: 60133b48009e54d910a6c3659322a76b9b4e42ca431c41ca82ca9cdc04185057
Opcode Fuzzy Hash: 41d66db008a84b62aec910faf6d7909d61aac7d424c195e0fa0006f608a2d2a5
Instruction Fuzzy Hash: 83F03CB0A01219DFCB05CFA8C9408ADBBF1BF49700B54C46EA804AB351D7708E15DB55

Function 0044EDF7 Relevance: 1.5, APIs: 1, Instructions: 33COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0044EDFE

Part of subcall function 0044C4ED: __EH_prolog3.LIBCMT ref: 0044C4F4

Part of subcall function 0044ECB5: __EH_prolog3.LIBCMT ref: 0044ECBC
Part of subcall function 0044ECB5: _CxxThrowException.VCRUNTIME140(?,0049371C,?,00000054,?,00493640,?,00000054,0044EDF6,00000000,?,?,-00000030,?,00000000,00000030), ref: 0044ECE7

Memory Dump Source

Source File: 00000006.00000002.4137209488.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.4137156906.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137406249.0000000000476000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137497400.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137574844.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137626631.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137684215.00000000004A3000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_wegame.jbxd

Similarity

API ID: H_prolog3$ExceptionThrow
String ID:
API String ID: 2323905274-0
Opcode ID: f86cea1874dbc7e03cb912fd7ea8a96aff086da37a66f3db668f96b5d8776a4f
Instruction ID: 201edea789e3cc5b685ab91c4320bcb1cac5f82bca75afaf91184821e18b345a
Opcode Fuzzy Hash: f86cea1874dbc7e03cb912fd7ea8a96aff086da37a66f3db668f96b5d8776a4f
Instruction Fuzzy Hash: 2CF036B4D0020E77DF01FBF2CC95E9E366DAF0435DF00441AB40167242D97DA5148668

Function 6C5D4508 Relevance: 1.5, APIs: 1, Instructions: 33COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C5D450F

Part of subcall function 6C5D2DA5: __EH_prolog3.LIBCMT ref: 6C5D2DAC

Part of subcall function 6C5D4464: __EH_prolog3.LIBCMT ref: 6C5D446B
Part of subcall function 6C5D4464: _CxxThrowException.VCRUNTIME140(?,6C8CBFF0,?,00000054,?,6C8CC078,?,000000B4,6C5D4507,00000000), ref: 6C5D4496

Memory Dump Source

Source File: 00000006.00000002.4141448948.000000006C591000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000006.00000002.4141374342.000000006C590000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142318714.000000006C825000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142662450.000000006C906000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142732140.000000006C907000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142791681.000000006C909000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142876110.000000006C911000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142956827.000000006C913000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143044653.000000006C91D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143105643.000000006C925000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c590000_wegame.jbxd

Similarity

API ID: H_prolog3$ExceptionThrow
String ID:
API String ID: 2323905274-0
Opcode ID: 33f659a6722a6e6f4ffb54a6c9a6209b14c7aa1462a2aa11696534f0423f0bf8
Instruction ID: 3e5b0e57a1c4797b59f8eae7d3e082ddbe7ac3c69b72c5ebd02636c338cc7510
Opcode Fuzzy Hash: 33f659a6722a6e6f4ffb54a6c9a6209b14c7aa1462a2aa11696534f0423f0bf8
Instruction Fuzzy Hash: BAF05EB4C0420BE7DF05ABF1CC58EDF76ACEF98258F004815B510B3B41EB369E1A8A65

Function 6C59A3A0 Relevance: 1.5, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,6C5A62D8,00000000,6C5A6649,00000003,9C33995A,?,?,00000000,6C7FF594,000000FF,?,6C5A5B05,00000000), ref: 6C59A3E5

Memory Dump Source

Source File: 00000006.00000002.4141448948.000000006C591000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000006.00000002.4141374342.000000006C590000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142318714.000000006C825000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142662450.000000006C906000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142732140.000000006C907000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142791681.000000006C909000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142876110.000000006C911000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142956827.000000006C913000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143044653.000000006C91D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143105643.000000006C925000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c590000_wegame.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: 67954d373ce27371d53d7ee79284a63889e98b8dfb0805e4771f8a1ea64cfa05
Instruction ID: 0a5ffbae7a9b084dd1e3eea6d8355bfc0c1d25923a41a606ca3ed210f9a64647
Opcode Fuzzy Hash: 67954d373ce27371d53d7ee79284a63889e98b8dfb0805e4771f8a1ea64cfa05
Instruction Fuzzy Hash: CEE065315112405BE3388E28EC9876D76A6EB42315F640B5CE0828BE85D774998587A5

Function 6C5B767D Relevance: 1.5, APIs: 1, Instructions: 30COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6C5B7684

Part of subcall function 6C5B6164: __EH_prolog3_GS.LIBCMT ref: 6C5B616B
Part of subcall function 6C5B6164: CryptAcquireContextW.ADVAPI32(?,00000000,00000000,00000001,F0000040,00000034,6C5B769A,0000001C,6C5B5A2D,?,?,?,000000D4,6C5B4690,?,?), ref: 6C5B6180

Part of subcall function 6C5B75CF: __EH_prolog3_GS.LIBCMT ref: 6C5B75D6
Part of subcall function 6C5B75CF: CryptGenRandom.ADVAPI32(?,?,?,00000034,6C5B76AF,?,00000010,0000001C,6C5B5A2D,?,?,?,000000D4,6C5B4690,?,?), ref: 6C5B75E4

Part of subcall function 6C5B66FC: CryptReleaseContext.ADVAPI32(00000000,00000000,9C33995A,00000000,00000000,6C801C74,000000FF,?,6C5B76CE,?,00000010,0000001C,6C5B5A2D,?,?,?), ref: 6C5B672F

Memory Dump Source

Source File: 00000006.00000002.4141448948.000000006C591000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000006.00000002.4141374342.000000006C590000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142318714.000000006C825000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142662450.000000006C906000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142732140.000000006C907000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142791681.000000006C909000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142876110.000000006C911000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142956827.000000006C913000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143044653.000000006C91D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143105643.000000006C925000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c590000_wegame.jbxd

Similarity

API ID: CryptH_prolog3_$Context$AcquireRandomRelease
String ID:
API String ID: 3909388945-0
Opcode ID: e63ae22e4026f00fb1d10196356b400641e07794f57e5645571f392b249cbbb3
Instruction ID: e6f304a0f0f05cb93d56a1226131237ced49700535fbda0d126897f1017a141e
Opcode Fuzzy Hash: e63ae22e4026f00fb1d10196356b400641e07794f57e5645571f392b249cbbb3
Instruction Fuzzy Hash: 38F03A7290060CDBDF04CFA4CD55ACD77B4AF49354F648565E400BB6D0EB759E09CB68

Function 6C5EF85A Relevance: 1.5, APIs: 1, Instructions: 28timeCOMMON

Download Yara Rule

APIs

SetWaitableTimer.KERNEL32(?,?,?,00000000,00000000,00000000,?,?,?,?,?,?,00000000), ref: 6C5EF887

Memory Dump Source

Source File: 00000006.00000002.4141448948.000000006C591000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000006.00000002.4141374342.000000006C590000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142318714.000000006C825000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142662450.000000006C906000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142732140.000000006C907000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142791681.000000006C909000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142876110.000000006C911000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142956827.000000006C913000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143044653.000000006C91D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143105643.000000006C925000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c590000_wegame.jbxd

Similarity

API ID: TimerWaitable
String ID:
API String ID: 1823812067-0
Opcode ID: 9e19a2b015e2b60860e0a9f2a57323a6b0f39fa777c2d4b1e3f8cb85310c1c6b
Instruction ID: b25734ad01f1d976c9ecfdceb608d280fe3ce0a2fe5615132200747c5e56dc95
Opcode Fuzzy Hash: 9e19a2b015e2b60860e0a9f2a57323a6b0f39fa777c2d4b1e3f8cb85310c1c6b
Instruction Fuzzy Hash: C4E0C97180112DBB8F10EF95DC49CDF7FBCFF09694B004555B5099B155D6309615CBE0

Function 6C5C3915 Relevance: 1.5, APIs: 1, Instructions: 27COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C5C391C

Memory Dump Source

Source File: 00000006.00000002.4141448948.000000006C591000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000006.00000002.4141374342.000000006C590000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142318714.000000006C825000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142662450.000000006C906000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142732140.000000006C907000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142791681.000000006C909000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142876110.000000006C911000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142956827.000000006C913000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143044653.000000006C91D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143105643.000000006C925000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c590000_wegame.jbxd

Similarity

API ID: H_prolog3
String ID:
API String ID: 431132790-0
Opcode ID: 1a43e2e223bf990681aff1dd502700892e6f92c13de79d0b4a72907eee31be5f
Instruction ID: ffc5b8f37df10701605ee16828c3586ee88447662a868f6ecb1c76e2ddde7aee
Opcode Fuzzy Hash: 1a43e2e223bf990681aff1dd502700892e6f92c13de79d0b4a72907eee31be5f
Instruction Fuzzy Hash: CBF01772D0021D9BEF01DFD4C8027EEBBB0FF44325F540408E8006B650D7B69A488B95

Function 00447C82 Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00447C89

Memory Dump Source

Source File: 00000006.00000002.4137209488.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.4137156906.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137406249.0000000000476000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137497400.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137574844.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137626631.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137684215.00000000004A3000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_wegame.jbxd

Similarity

API ID: H_prolog3
String ID:
API String ID: 431132790-0
Opcode ID: 2dac377976ec124f3b5c640a9a2ee1bec90f4431586fe2ed784e0f155bbad409
Instruction ID: 4695664a0ddad82fd71f6b45eecc12ba30f2cfbb68d605700a7f35ec129a9b4e
Opcode Fuzzy Hash: 2dac377976ec124f3b5c640a9a2ee1bec90f4431586fe2ed784e0f155bbad409
Instruction Fuzzy Hash: 74F09A70600208DFCB11DFA8C94898E7BF1BF08318F10854EF5408B2A1C376DE01CB54

Function 6C5D49FD Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C5D4A04

Memory Dump Source

Source File: 00000006.00000002.4141448948.000000006C591000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000006.00000002.4141374342.000000006C590000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142318714.000000006C825000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142662450.000000006C906000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142732140.000000006C907000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142791681.000000006C909000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142876110.000000006C911000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142956827.000000006C913000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143044653.000000006C91D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143105643.000000006C925000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c590000_wegame.jbxd

Similarity

API ID: H_prolog3
String ID:
API String ID: 431132790-0
Opcode ID: 51d118ca95f77cd7de10f01526cd704e07f2764961d300a3c8df9e4e749da978
Instruction ID: 0fe1679debd3af161aae2182bf9aefe61319470cda14b1ef456e09b5823f892a
Opcode Fuzzy Hash: 51d118ca95f77cd7de10f01526cd704e07f2764961d300a3c8df9e4e749da978
Instruction Fuzzy Hash: 4EF01775601209DFDB21CFA8C944A897BB1FF08314F518589F5509B7A1C372DE15CB98

Function 6C5C187E Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C5C1885

Part of subcall function 6C5B5524: __EH_prolog3.LIBCMT ref: 6C5B552B

Part of subcall function 6C5C2078: __EH_prolog3_GS.LIBCMT ref: 6C5C207F
Part of subcall function 6C5C2078: GetTickCount.KERNEL32 ref: 6C5C20C6

Memory Dump Source

Source File: 00000006.00000002.4141448948.000000006C591000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000006.00000002.4141374342.000000006C590000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142318714.000000006C825000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142662450.000000006C906000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142732140.000000006C907000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142791681.000000006C909000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142876110.000000006C911000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142956827.000000006C913000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143044653.000000006C91D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143105643.000000006C925000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c590000_wegame.jbxd

Similarity

API ID: H_prolog3$CountH_prolog3_Tick
String ID:
API String ID: 1641273540-0
Opcode ID: d488482c62358c76d6d942b14b3085bf06a705dde149374cfac8957d7471386b
Instruction ID: 60260dc126d0f7b4565cba07cc157cbb882c15c3f3779b7c5264fcefd5522951
Opcode Fuzzy Hash: d488482c62358c76d6d942b14b3085bf06a705dde149374cfac8957d7471386b
Instruction Fuzzy Hash: 2CF03031611248FBCF45EBF4CA157CD7A606F85254F805148F4006B690DB368E49DB96

Function 6C6298F3 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C6298FA

Part of subcall function 6C629B3F: __EH_prolog3.LIBCMT ref: 6C629B46

Part of subcall function 6C5BF906: __EH_prolog3_GS.LIBCMT ref: 6C5BF90D

Memory Dump Source

Source File: 00000006.00000002.4141448948.000000006C591000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000006.00000002.4141374342.000000006C590000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142318714.000000006C825000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142662450.000000006C906000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142732140.000000006C907000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142791681.000000006C909000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142876110.000000006C911000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142956827.000000006C913000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143044653.000000006C91D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143105643.000000006C925000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c590000_wegame.jbxd

Similarity

API ID: H_prolog3$H_prolog3_
String ID:
API String ID: 4240126716-0
Opcode ID: 55f9b05ded7e9fc10ef0579875cbc9d55bc5638f2d18733141faac186240526d
Instruction ID: 4528aa5f3e41b09f5e9f6b393c1e904cbe09f4d74a76781b17cfa0acd315ef6f
Opcode Fuzzy Hash: 55f9b05ded7e9fc10ef0579875cbc9d55bc5638f2d18733141faac186240526d
Instruction Fuzzy Hash: 1FE0ED71A00219CBD704CFA8C442ADEFBB0AF48324F10431AE110AB390CB388F068BCC

Function 6C6BED80 Relevance: 1.5, APIs: 1, Instructions: 23networkCOMMON

Download Yara Rule

APIs

socket.WS2_32(00000017,00000002,00000000), ref: 6C6BED90

Memory Dump Source

Source File: 00000006.00000002.4141448948.000000006C591000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000006.00000002.4141374342.000000006C590000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142318714.000000006C825000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142662450.000000006C906000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142732140.000000006C907000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142791681.000000006C909000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142876110.000000006C911000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142956827.000000006C913000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143044653.000000006C91D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143105643.000000006C925000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c590000_wegame.jbxd

Similarity

API ID: socket
String ID:
API String ID: 98920635-0
Opcode ID: e9918ca9dfefe7eb5b5825513226d36435f23d53e65fb06a01344ff85f7a967c
Instruction ID: 1e43ec698c40a7eb7dbb80fd750de260562f43147985342f6e2928e4ed67ebdd
Opcode Fuzzy Hash: e9918ca9dfefe7eb5b5825513226d36435f23d53e65fb06a01344ff85f7a967c
Instruction Fuzzy Hash: EBE04F343592046EEB009639CD07B6531B5DB033B8F648310F528D9AC0D7B1D820DB85

Function 6C5CBAE9 Relevance: 1.5, APIs: 1, Instructions: 21COMMON

Download Yara Rule

APIs

fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C5CBB03

Memory Dump Source

Source File: 00000006.00000002.4141448948.000000006C591000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000006.00000002.4141374342.000000006C590000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142318714.000000006C825000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142662450.000000006C906000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142732140.000000006C907000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142791681.000000006C909000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142876110.000000006C911000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142956827.000000006C913000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143044653.000000006C91D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143105643.000000006C925000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c590000_wegame.jbxd

Similarity

API ID: fflush
String ID:
API String ID: 497872470-0
Opcode ID: 6e7b6ed4781bdb7ee27d12da7f48c03453f94ab42fddb3983050c4171e9bda77
Instruction ID: d6238cc3dc617bb39ea608d9ad7f7ff0c82f2d8e602d9076a72bed7d04849bbf
Opcode Fuzzy Hash: 6e7b6ed4781bdb7ee27d12da7f48c03453f94ab42fddb3983050c4171e9bda77
Instruction Fuzzy Hash: FFE0C2313015108BE3212A1AEC08E66B3FAEBC1239B21462EF161C28D8C770C802DB51

Function 0044A9DB Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0044A9E2

Memory Dump Source

Source File: 00000006.00000002.4137209488.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.4137156906.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137406249.0000000000476000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137497400.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137574844.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137626631.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137684215.00000000004A3000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_wegame.jbxd

Similarity

API ID: H_prolog3
String ID:
API String ID: 431132790-0
Opcode ID: 261d38a29d9c9fee2bb54d4449809139455961f204fb28188f2ea970f9de8f6a
Instruction ID: d4ce2dc5aabb3bb2516233e4d9af7136cc9597ee843a3a386ed1855b91315c2a
Opcode Fuzzy Hash: 261d38a29d9c9fee2bb54d4449809139455961f204fb28188f2ea970f9de8f6a
Instruction Fuzzy Hash: FFE0ED719102089FCF04AF98C9063AD3B62BF84329F64458DE8106B2C1D778EA159BD6

Function 6C5D7214 Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C5D721B

Part of subcall function 6C5DA614: __EH_prolog3_catch_GS.LIBCMT ref: 6C5DA61E

Memory Dump Source

Source File: 00000006.00000002.4141448948.000000006C591000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000006.00000002.4141374342.000000006C590000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142318714.000000006C825000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142662450.000000006C906000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142732140.000000006C907000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142791681.000000006C909000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142876110.000000006C911000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142956827.000000006C913000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143044653.000000006C91D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143105643.000000006C925000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c590000_wegame.jbxd

Similarity

API ID: H_prolog3H_prolog3_catch_
String ID:
API String ID: 863784098-0
Opcode ID: ca42fa8d46fd73a03bdd1f576eb92ac910f48e8e073e5282278d341ca8889b2d
Instruction ID: 808feb279e4b9eb28b896f690a0af910e54542cad8ccfc341ccc0b59b9f536f9
Opcode Fuzzy Hash: ca42fa8d46fd73a03bdd1f576eb92ac910f48e8e073e5282278d341ca8889b2d
Instruction Fuzzy Hash: CCE06D31910209EFCF056F98C9067ED3E71AF9136AF600548F820196E1C736CA399BDA

Function 6C5C1836 Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C5C183D

Part of subcall function 6C5B5524: __EH_prolog3.LIBCMT ref: 6C5B552B

Part of subcall function 6C5C1FA9: __EH_prolog3_GS.LIBCMT ref: 6C5C1FB0
Part of subcall function 6C5C1FA9: GetTickCount.KERNEL32 ref: 6C5C1FE6

Memory Dump Source

Source File: 00000006.00000002.4141448948.000000006C591000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000006.00000002.4141374342.000000006C590000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142318714.000000006C825000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142662450.000000006C906000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142732140.000000006C907000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142791681.000000006C909000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142876110.000000006C911000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142956827.000000006C913000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143044653.000000006C91D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143105643.000000006C925000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c590000_wegame.jbxd

Similarity

API ID: H_prolog3$CountH_prolog3_Tick
String ID:
API String ID: 1641273540-0
Opcode ID: aee16033bebd4a8a3d597f0094d572676e2d0d781f12cef4274422d267ecc08c
Instruction ID: b76c4ca842960189ea13cca7db99cb3ea3df5852a4de965dd6f8d3b558e611c5
Opcode Fuzzy Hash: aee16033bebd4a8a3d597f0094d572676e2d0d781f12cef4274422d267ecc08c
Instruction Fuzzy Hash: DAE06D30910248EBCF08DBE4C9257CD7E606F81218F904158E4005A6D0CB758F48DB66

Function 6C5CC5DB Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C5CC5E2

Part of subcall function 6C5A9850: __EH_prolog3.LIBCMT ref: 6C5A9857

Memory Dump Source

Source File: 00000006.00000002.4141448948.000000006C591000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000006.00000002.4141374342.000000006C590000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142318714.000000006C825000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142662450.000000006C906000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142732140.000000006C907000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142791681.000000006C909000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142876110.000000006C911000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142956827.000000006C913000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143044653.000000006C91D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143105643.000000006C925000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c590000_wegame.jbxd

Similarity

API ID: H_prolog3
String ID:
API String ID: 431132790-0
Opcode ID: f8c6c903c65f41986a50ed9f3eb52fdc671c091e51937d69bb19b83c23fee8cf
Instruction ID: 603480d8f2a1d5e7ec41cfa6b393b2d3b5c1244d427d085a3c04eba71e75baa3
Opcode Fuzzy Hash: f8c6c903c65f41986a50ed9f3eb52fdc671c091e51937d69bb19b83c23fee8cf
Instruction Fuzzy Hash: B2E0127190010DEBCF14EFF4CC159DDB674AF81324F10872AA431966E0DB354F0ADA65

Function 6C5F1DDD Relevance: 1.5, APIs: 1, Instructions: 15COMMON

Download Yara Rule

APIs

Part of subcall function 6C5A6B70: ?_Execute_once@std@@YAHAAUonce_flag@1@P6GHPAX1PAPAX@Z1@Z.MSVCP140(6C91D054,6C5A6BB1,6C91D058,?,6C5AA235,00000000,?,00000010), ref: 6C5A6B81
Part of subcall function 6C5A6B70: terminate.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5A6B8D

?exists@filesystem@ierd_tgp@@YA_NABVpath@12@AAVerror_code@std@@@Z.COMMON(00000000,00000000,?,?,?,?,6C8C31F0,?,?,?,?,?,00000000,00000044,?,6C8C31F0), ref: 6C5F1DF5

Memory Dump Source

Source File: 00000006.00000002.4141448948.000000006C591000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000006.00000002.4141374342.000000006C590000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142318714.000000006C825000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142662450.000000006C906000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142732140.000000006C907000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142791681.000000006C909000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142876110.000000006C911000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142956827.000000006C913000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143044653.000000006C91D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143105643.000000006C925000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c590000_wegame.jbxd

Similarity

API ID: ?exists@filesystem@ierd_tgp@@Execute_once@std@@Uonce_flag@1@Verror_code@std@@@Vpath@12@terminate
String ID:
API String ID: 3201841121-0
Opcode ID: 44bad85fd55e388663efb16c1270524ad2c5c494d0e774fee32e5b264cdd4f1a
Instruction ID: c34918fcddaad84f81b8be217125b2b39a77ab8b9b6866f73faf08f330e38d65
Opcode Fuzzy Hash: 44bad85fd55e388663efb16c1270524ad2c5c494d0e774fee32e5b264cdd4f1a
Instruction Fuzzy Hash: 8ED0A9B240420CBBEB088B80CC02ADE7BBCDB40258F10005AE00092140EF70AE484AA0

Function 6C5D71FA Relevance: 1.5, APIs: 1, Instructions: 11COMMON

Download Yara Rule

APIs

?get_cfg@common@ierd_tgp@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABVpath@filesystem@2@AAV?$basic_ptree@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@property_tree@boost@@_N3@Z.COMMON(?,?,?,00000001,00000000,?,6C5D77FD,?,00000000,?,files,00000005), ref: 6C5D720A

Part of subcall function 6C5D7214: __EH_prolog3.LIBCMT ref: 6C5D721B

Memory Dump Source

Source File: 00000006.00000002.4141448948.000000006C591000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000006.00000002.4141374342.000000006C590000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142318714.000000006C825000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142662450.000000006C906000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142732140.000000006C907000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142791681.000000006C909000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142876110.000000006C911000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142956827.000000006C913000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143044653.000000006C91D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143105643.000000006C925000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c590000_wegame.jbxd

Similarity

API ID: D@std@@U?$char_traits@V?$allocator@V?$basic_string@$D@2@@std@@$?get_cfg@common@ierd_tgp@@D@2@@std@@@2@@property_tree@boost@@_H_prolog3U?$less@V12@V?$basic_ptree@Vpath@filesystem@2@
String ID:
API String ID: 1018117080-0
Opcode ID: 4f23327678cb210834d688bdc7d14eaf2cd09f839c3f7af599adfa6ff0f24a10
Instruction ID: ab7dbcc94bb58b4712a51776612053ad8c0f4e999b3f2cd856c20455f84ebb63
Opcode Fuzzy Hash: 4f23327678cb210834d688bdc7d14eaf2cd09f839c3f7af599adfa6ff0f24a10
Instruction Fuzzy Hash: 3EC08C3208030CB7CF011E84CC02F8D3B1AAB00750F044050FF0C091A0D7B3A5709694

Function 00401125 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 0040112F

Memory Dump Source

Source File: 00000006.00000002.4137209488.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.4137156906.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137406249.0000000000476000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137497400.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137574844.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137626631.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137684215.00000000004A3000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_wegame.jbxd

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: d75190e280bcad54515b5aa78c75d12eb538471467df8bf1fcd3d2e9d8f38a71
Instruction ID: 7ceafc34f9a2d5f28f326fac8160f3156a68c61a7f1a365fafcd233377f90618
Opcode Fuzzy Hash: d75190e280bcad54515b5aa78c75d12eb538471467df8bf1fcd3d2e9d8f38a71
Instruction Fuzzy Hash: 96C04CB59043089BCB00EBA5DA4D89A7BFCA60C215B400575D956E3255E670E9888BA5

Function 6C592DCB Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 6C592DD5

Memory Dump Source

Source File: 00000006.00000002.4141448948.000000006C591000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000006.00000002.4141374342.000000006C590000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142318714.000000006C825000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142662450.000000006C906000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142732140.000000006C907000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142791681.000000006C909000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142876110.000000006C911000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142956827.000000006C913000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143044653.000000006C91D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143105643.000000006C925000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c590000_wegame.jbxd

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: d172674d5a9e33518e4bbfc1daa47b45782af30a90e10b55ef7c8c1b3039421c
Instruction ID: ee706e78c0a654fb38fcaa03dfc0f1f1f96d7e23a9b1604f5dd1a34d152de097
Opcode Fuzzy Hash: d172674d5a9e33518e4bbfc1daa47b45782af30a90e10b55ef7c8c1b3039421c
Instruction Fuzzy Hash: B6C04CB5A04318DBCF01EBA5C54A88EB7FCB709248B504561DD12E3744E774E949CBE1

Function 6C624AF9 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

Part of subcall function 6C624DE4: __EH_prolog3.LIBCMT ref: 6C624DEB

?report@Qos@qos@adapt_for_imports@ierd_tgp@@QAE_NABUQos_data_base@234@W4Qos_occasion@234@@Z.COMMON(?,?), ref: 6C624B08

Part of subcall function 6C625868: __EH_prolog3_GS.LIBCMT ref: 6C625872
Part of subcall function 6C625868: ?get_log_instance@base@@YAPAVILogger@1@XZ.COMMON(00000098,6C5E6E07,?,00000001,?,?,0000008C,6C5E79F6,00000002,00000000,?), ref: 6C625881

Memory Dump Source

Source File: 00000006.00000002.4141448948.000000006C591000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000006.00000002.4141374342.000000006C590000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142318714.000000006C825000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142662450.000000006C906000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142732140.000000006C907000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142791681.000000006C909000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142876110.000000006C911000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142956827.000000006C913000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143044653.000000006C91D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143105643.000000006C925000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c590000_wegame.jbxd

Similarity

API ID: ?get_log_instance@base@@?report@H_prolog3H_prolog3_Logger@1@Qos@qos@adapt_for_imports@ierd_tgp@@Qos_data_base@234@Qos_occasion@234@@
String ID:
API String ID: 4155978998-0
Opcode ID: 65291f374f562c28d3020b1e8e63a11297490e5bb09e0719ef3821a22b73622c
Instruction ID: 2601e7458335efd96e0fd375340a74a8c9cd86670f67065181558d1f3d48c1d4
Opcode Fuzzy Hash: 65291f374f562c28d3020b1e8e63a11297490e5bb09e0719ef3821a22b73622c
Instruction Fuzzy Hash: B1B09B651015305A8B111610BC004E9B699DF4711830544559C055661487596D4B8DDC

Function 6C5B3D1C Relevance: 1.5, APIs: 1, Instructions: 7COMMON

Download Yara Rule

APIs

?CreateWndImpl@WndMsgReceiver@Tenio@@IAEPAUHWND__@@PBDP6GJPAU3@IIJ@Z@Z.COMMON(?,6C5B3E81), ref: 6C5B3D27

Part of subcall function 6C5B3D44: memset.VCRUNTIME140(?,00000000,00000100), ref: 6C5B3D70
Part of subcall function 6C5B3D44: strcpy_s.API-MS-WIN-CRT-STRING-L1-1-0(?,00000100,?), ref: 6C5B3D89
Part of subcall function 6C5B3D44: CreateWindowExA.USER32(00000000,static,?,00000000,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000), ref: 6C5B3DC5
Part of subcall function 6C5B3D44: SetLastError.KERNEL32(00000000), ref: 6C5B3DD3
Part of subcall function 6C5B3D44: SetWindowLongA.USER32(00000000,000000FC,?), ref: 6C5B3DDD
Part of subcall function 6C5B3D44: GetLastError.KERNEL32 ref: 6C5B3DF0
Part of subcall function 6C5B3D44: SetLastError.KERNEL32(00000000), ref: 6C5B3DF8
Part of subcall function 6C5B3D44: SetWindowLongA.USER32(00000000,000000EB), ref: 6C5B3E02
Part of subcall function 6C5B3D44: GetLastError.KERNEL32 ref: 6C5B3E0C
Part of subcall function 6C5B3D44: DestroyWindow.USER32(00000000), ref: 6C5B3E13

Memory Dump Source

Source File: 00000006.00000002.4141448948.000000006C591000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000006.00000002.4141374342.000000006C590000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142318714.000000006C825000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142662450.000000006C906000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142732140.000000006C907000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142791681.000000006C909000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142876110.000000006C911000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142956827.000000006C913000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143044653.000000006C91D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143105643.000000006C925000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c590000_wegame.jbxd

Similarity

API ID: ErrorLastWindow$CreateLong$D__@@DestroyImpl@Receiver@Tenio@@memsetstrcpy_s
String ID:
API String ID: 1278412074-0
Opcode ID: afad6379833c5f090b255e127b37c5296c38c223a46b7a76824bd5e18ee023b2
Instruction ID: 8c4837302e794b12cb45b0e9667e973e8d37d012e69eb0125fd43da9fca38de9
Opcode Fuzzy Hash: afad6379833c5f090b255e127b37c5296c38c223a46b7a76824bd5e18ee023b2
Instruction Fuzzy Hash: F8B0123144010C7749001541DC20C5ABE1C47505906004022F6043E9108E3258A19098

Function 0043A670 Relevance: 1.3, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(00000001,0000000F,00000001,?,?,?,?,00437617,00000004,00000000), ref: 0043A6B6

Part of subcall function 0043AF70: memcpy.VCRUNTIME140(00000000,7FFFFFFF,00000000,00000001,00000001,0000000F), ref: 0043B03A
Part of subcall function 0043AF70: memset.VCRUNTIME140(00000010,00000001,00000001,00000000,7FFFFFFF,00000000,00000001,00000001,0000000F), ref: 0043B048

Memory Dump Source

Source File: 00000006.00000002.4137209488.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.4137156906.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137406249.0000000000476000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137497400.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137574844.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137626631.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137684215.00000000004A3000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_wegame.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: d11a58289a1c1aa42c24521ece4cc5ee6ad1354e351a41854d8fd0019f2a4681
Instruction ID: 5cec30af4d7c80d3daae319060ff34125f7c7a3ad8aad2e3e9671e9b1a719361
Opcode Fuzzy Hash: d11a58289a1c1aa42c24521ece4cc5ee6ad1354e351a41854d8fd0019f2a4681
Instruction Fuzzy Hash: 5D012833240150AFDB159E18EC40AAABB59FBD6754F34806FE5844F242C276D862C7EA

Function 6C59F200 Relevance: 1.3, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(00000000,?,?,?,?,?), ref: 6C59F246

Part of subcall function 6C59FD30: memcpy.VCRUNTIME140(00000000,7FFFFFFF,00000000,?,00000000,0000000F), ref: 6C59FDFA
Part of subcall function 6C59FD30: memset.VCRUNTIME140(00000010,?,00000000,00000000,7FFFFFFF,00000000,?,00000000,0000000F), ref: 6C59FE08

Memory Dump Source

Source File: 00000006.00000002.4141448948.000000006C591000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000006.00000002.4141374342.000000006C590000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142318714.000000006C825000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142662450.000000006C906000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142732140.000000006C907000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142791681.000000006C909000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142876110.000000006C911000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142956827.000000006C913000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143044653.000000006C91D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143105643.000000006C925000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c590000_wegame.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: 769b88b9df578ef76df08160c9db66007ceab8b25587ec1d5d3b9c8cb5a7f57b
Instruction ID: 8b77e45906f51d7ee8b68304eb4f1147c366a7d21dc59a43c0c589b730b6134b
Opcode Fuzzy Hash: 769b88b9df578ef76df08160c9db66007ceab8b25587ec1d5d3b9c8cb5a7f57b
Instruction Fuzzy Hash: 7301F532200294AFDB058EA8EC84BAEBB59EBD2719F3081AAF5544F241C272D44783A5

Function 6C6AF0C0 Relevance: 1.3, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

Part of subcall function 6C6ADFB0: OpenEventA.KERNEL32(00100002,00000000,00000000), ref: 6C6AE054
Part of subcall function 6C6ADFB0: CloseHandle.KERNEL32(00000000), ref: 6C6AE069
Part of subcall function 6C6ADFB0: ResetEvent.KERNEL32(00000000), ref: 6C6AE073
Part of subcall function 6C6ADFB0: CreateEventA.KERNEL32(00000000,00000001,00000000,00000000), ref: 6C6AE0DD

TlsSetValue.KERNEL32(00000027,?), ref: 6C6AF10A

Memory Dump Source

Source File: 00000006.00000002.4141448948.000000006C591000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000006.00000002.4141374342.000000006C590000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142318714.000000006C825000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142662450.000000006C906000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142732140.000000006C907000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142791681.000000006C909000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142876110.000000006C911000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142956827.000000006C913000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143044653.000000006C91D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143105643.000000006C925000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c590000_wegame.jbxd

Similarity

API ID: Event$CloseCreateHandleOpenResetValue
String ID:
API String ID: 3980803231-0
Opcode ID: 1a01f460243f907cf45d36cc86fd4ff7887e1e5050fe36dae19b16c031c5a86b
Instruction ID: 3e12088f2c3b4017a8a1677d01bcd58f66aa88fb1847f2693d2904ed28553a61
Opcode Fuzzy Hash: 1a01f460243f907cf45d36cc86fd4ff7887e1e5050fe36dae19b16c031c5a86b
Instruction Fuzzy Hash: 2401A771604118AFCB10CF98CC09B5ABBB8EB06774F204B2AF824D3B80D7356D008AE8

Function 6C62ADA8 Relevance: 1.3, APIs: 1, Instructions: 20sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000064), ref: 6C62ADD3

Part of subcall function 6C62B2B3: Sleep.KERNEL32(00000064), ref: 6C62B341

Memory Dump Source

Source File: 00000006.00000002.4141448948.000000006C591000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000006.00000002.4141374342.000000006C590000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142318714.000000006C825000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142662450.000000006C906000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142732140.000000006C907000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142791681.000000006C909000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142876110.000000006C911000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142956827.000000006C913000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143044653.000000006C91D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143105643.000000006C925000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c590000_wegame.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 085f3b299d43ea539bb14a0bf9bf6a14c008f86c01c5b815ec1a956c6021b111
Instruction ID: bf1fae107704643624cab40704a5ef73723b1e1096428935dcf0fd84826d042d
Opcode Fuzzy Hash: 085f3b299d43ea539bb14a0bf9bf6a14c008f86c01c5b815ec1a956c6021b111
Instruction Fuzzy Hash: F9D05E32A8572049CF0036A83504BD923D65F8770EF41444AA0811EEC78FF9048A9EEE

Function 6C598980 Relevance: 1.3, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C59898B

Memory Dump Source

Source File: 00000006.00000002.4141448948.000000006C591000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000006.00000002.4141374342.000000006C590000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142318714.000000006C825000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142662450.000000006C906000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142732140.000000006C907000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142791681.000000006C909000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142876110.000000006C911000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4142956827.000000006C913000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143044653.000000006C91D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.4143105643.000000006C925000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c590000_wegame.jbxd

Similarity

API ID: malloc
String ID:
API String ID: 2803490479-0
Opcode ID: 10c6b9df565790a1a5a211a0abd9e05d94ac5417bab37d4c57758837f1bcaabb
Instruction ID: 2eea511df964520362840573ee284ca48c81beb62729e8fbcdf0a2d92a08335a
Opcode Fuzzy Hash: 10c6b9df565790a1a5a211a0abd9e05d94ac5417bab37d4c57758837f1bcaabb
Instruction Fuzzy Hash: 2DC0927255030D9BCF00DF98E98A85A77ACAB54628B08C431F91E8B601D635F625CBD6

Non-executed Functions

Function 00450262 Relevance: 14.2, APIs: 1, Strings: 7, Instructions: 244COMMON

Download Yara Rule

Strings

0123456789abcdef, xrefs: 0044FF37, 004503E5
0, xrefs: 004503AD
integer, xrefs: 00450019, 004504ED
char, xrefs: 0045001E, 00450026, 004504F2, 004504FA
x, xrefs: 004503DC
0123456789ABCDEF, xrefs: 0044FF3C, 004503ED
0, xrefs: 00450421

Memory Dump Source

Source File: 00000006.00000002.4137209488.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.4137156906.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137406249.0000000000476000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137497400.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137574844.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137626631.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137684215.00000000004A3000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_wegame.jbxd

Similarity

API ID:
String ID: 0$0$0123456789ABCDEF$0123456789abcdef$char$integer$x
API String ID: 0-3625314725
Opcode ID: 08c1d498226b2ecc7008d17652090bb5e43fa88d9fab03caaf00b136daea2920
Instruction ID: 6124f39d4697e61237c35fb474113494ed70ac19028c091d118c670ad7d5c55e
Opcode Fuzzy Hash: 08c1d498226b2ecc7008d17652090bb5e43fa88d9fab03caaf00b136daea2920
Instruction Fuzzy Hash: 268114B6E001499FDF15CE58C8406EF7BA9AB95305F18C1ABEC55E7342D638DE09CB84

Function 00450039 Relevance: 12.5, APIs: 1, Strings: 6, Instructions: 213COMMON

Download Yara Rule

Strings

0123456789abcdef, xrefs: 0045015A
integer, xrefs: 00450242
char, xrefs: 00450247, 0045024F
0123456789ABCDEF, xrefs: 0045015F
0, xrefs: 00450189
x, xrefs: 00450151

Memory Dump Source

Source File: 00000006.00000002.4137209488.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.4137156906.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137406249.0000000000476000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137497400.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137574844.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137626631.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137684215.00000000004A3000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_wegame.jbxd

Similarity

API ID: ExceptionH_prolog3Throwisprint
String ID: 0$0123456789ABCDEF$0123456789abcdef$char$integer$x
API String ID: 3477395652-3234282380
Opcode ID: 44ff7697ef38e8fbd2d440c7b213ca14d22720103df678683a0a5012a0199590
Instruction ID: f9fa3c71bd52c8f8879cf3bde0b26f1638a9620607aefd0d15ab18b7397c55b6
Opcode Fuzzy Hash: 44ff7697ef38e8fbd2d440c7b213ca14d22720103df678683a0a5012a0199590
Instruction Fuzzy Hash: 06614476900109AFDF05DE69C895AEF3BA8EF52344F04805BEC45DB342D639CE4AC7A9

Function 004240D0 Relevance: 6.2, APIs: 3, Strings: 1, Instructions: 163COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(&B,?,?,?), ref: 004241BB
memcpy.VCRUNTIME140(00000000,?,&B), ref: 004241DF
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 004242D0

Strings

&B, xrefs: 00424162, 004241B3, 0042426A, 004241D8, 004241BA

Memory Dump Source

Source File: 00000006.00000002.4137209488.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.4137156906.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137406249.0000000000476000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137497400.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137574844.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137626631.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137684215.00000000004A3000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_wegame.jbxd

Similarity

API ID: freemallocmemcpy
String ID: &B
API String ID: 3056473165-3208460036
Opcode ID: ec3d463cb64532436e07a358fee51b4539ad9a72f9532496cbb7933ea9d26811
Instruction ID: 457ef9b8594cb7eb7360b13392eaacdb70403321e4b38281ace01ea2b311ad80
Opcode Fuzzy Hash: ec3d463cb64532436e07a358fee51b4539ad9a72f9532496cbb7933ea9d26811
Instruction Fuzzy Hash: F35177B16083418BC714CF69D88471AFBE1FBC9364F548B6EF4A99B381D334C9498B96

Function 6C524640 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 91windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00000000), ref: 6C52465E
FormatMessageA.KERNEL32(00001200,00000000,00000000,00000000,?,00000080,00000000), ref: 6C52467A

Strings

%s.dll, xrefs: 6C5246EA

Memory Dump Source

Source File: 00000006.00000002.4140707867.000000006C509000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000006.00000002.4140614744.000000006C500000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.4140707867.000000006C501000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.4141048756.000000006C57A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.4141124009.000000006C583000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.4141184681.000000006C584000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.4141184681.000000006C587000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c500000_wegame.jbxd

Similarity

API ID: ErrorFormatLastMessage
String ID: %s.dll
API String ID: 3479602957-3668843792
Opcode ID: 1f4fd7c12e032653efa67967d0e6e50d50b3a89c7690729d3e9301d8feb8818e
Instruction ID: aea8935eff42d4f600e3058d132e3724e4f503eef6a5b8e2c7bff5d22683c656
Opcode Fuzzy Hash: 1f4fd7c12e032653efa67967d0e6e50d50b3a89c7690729d3e9301d8feb8818e
Instruction Fuzzy Hash: BA114C76205310ABDB204A24DC00FE77BAC9FC7658F148548F1D9979D2D730684A8776

Function 004462AA Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

?to_json@jsonbind@@YAHPAXAAVValue@Json@@@Z.COMMON(?,?), ref: 004462B1

Memory Dump Source

Source File: 00000006.00000002.4137209488.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.4137156906.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137406249.0000000000476000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137497400.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137574844.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137626631.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137684215.00000000004A3000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_wegame.jbxd

Similarity

API ID: ?to_json@jsonbind@@Json@@@Value@
String ID:
API String ID: 1197194930-0
Opcode ID: a344cd6ff7a345d52612928cf183342128cd536626fba050600e4bf321d7cbec
Instruction ID: a03762896c5988b49979fc0897a39a9d49b22febffd215c57dfb0b68bb1138c4
Opcode Fuzzy Hash: a344cd6ff7a345d52612928cf183342128cd536626fba050600e4bf321d7cbec
Instruction Fuzzy Hash: 93B0127300C30C3A55086697B803C467F8CC6A0274610C01FF604040417C37F06061AD

Function 6C533530 Relevance: 45.7, APIs: 15, Strings: 11, Instructions: 169COMMON

Download Yara Rule

Strings

Snlf, xrefs: 6C533606
..., xrefs: 6C5335D1
in main chunk, xrefs: 6C53368E
in function <%s:%d>, xrefs: 6C5336BE
%d:, xrefs: 6C533657
%s, xrefs: 6C533567
%s:, xrefs: 6C53363A, 6C533644
stack traceback:, xrefs: 6C533577
in function '%s', xrefs: 6C533672
[builtin#%d]:, xrefs: 6C533630
at %p, xrefs: 6C5336A5

Memory Dump Source

Source File: 00000006.00000002.4140707867.000000006C509000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000006.00000002.4140614744.000000006C500000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.4140707867.000000006C501000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.4141048756.000000006C57A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.4141124009.000000006C583000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.4141184681.000000006C584000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.4141184681.000000006C587000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c500000_wegame.jbxd

Similarity

API ID:
String ID: %s:$...$[builtin#%d]:$ at %p$ in function '%s'$ in function <%s:%d>$ in main chunk$%d:$%s$Snlf$stack traceback:
API String ID: 0-750625491
Opcode ID: 2d154384520a2750bd0977761f175bb1ac48a5f6e37caf1b80d6875aa07798bf
Instruction ID: 090163033d94d02d831ef81dfc313a52557914bc80115957bbd93405e9f09d0e
Opcode Fuzzy Hash: 2d154384520a2750bd0977761f175bb1ac48a5f6e37caf1b80d6875aa07798bf
Instruction Fuzzy Hash: 4351F971604655AFD210DF28CC41EAB77E8AF85318F040A08F959D7B91F731EA1A8BA7

Function 0043E25B Relevance: 35.3, APIs: 11, Strings: 9, Instructions: 286fileCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0043E265
PathFileExistsW.SHLWAPI(?,?,?,?,?,?,?,?,?,?,?,?,000000F4), ref: 0043E298
DeleteFileW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,000000F4), ref: 0043E2B2
?get_log_instance@base@@YAPAVILogger@1@XZ.COMMON(?,?,?,?,?,?,?,?,?,?,?,000000F4), ref: 0043E2BC

Part of subcall function 0043DD1B: __EH_prolog3.LIBCMT ref: 0043DD22

?get_log_instance@base@@YAPAVILogger@1@XZ.COMMON(?,?,?,?,?,?,?,?,?,?,?,000000F4), ref: 0043E309
?get_log_instance@base@@YAPAVILogger@1@XZ.COMMON(?,?,?,?,?,?,?,?,?,?,?,000000F4), ref: 0043E353
CreateFileW.KERNEL32(?,C0000000,00000001,00000000,00000002,00000082,00000000), ref: 0043E3F8
CloseHandle.KERNEL32(00000000), ref: 0043E404
?get_log_instance@base@@YAPAVILogger@1@XZ.COMMON ref: 0043E40C
GetLastError.KERNEL32(00000000,00000005,e:\dailybuild_fix_5.4\wegame_client\codes\main\tgp_daemon\src\crashchecker.cpp,000000A1,00484367), ref: 0043E449
?get_log_instance@base@@YAPAVILogger@1@XZ.COMMON(00000000,?,?), ref: 0043E55A

Strings

Before exit, run flag file not find., xrefs: 0043E38E
login_pic\, xrefs: 0043E3AB, 0043E46E
Before exit, delete run flag file fail., xrefs: 0043E34C
Before exit, prepare create hash file failed. err %d, xrefs: 0043E450
Flag, xrefs: 0043E275
Before exit, delete run flag file., xrefs: 0043E2FF
fileinfo.hash, xrefs: 0043E3BE
e:\dailybuild_fix_5.4\wegame_client\codes\main\tgp_daemon\src\crashchecker.cpp, xrefs: 0043E2E8, 0043E335, 0043E377, 0043E430, 0043E582
Before exit, write hash failed. %ws, xrefs: 0043E5BA

Memory Dump Source

Source File: 00000006.00000002.4137209488.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.4137156906.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137406249.0000000000476000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137497400.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137574844.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137626631.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137684215.00000000004A3000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_wegame.jbxd

Similarity

API ID: ?get_log_instance@base@@Logger@1@$File$CloseCreateDeleteErrorExistsH_prolog3H_prolog3_HandleLastPath
String ID: Before exit, delete run flag file fail.$Before exit, delete run flag file.$Before exit, prepare create hash file failed. err %d$Before exit, run flag file not find.$Before exit, write hash failed. %ws$Flag$e:\dailybuild_fix_5.4\wegame_client\codes\main\tgp_daemon\src\crashchecker.cpp$fileinfo.hash$login_pic\
API String ID: 1687871307-2502764942
Opcode ID: 78f7459b7b5dc0a56bdeb6360e7acffdee336a988ad2736a97356d0ae1936ae0
Instruction ID: 5ffd19562f6899cead28f942783f98122cba7cb1aa672db310e844defbfb47e3
Opcode Fuzzy Hash: 78f7459b7b5dc0a56bdeb6360e7acffdee336a988ad2736a97356d0ae1936ae0
Instruction Fuzzy Hash: 0BB11430E01219EADB20EBA1CC45FDE7774AF59308F1040AEE5457B2C2EB785E49DB69

Function 6C541380 Relevance: 28.1, APIs: 12, Strings: 4, Instructions: 139stringfileCOMMON

Download Yara Rule

APIs

fopen.API-MS-WIN-CRT-STDIO-L1-1-0(?,6C57D08C), ref: 6C5413B3
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5413C7
strerror.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000), ref: 6C5413CF
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C541417
ferror.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6C5414A6
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5414C4
strerror.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000), ref: 6C5414CC
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6C5414F2
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6C541533

Strings

=stdin, xrefs: 6C54141D
cannot read %s: %s, xrefs: 6C5414D9
cannot open %s: %s, xrefs: 6C5413D7
@%s, xrefs: 6C5413FF

Memory Dump Source

Source File: 00000006.00000002.4140707867.000000006C509000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000006.00000002.4140614744.000000006C500000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.4140707867.000000006C501000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.4141048756.000000006C57A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.4141124009.000000006C583000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.4141184681.000000006C584000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.4141184681.000000006C587000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c500000_wegame.jbxd

Similarity

API ID: _errnofclosestrerror$__acrt_iob_funcferrorfopen
String ID: =stdin$@%s$cannot open %s: %s$cannot read %s: %s
API String ID: 3519029791-583736455
Opcode ID: b0493827b370bd96e04fea2043ba5912922acf9f8ed6837d1ff907bce0e2df2e
Instruction ID: d6f92e4ba88674d5a3942d154df76b334821c27a0198860c2df11bfe02fa7726
Opcode Fuzzy Hash: b0493827b370bd96e04fea2043ba5912922acf9f8ed6837d1ff907bce0e2df2e
Instruction Fuzzy Hash: 07515B716056019BC720DF28DC45B9B7BF9BF86308F00852DE89AC7750EB31D9588B96

Function 0043C3D0 Relevance: 21.5, APIs: 11, Strings: 1, Instructions: 461COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,null,00000004,F69FE839,?), ref: 0043C444
memcpy.VCRUNTIME140(?,00000000,?,?), ref: 0043C4B7
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,00000000,00000000,?,?), ref: 0043C4FE
memcpy.VCRUNTIME140(?,0048470C,00000001,?), ref: 0043C5E5
memcpy.VCRUNTIME140(?,00484710,00000001,00000001,00000000,0048470C,00000001,?), ref: 0043C64D
memcpy.VCRUNTIME140(?,00484714,00000001,00000001,00000000,0048470C,00000001,?), ref: 0043C6B1
memcpy.VCRUNTIME140(?,00484718,00000001,?,?,?,?,?), ref: 0043C71C
memcpy.VCRUNTIME140(00000000,00484710,00000001,?,00000000,00000000,?,00000001,00000000,00484718,00000001,?,?,?,?,?), ref: 0043C77C
memcpy.VCRUNTIME140(?,00000000,?,00000001,00000000,00484710,00000001,?,00000000,00000000,?,00000001,00000000,00484718,00000001,?), ref: 0043C7E8
memcpy.VCRUNTIME140(?,00484720,00000001,00000001,00000000,00484718,00000001,?,?,?,?,?), ref: 0043C8A1
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?), ref: 0043C90E

Strings

null, xrefs: 0043C43E, 0043C457

Memory Dump Source

Source File: 00000006.00000002.4137209488.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.4137156906.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137406249.0000000000476000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137497400.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137574844.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137626631.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137684215.00000000004A3000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_wegame.jbxd

Similarity

API ID: memcpy$_invalid_parameter_noinfo_noreturn
String ID: null
API String ID: 2665656946-634125391
Opcode ID: 6f3d7685a8c59acdb9c1e17efde61921ce30b42703559a24a9a8deac76d583bd
Instruction ID: 4bb5b911f5799bdcbed3e786be77f307c2ec9f1eb19dda12abdcb71094c5e1ab
Opcode Fuzzy Hash: 6f3d7685a8c59acdb9c1e17efde61921ce30b42703559a24a9a8deac76d583bd
Instruction Fuzzy Hash: 16F10671B002049FDB08DF68C9C5BAEB772EF89304F24552EE411AB382D779E945CB99

Function 0045C0B7 Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 176processCOMMON

Download Yara Rule

APIs

__EH_prolog3_catch_GS.LIBCMT ref: 0045C0C1

Part of subcall function 00420F10: memcpy.VCRUNTIME140(00000000,00000000,00000000,004204D1,00000000,00000000,00000000,?,00423FD2,00000000,00000001), ref: 00420F37

?instance@Application@common@ierd_tgp@@SAPAV123@XZ.COMMON(client_launcher.exe,00000013), ref: 0045C0ED
?get_app_sub_path@Application@common@ierd_tgp@@SA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V45@@Z.COMMON(?), ref: 0045C11A
?u8to16@common@ierd_tgp@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@4@@Z.COMMON(?,?,?), ref: 0045C147
GetCurrentProcessId.KERNEL32 ref: 0045C14F

Part of subcall function 0044D584: __EH_prolog3_GS.LIBCMT ref: 0044D58B

memset.VCRUNTIME140(?,00000000,00000044,00000000), ref: 0045C227
GetCommandLineW.KERNEL32 ref: 0045C248

Part of subcall function 0040BC90: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,0040E9C2,?,?), ref: 0040BCDD

CreateProcessW.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 0045C2DF
?get_log_instance@base@@YAPAVILogger@1@XZ.COMMON ref: 0045C2E9

Part of subcall function 0043DD1B: __EH_prolog3.LIBCMT ref: 0043DD22

Part of subcall function 0043F2BB: __EH_prolog3_catch_GS.LIBCMT ref: 0043F2C2

Strings

e:\dailybuild_fix_5.4\wegame_client\codes\main\tgp_daemon\src\tgp_daemon_main.cpp, xrefs: 0045C30D
client_launcher.exe, xrefs: 0045C0DD
[ReStart] relaunch tgp failed, xrefs: 0045C324

Memory Dump Source

Source File: 00000006.00000002.4137209488.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.4137156906.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137406249.0000000000476000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137497400.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137574844.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137626631.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137684215.00000000004A3000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_wegame.jbxd

Similarity

API ID: Application@common@ierd_tgp@@D@2@@std@@D@std@@H_prolog3_catch_ProcessU?$char_traits@V?$allocator@V?$basic_string@$?get_app_sub_path@?get_log_instance@base@@?instance@?u8to16@common@ierd_tgp@@CommandCreateCurrentH_prolog3H_prolog3_LineLogger@1@U?$char_traits@_V123@V45@@V?$allocator@_V?$basic_string@_W@2@@4@@W@std@@_invalid_parameter_noinfo_noreturnmemcpymemset
String ID: [ReStart] relaunch tgp failed$client_launcher.exe$e:\dailybuild_fix_5.4\wegame_client\codes\main\tgp_daemon\src\tgp_daemon_main.cpp
API String ID: 149771262-2221009300
Opcode ID: c07dd3b6d83caee02c59580ecea161e95f2bcc5a716948c85d48daccdc74ec87
Instruction ID: a44f8cb8ffe04374ef9375fe63619a20b9322ad382702d3aa1ad01d813176ed6
Opcode Fuzzy Hash: c07dd3b6d83caee02c59580ecea161e95f2bcc5a716948c85d48daccdc74ec87
Instruction Fuzzy Hash: 64716070D0524CDADB11DFA5C985BDEBBB4AF14308F6080AEE145B7182EB785B48CF95

Function 00408330 Relevance: 19.7, APIs: 9, Strings: 2, Instructions: 498COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,F69FE839), ref: 00408393
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,?,?,?,?,?,?,?), ref: 00408572
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 004085E2
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 0040863B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 004086A8
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00408886
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,00000164), ref: 0040890E

Part of subcall function 004038B0: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,0040BFC7,?,?,?,?,004029F7,?,F69FE839,?,?,00000000), ref: 00403947

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,00000164), ref: 00408A81
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,00000164), ref: 00408AA6

Strings

_KEY), xrefs: 00408758
VFSHelper::CreateVFSFile() , xrefs: 004086C1

Memory Dump Source

Source File: 00000006.00000002.4137209488.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.4137156906.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137406249.0000000000476000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137497400.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137574844.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137626631.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137684215.00000000004A3000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_wegame.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$CriticalSection$EnterLeave
String ID: VFSHelper::CreateVFSFile() $_KEY)
API String ID: 363805048-2244242188
Opcode ID: 6c220a82bd40181256b181ba4dfa97f60f8f5d05a44941533827735b043a7dd8
Instruction ID: 686b7dac7b2fe8d52913a94072ee32a43756337106202ee2b117b941fc7e3929
Opcode Fuzzy Hash: 6c220a82bd40181256b181ba4dfa97f60f8f5d05a44941533827735b043a7dd8
Instruction Fuzzy Hash: 2B226C71D00258CBDB24DF64CE49BDEB7B1AF85308F1481AEE449B7291DB789A84CF58

Function 004120B0 Relevance: 19.4, APIs: 4, Strings: 7, Instructions: 174COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,00000000,?,00000000,?,00000000,?,?,?,?,?,00405CC9,?,00000000,?), ref: 004121A5
memcpy.VCRUNTIME140(00000000,?,00000000,?,00000000,?,00000000,?,?,?,?,?,00405CC9,?,00000000,?), ref: 004121B6
memcpy.VCRUNTIME140(-00000005,00000000,00000000,00000000,?,00000000,?,00000000,?,00000000,?,?,?,?,?,00405CC9), ref: 004121CB
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00000000,?,00000000,?,?,?,?,?,00405CC9,?,00000000,?), ref: 00412239

Strings

3333, xrefs: 00412107
3333, xrefs: 00412131
gfff, xrefs: 004121DC
3333, xrefs: 004120ED
gfff, xrefs: 004120B9
gfff, xrefs: 004120DA
gfff, xrefs: 00412100

Memory Dump Source

Source File: 00000006.00000002.4137209488.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.4137156906.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137406249.0000000000476000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137497400.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137574844.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137626631.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137684215.00000000004A3000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_wegame.jbxd

Similarity

API ID: memcpy$_invalid_parameter_noinfo_noreturn
String ID: 3333$3333$3333$gfff$gfff$gfff$gfff
API String ID: 2665656946-2802276651
Opcode ID: e2cc261ba5b28b10a1adaf53e67b0948f0b7ec71b49745b6f501b91ac5e0ade6
Instruction ID: b6a76a5b44afb96e132a3027b799dde0fddf25456a471bfbbd69f0b57b2ad1ed
Opcode Fuzzy Hash: e2cc261ba5b28b10a1adaf53e67b0948f0b7ec71b49745b6f501b91ac5e0ade6
Instruction Fuzzy Hash: A451F5726004049FC718DF2DDE859AD7BA6AB89350718C26EE905CF385EA70EE51C687

Function 6C501A14 Relevance: 16.1, APIs: 5, Strings: 4, Instructions: 395libraryCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 6C524CFE
SetLastError.KERNEL32(?), ref: 6C524DF5
GetLastError.KERNEL32(00000000,?,?,?,?,00000EC7,?), ref: 6C524EEB
LoadLibraryA.KERNEL32(00000000), ref: 6C524F2C
SetLastError.KERNEL32(00000000), ref: 6C524F39

Strings

@%s@%d, xrefs: 6C524DC6, 6C524DCF
%s.dll, xrefs: 6C524F19
cannot resolve symbol '%s': %s, xrefs: 6C524E2F
_%s@%d, xrefs: 6C524DC1

Memory Dump Source

Source File: 00000006.00000002.4140707867.000000006C501000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000006.00000002.4140614744.000000006C500000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.4140707867.000000006C509000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.4141048756.000000006C57A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.4141124009.000000006C583000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.4141184681.000000006C584000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.4141184681.000000006C587000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c500000_wegame.jbxd

Similarity

API ID: ErrorLast$LibraryLoad
String ID: %s.dll$@%s@%d$_%s@%d$cannot resolve symbol '%s': %s
API String ID: 1136134869-3314875064
Opcode ID: 95ca945f6f33fd82702e7e77e8929da537b568a5f8123759deddef8e48d6e643
Instruction ID: 815c53cbbe937c3aa87b7efa7bf1c17d158401dbd9a3d9a97193edf49eb46623
Opcode Fuzzy Hash: 95ca945f6f33fd82702e7e77e8929da537b568a5f8123759deddef8e48d6e643
Instruction Fuzzy Hash: AC8116756057129BC700CF28DC40B6AB7F8FF85328F184669F9549B781D739E982CBA2

Function 00444156 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 186COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00444160
?u8to16@common@ierd_tgp@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@4@@Z.COMMON(?,?), ref: 004441A3
memset.VCRUNTIME140(?,00000000,00000208,?,?), ref: 004441B5
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 00444204
SimpleUString::operator=.MSOBJ140-MSVCRT ref: 00444267
?instance@Application@common@ierd_tgp@@SAPAV123@XZ.COMMON ref: 0044430D
?get_workingdir_path@Application@common@ierd_tgp@@SA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ.COMMON(?), ref: 00444319
?u8to16@common@ierd_tgp@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@4@@Z.COMMON(?,?), ref: 00444359

Part of subcall function 00442329: __EH_prolog3_GS.LIBCMT ref: 00442333
Part of subcall function 00442329: memset.VCRUNTIME140(?,00000000,00000414,0000047C,004443B8,?,00000000,?,?,00000000,0047D1B0,?,00000000,?,?,?), ref: 00442361

Part of subcall function 0040BC90: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,0040E9C2,?,?), ref: 0040BCDD

Strings

\tpf_ui\lua_script\, xrefs: 0044435E

Memory Dump Source

Source File: 00000006.00000002.4137209488.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.4137156906.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137406249.0000000000476000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137497400.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137574844.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137626631.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137684215.00000000004A3000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_wegame.jbxd

Similarity

API ID: D@2@@std@@D@std@@U?$char_traits@V?$allocator@V?$basic_string@$?u8to16@common@ierd_tgp@@Application@common@ierd_tgp@@H_prolog3_U?$char_traits@_V?$allocator@_V?$basic_string@_W@2@@4@@W@std@@memset$?get_workingdir_path@?instance@SimpleString::operator=V123@_invalid_parameter_noinfo_noreturnwcslen
String ID: \tpf_ui\lua_script\
API String ID: 1480478042-3405123967
Opcode ID: e139be7cba1ff0a27762b38451c1809bfaba17b4f1ab69d4f2fdd49b6c4bad16
Instruction ID: 2a57bfeefb8dd81a30a9c853e766909a5ef2705420f54136b31a7e199a856888
Opcode Fuzzy Hash: e139be7cba1ff0a27762b38451c1809bfaba17b4f1ab69d4f2fdd49b6c4bad16
Instruction Fuzzy Hash: 69813C71C0525CDADB20EFA5CC89BDEBBB4AF14308F5441EEA009A7192DB785B84CF95

Function 0044A2A7 Relevance: 15.1, APIs: 10, Instructions: 133COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 0044A2AE

Part of subcall function 00453AD1: __EH_prolog3.LIBCMT ref: 00453AD8
Part of subcall function 00453AD1: ?_Ipfx@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAE_N_N@Z.MSVCP140(?,?,00000004,0044A2CA,?,00000000,00000048), ref: 00453AF3

?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,?,00000000,00000048), ref: 0044A2E1

Part of subcall function 0044F21D: __EH_prolog3.LIBCMT ref: 0044F224
Part of subcall function 0044F21D: ??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000,00000018,0044A4AE,00000000), ref: 0044F22F
Part of subcall function 0044F21D: ??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 0044F246
Part of subcall function 0044F21D: std::locale::_Getfacet.LIBCPMT ref: 0044F250
Part of subcall function 0044F21D: ?_Getcat@?$ctype@_W@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,00000008), ref: 0044F269
Part of subcall function 0044F21D: std::_Facet_Register.LIBCPMT ref: 0044F281
Part of subcall function 0044F21D: ??1_Lockit@std@@QAE@XZ.MSVCP140 ref: 0044F2A4

?width@ios_base@std@@QBE_JXZ.MSVCP140 ref: 0044A314
?width@ios_base@std@@QBE_JXZ.MSVCP140 ref: 0044A346
?width@ios_base@std@@QBE_JXZ.MSVCP140 ref: 0044A35C
?sgetc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEGXZ.MSVCP140 ref: 0044A397
?is@?$ctype@_W@std@@QBE_NF_W@Z.MSVCP140(00000048,?), ref: 0044A3C4
?snextc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEGXZ.MSVCP140(?), ref: 0044A3F0
?width@ios_base@std@@QAE_J_J@Z.MSVCP140(00000000,00000000,?,00000000,00000048), ref: 0044A426
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(00000000,00000000), ref: 0044A43E

Memory Dump Source

Source File: 00000006.00000002.4137209488.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.4137156906.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137406249.0000000000476000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137497400.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137574844.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137626631.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137684215.00000000004A3000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_wegame.jbxd

Similarity

API ID: ?width@ios_base@std@@$U?$char_traits@_W@std@@@std@@$H_prolog3Lockit@std@@W@std@@$??0_??1_?getloc@ios_base@std@@?is@?$ctype@_?setstate@?$basic_ios@?sgetc@?$basic_streambuf@_?snextc@?$basic_streambuf@_Bid@locale@std@@D@std@@@std@@Facet_Getcat@?$ctype@_GetfacetH_prolog3_catchIpfx@?$basic_istream@_RegisterU?$char_traits@V42@@Vfacet@locale@2@Vlocale@2@std::_std::locale::_
String ID:
API String ID: 60005924-0
Opcode ID: a74a7e606078e145eb00bc18fe45efe8a72d763d9b418baef1afd703b7d5211b
Instruction ID: 5bf4b8a41870af5831336775d10defe226dacbcbb37d8c784308d2ee47c72bff
Opcode Fuzzy Hash: a74a7e606078e145eb00bc18fe45efe8a72d763d9b418baef1afd703b7d5211b
Instruction Fuzzy Hash: 21518070A00104DFDB14DF98C898AADBBF5BF48314F24416DE456A73A2DB389D45CB49

Function 0044A0F2 Relevance: 15.1, APIs: 10, Instructions: 130COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 0044A0F9

Part of subcall function 0043B4A0: ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z.MSVCP140(?,F69FE839,?,?,?,0046D3F8,000000FF), ref: 0043B4EC

?getloc@ios_base@std@@QBE?AVlocale@2@XZ.MSVCP140(?,0000004C), ref: 0044A12C

Part of subcall function 0044F171: __EH_prolog3.LIBCMT ref: 0044F178
Part of subcall function 0044F171: ??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000,00000018,00450B3E,00000000), ref: 0044F183
Part of subcall function 0044F171: ??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 0044F19A
Part of subcall function 0044F171: std::locale::_Getfacet.LIBCPMT ref: 0044F1A4
Part of subcall function 0044F171: ?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,00000000), ref: 0044F1BD
Part of subcall function 0044F171: std::_Facet_Register.LIBCPMT ref: 0044F1D5
Part of subcall function 0044F171: ??1_Lockit@std@@QAE@XZ.MSVCP140 ref: 0044F1F8

?width@ios_base@std@@QBE_JXZ.MSVCP140 ref: 0044A15F
?width@ios_base@std@@QBE_JXZ.MSVCP140 ref: 0044A193
?width@ios_base@std@@QBE_JXZ.MSVCP140 ref: 0044A1A9
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140 ref: 0044A1E1
?is@?$ctype@D@std@@QBE_NFD@Z.MSVCP140(00000048,00000000), ref: 0044A206
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?), ref: 0044A232
?width@ios_base@std@@QAE_J_J@Z.MSVCP140(00000000,00000000,0000004C), ref: 0044A268
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(00000000,00000000), ref: 0044A280

Memory Dump Source

Source File: 00000006.00000002.4137209488.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.4137156906.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137406249.0000000000476000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137497400.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137574844.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137626631.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137684215.00000000004A3000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_wegame.jbxd

Similarity

API ID: ?width@ios_base@std@@D@std@@@std@@U?$char_traits@$D@std@@Lockit@std@@$??0_??1_?getloc@ios_base@std@@?is@?$ctype@?setstate@?$basic_ios@?sgetc@?$basic_streambuf@?snextc@?$basic_streambuf@Bid@locale@std@@Facet_Getcat@?$ctype@GetfacetH_prolog3H_prolog3_catchIpfx@?$basic_istream@RegisterV42@@Vfacet@locale@2@Vlocale@2@std::_std::locale::_
String ID:
API String ID: 42574568-0
Opcode ID: d0e87a05b5e7509a779d30b048b1cefdb1672a7d97f1b4c06e9d19113d8066b1
Instruction ID: 41f10faa7cb6bc1b1661fcbb80ae2689497ba947cb8b4263a98ceedd0bbb0f38
Opcode Fuzzy Hash: d0e87a05b5e7509a779d30b048b1cefdb1672a7d97f1b4c06e9d19113d8066b1
Instruction Fuzzy Hash: 7D518170A00244DFDB14DFA8C894AADBBB1FF48314F24425DE156A73A2CB359D45CB49

Function 6C501276 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 150libraryCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,?,?,?,?,00000EC7,?), ref: 6C524EEB
LoadLibraryA.KERNEL32(00000000), ref: 6C524F2C
SetLastError.KERNEL32(00000000), ref: 6C524F39
FreeLibrary.KERNEL32(00000000,?,00000000,?,?,cannot load module '%s': %s,?), ref: 6C524FF5
FreeLibrary.KERNEL32(00000000,?,?,cannot load module '%s': %s,?), ref: 6C52500E

Strings

%s.dll, xrefs: 6C524F19
cannot load module '%s': %s, xrefs: 6C524F82

Memory Dump Source

Source File: 00000006.00000002.4140707867.000000006C501000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000006.00000002.4140614744.000000006C500000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.4140707867.000000006C509000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.4141048756.000000006C57A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.4141124009.000000006C583000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.4141184681.000000006C584000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.4141184681.000000006C587000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c500000_wegame.jbxd

Similarity

API ID: Library$ErrorFreeLast$Load
String ID: %s.dll$cannot load module '%s': %s
API String ID: 2360286020-4289185444
Opcode ID: b4720a304e5965ee8615f35a6acaa203b24f1cef45a54801818e0cab674060f9
Instruction ID: 2ca5d180898882706ea19fd2d14b6256c21cc5eff36e026cc8c1535a9bcfd4aa
Opcode Fuzzy Hash: b4720a304e5965ee8615f35a6acaa203b24f1cef45a54801818e0cab674060f9
Instruction Fuzzy Hash: 9B31F671A053129BD7219F28DC44B57BBF8BF86228F210259F9589B7C1D739E881CBE1

Function 6C5247F0 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 76libraryloaderCOMMON

Download Yara Rule

APIs

__p__fmode.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6C524865
GetModuleHandleExA.KERNEL32(00000006,00000000), ref: 6C52486E
GetProcAddress.KERNEL32(?,00000000), ref: 6C5248A0
GetProcAddress.KERNEL32(?,6C524D12), ref: 6C5248CA

Strings

gdi32.dll, xrefs: 6C524888
kernel32.dll, xrefs: 6C52487A
user32.dll, xrefs: 6C524881

Memory Dump Source

Source File: 00000006.00000002.4140707867.000000006C509000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000006.00000002.4140614744.000000006C500000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.4140707867.000000006C501000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.4141048756.000000006C57A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.4141124009.000000006C583000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.4141184681.000000006C584000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.4141184681.000000006C587000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c500000_wegame.jbxd

Similarity

API ID: AddressProc$HandleModule__p__fmode
String ID: gdi32.dll$kernel32.dll$user32.dll
API String ID: 1272881337-3744471378
Opcode ID: 4d7ab9c49d3b459eb758ddaf864b7d87edde2387c2dc07c24e2bad3736ffe45a
Instruction ID: e63212743d3786ea794b258bf24a1ced1db0ab0c64cd9ca8fb65716ec3a90249
Opcode Fuzzy Hash: 4d7ab9c49d3b459eb758ddaf864b7d87edde2387c2dc07c24e2bad3736ffe45a
Instruction Fuzzy Hash: D0216A72619261EBD700DE99EC80E1AB3F8EB8B711F421925FA40D7680DB30EC008B76

Function 6C51C820 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 321COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?), ref: 6C51C85C
memcpy.VCRUNTIME140(?,?,?), ref: 6C51C896
memcpy.VCRUNTIME140(?,00000000,?), ref: 6C51C923

Strings

%s: %s, xrefs: 6C51C7EC
(binary), xrefs: 6C51C7D1

Memory Dump Source

Source File: 00000006.00000002.4140707867.000000006C509000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000006.00000002.4140614744.000000006C500000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.4140707867.000000006C501000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.4141048756.000000006C57A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.4141124009.000000006C583000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.4141184681.000000006C584000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.4141184681.000000006C587000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c500000_wegame.jbxd

Similarity

API ID: memcpy
String ID: %s: %s$(binary)
API String ID: 3510742995-3183693350
Opcode ID: 871230105774feaf2520714116cbab6bc39bb4b6f4c1c1f852de549e8b7cfed9
Instruction ID: 4b410eccfb18590648260e31b455feea890b5882e4c4b96099bab3c9d17d4fca
Opcode Fuzzy Hash: 871230105774feaf2520714116cbab6bc39bb4b6f4c1c1f852de549e8b7cfed9
Instruction Fuzzy Hash: 1B81AC71608B01AFE721DF29CC84A5AB7E6FF88714F140A2DE45A87E00D332F855CB84

Function 0040A280 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 192COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,F69FE839), ref: 0040A2C2
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 0040A3E7
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 0040A445
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,00000001), ref: 0040A4B8
LeaveCriticalSection.KERNEL32(?,?,00000001), ref: 0040A4DD

Strings

VFSHelper::OutputSequenceFile() , xrefs: 0040A45B

Memory Dump Source

Source File: 00000006.00000002.4137209488.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.4137156906.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137406249.0000000000476000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137497400.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137574844.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137626631.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137684215.00000000004A3000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_wegame.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$CriticalSection$EnterLeave
String ID: VFSHelper::OutputSequenceFile()
API String ID: 363805048-1191238597
Opcode ID: 03b1e94b2d7b8decae809b17ba1c2acfbd261c7a10f426b4c589e269bb15e470
Instruction ID: 4d92bf8e6a1fd9fc1fd3b6ec17634ad52e6ca1ed61172e054c0388b7bdba8cde
Opcode Fuzzy Hash: 03b1e94b2d7b8decae809b17ba1c2acfbd261c7a10f426b4c589e269bb15e470
Instruction Fuzzy Hash: 8D71D271E00348CBDB04CFA4C8497EEBBB2EF45308F24422ED405AB391D7795A95CB9A

Function 00406040 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 190COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,F69FE839), ref: 00406082
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?), ref: 004061A7
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00406205
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?), ref: 00406271
LeaveCriticalSection.KERNEL32(?,?), ref: 00406296

Strings

VFSHelper::GetFileSize() , xrefs: 0040621B

Memory Dump Source

Source File: 00000006.00000002.4137209488.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.4137156906.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137406249.0000000000476000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137497400.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137574844.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137626631.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137684215.00000000004A3000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_wegame.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$CriticalSection$EnterLeave
String ID: VFSHelper::GetFileSize()
API String ID: 363805048-1800328712
Opcode ID: 345b648b3cdc7702ed62ce9e845193b573ce1a10fa7e724f4960dfa88b9c7e16
Instruction ID: 27c4f4010ac710208b6bd85b8c538d1fcb599c037b9deeff05eb05679f3f8f4e
Opcode Fuzzy Hash: 345b648b3cdc7702ed62ce9e845193b573ce1a10fa7e724f4960dfa88b9c7e16
Instruction Fuzzy Hash: 8371C271E002488BDB14DFA8C94979EBBB2FF45318F14422EE406AB3D1D7795A94CB98

Function 0045C212 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 108processCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,00000044,00000000), ref: 0045C227
GetCommandLineW.KERNEL32 ref: 0045C248

Part of subcall function 0040BC90: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,0040E9C2,?,?), ref: 0040BCDD

CreateProcessW.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 0045C2DF
?get_log_instance@base@@YAPAVILogger@1@XZ.COMMON ref: 0045C2E9

Part of subcall function 0043DD1B: __EH_prolog3.LIBCMT ref: 0043DD22

Part of subcall function 0043F2BB: __EH_prolog3_catch_GS.LIBCMT ref: 0043F2C2

Strings

e:\dailybuild_fix_5.4\wegame_client\codes\main\tgp_daemon\src\tgp_daemon_main.cpp, xrefs: 0045C30D
[ReStart] relaunch tgp failed, xrefs: 0045C324

Memory Dump Source

Source File: 00000006.00000002.4137209488.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.4137156906.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137406249.0000000000476000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137497400.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137574844.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137626631.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137684215.00000000004A3000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_wegame.jbxd

Similarity

API ID: ?get_log_instance@base@@CommandCreateH_prolog3H_prolog3_catch_LineLogger@1@Process_invalid_parameter_noinfo_noreturnmemset
String ID: [ReStart] relaunch tgp failed$e:\dailybuild_fix_5.4\wegame_client\codes\main\tgp_daemon\src\tgp_daemon_main.cpp
API String ID: 4008466797-1205512537
Opcode ID: 324b4105bb4846ec1df06337bf6346201d4a4ac560cbe75f493e578ef2174662
Instruction ID: bb770c7b4915c97400efaec5fa7d46d71de26cf1d2db4936c88a0040512f659b
Opcode Fuzzy Hash: 324b4105bb4846ec1df06337bf6346201d4a4ac560cbe75f493e578ef2174662
Instruction Fuzzy Hash: 3941827190024CDADB11EBA5CC49BDEB778AF14308F6081AEE54577182EB781F48CBA9

Function 0040A130 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 103COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,F69FE839), ref: 0040A167
LeaveCriticalSection.KERNEL32(?), ref: 0040A253

Part of subcall function 00409C60: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,F69FE839), ref: 00409E7C

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 0040A22E

Part of subcall function 00411660: _waccess.API-MS-WIN-CRT-FILESYSTEM-L1-1-0(?,00000000,F69FE839,?,?), ref: 004116B1
Part of subcall function 00411660: SetFileAttributesW.KERNEL32(?,00000080), ref: 004116CE

Strings

VFSHelper::EndLoadFileSet() , xrefs: 0040A17C
VFSHelper::EndLoadFileSet(), xrefs: 0040A18B
fileSetID, xrefs: 0040A196

Memory Dump Source

Source File: 00000006.00000002.4137209488.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.4137156906.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137406249.0000000000476000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137497400.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137574844.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137626631.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137684215.00000000004A3000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_wegame.jbxd

Similarity

API ID: CriticalSection_invalid_parameter_noinfo_noreturn$AttributesEnterFileLeave_waccess
String ID: VFSHelper::EndLoadFileSet()$VFSHelper::EndLoadFileSet() $fileSetID
API String ID: 2819506187-656408057
Opcode ID: ac882ee950cb703aa8114ed81b49964fa4c1de672dfe87de940f9fa5a0df7570
Instruction ID: 0a0a606189e9194de7940ca0bc319d4484a881f76b66fb534aae6fd3817f4ad1
Opcode Fuzzy Hash: ac882ee950cb703aa8114ed81b49964fa4c1de672dfe87de940f9fa5a0df7570
Instruction Fuzzy Hash: F2312571A042089BDB04CFA4D885BEEB765EB05324F20427FE425A73C1D73D5A48CB9A

Function 6C56C730 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 46filestringCOMMON

Download Yara Rule

APIs

fopen.API-MS-WIN-CRT-STDIO-L1-1-0(00000010,?,00000004,00000008,00000004,00000001,?,?,?,6C56D03A,?,00000004,?,?,?,00000004), ref: 6C56C774
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C56C783
strerror.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000), ref: 6C56C78B

Strings

%s: %s, xrefs: 6C56C793

Memory Dump Source

Source File: 00000006.00000002.4140707867.000000006C509000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000006.00000002.4140614744.000000006C500000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.4140707867.000000006C501000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.4141048756.000000006C57A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.4141124009.000000006C583000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.4141184681.000000006C584000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.4141184681.000000006C587000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c500000_wegame.jbxd

Similarity

API ID: _errnofopenstrerror
String ID: %s: %s
API String ID: 399915861-3740598653
Opcode ID: afcb8a1b2dea9cf316e5b505b0dfaa83198fc0071471fd993f6afef888f7d6eb
Instruction ID: c5dce73222899ca13682cb027fb6ee300a167db0e5a7c6f9d05b26e4d98237b6
Opcode Fuzzy Hash: afcb8a1b2dea9cf316e5b505b0dfaa83198fc0071471fd993f6afef888f7d6eb
Instruction Fuzzy Hash: 5B0165B1200201ABD3149F54CC84BAAFBB9FB86758F000548F8458B780DB62EC84CBA2

Function 6C55F890 Relevance: 9.4, APIs: 2, Strings: 4, Instructions: 410stringCOMMON

Download Yara Rule

APIs

strchr.VCRUNTIME140(?,00000025), ref: 6C55F916
strchr.VCRUNTIME140(?,00000025), ref: 6C55FC93

Strings

0x, xrefs: 6C55FB30
NULL, xrefs: 6C55FB17
(null), xrefs: 6C55F9F0, 6C55FA19, 6C55FA1A
, xrefs: 6C55F8E5

Memory Dump Source

Source File: 00000006.00000002.4140707867.000000006C509000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000006.00000002.4140614744.000000006C500000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.4140707867.000000006C501000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.4141048756.000000006C57A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.4141124009.000000006C583000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.4141184681.000000006C584000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.4141184681.000000006C587000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c500000_wegame.jbxd

Similarity

API ID: strchr
String ID: $(null)$0x$NULL
API String ID: 2830005266-3301898425
Opcode ID: cd8c22436b3400a0193e4d6a777e6880f7c46b48ad3f7bab0d4f2c80eb768a50
Instruction ID: c6729af289bc8e8a116f317ddb4ab36a2f188c6eaec013997ba7e84d6f53a6ef
Opcode Fuzzy Hash: cd8c22436b3400a0193e4d6a777e6880f7c46b48ad3f7bab0d4f2c80eb768a50
Instruction Fuzzy Hash: 31F17CB16087429FD314CF28C85086ABBF1FF99348F548A5EF89987712D331E925CB92

Function 00442329 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 118COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00442333
memset.VCRUNTIME140(?,00000000,00000414,0000047C,004443B8,?,00000000,?,?,00000000,0047D1B0,?,00000000,?,?,?), ref: 00442361
_wcsicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,desc.lua), ref: 004423EB
?u16to8@common@ierd_tgp@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@4@@Z.COMMON(?,?,?,?,?), ref: 00442430

Strings

desc.lua, xrefs: 004423E5

Memory Dump Source

Source File: 00000006.00000002.4137209488.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.4137156906.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137406249.0000000000476000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137497400.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137574844.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137626631.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137684215.00000000004A3000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_wegame.jbxd

Similarity

API ID: ?u16to8@common@ierd_tgp@@D@2@@4@@D@std@@H_prolog3_U?$char_traits@U?$char_traits@_V?$allocator@V?$allocator@_V?$basic_string@V?$basic_string@_W@2@@std@@W@std@@_wcsicmpmemset
String ID: desc.lua
API String ID: 3802480434-3539228332
Opcode ID: c33bccc5f6a07bbe73ceae8c79c32612f9b03d1202f763f2e843b1878d62ca9e
Instruction ID: 66c2641bd24fb6f6d556978b437ac45ec293262b78bfae897c72dce413562dc1
Opcode Fuzzy Hash: c33bccc5f6a07bbe73ceae8c79c32612f9b03d1202f763f2e843b1878d62ca9e
Instruction Fuzzy Hash: CA416171900219DBDF10DFA4CD45ADEBBB8EF04314F5444AEF505A7282EB78AB44CB69

Function 6C524930 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 97libraryCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 6C524934
LoadLibraryA.KERNEL32(00000000), ref: 6C52497B
SetLastError.KERNEL32(00000000), ref: 6C524988

Strings

%s.dll, xrefs: 6C524968
cannot load module '%s': %s, xrefs: 6C524996

Memory Dump Source

Source File: 00000006.00000002.4140707867.000000006C509000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000006.00000002.4140614744.000000006C500000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.4140707867.000000006C501000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.4141048756.000000006C57A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.4141124009.000000006C583000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.4141184681.000000006C584000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.4141184681.000000006C587000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c500000_wegame.jbxd

Similarity

API ID: ErrorLast$LibraryLoad
String ID: %s.dll$cannot load module '%s': %s
API String ID: 1136134869-4289185444
Opcode ID: 32740f000b326e9c45245467d679f9e6cb68a79517f13aa8fbdf8c699f11fff0
Instruction ID: f0eb1c636bb94dec2555424b2596c521b868f680f36b8deabc082964f4c1e387
Opcode Fuzzy Hash: 32740f000b326e9c45245467d679f9e6cb68a79517f13aa8fbdf8c699f11fff0
Instruction Fuzzy Hash: 34116F783067058BCB100E145C74BB37BE99F8765DF345186F8985BAD2D71EC842A668

Function 6C522730 Relevance: 8.0, APIs: 6, Instructions: 461COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4140707867.000000006C509000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000006.00000002.4140614744.000000006C500000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.4140707867.000000006C501000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.4141048756.000000006C57A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.4141124009.000000006C583000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.4141184681.000000006C584000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.4141184681.000000006C587000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c500000_wegame.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 202ab90366710bd51c29cde0018a092d125c8759b1dcfcc5a22c49bf30287560
Instruction ID: 0f6b285b24de5ebd72aa9eacc35b7c0cf87a6d424c068a463304b1cb52ba526a
Opcode Fuzzy Hash: 202ab90366710bd51c29cde0018a092d125c8759b1dcfcc5a22c49bf30287560
Instruction Fuzzy Hash: 8EE1393AA146149BC701CF29DC9079AB3E0FF86379F184666F844E7690E33DE985CB61

Function 004641B8 Relevance: 7.6, APIs: 5, Instructions: 129COMMON

Download Yara Rule

APIs

?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ.MSVCP140 ref: 004641E2
?_Pninc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEPA_WXZ.MSVCP140 ref: 00464207

Memory Dump Source

Source File: 00000006.00000002.4137209488.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.4137156906.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137406249.0000000000476000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137497400.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137574844.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137626631.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137684215.00000000004A3000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_wegame.jbxd

Similarity

API ID: ?pptr@?$basic_streambuf@D@std@@@std@@Pninc@?$basic_streambuf@_U?$char_traits@U?$char_traits@_W@std@@@std@@
String ID:
API String ID: 3900108780-0
Opcode ID: 907bd402f971a10c4ff396255b32c59365c7ec56178a91d25f8ce95495030ec2
Instruction ID: c2b86b7ca9ae6670c1ea4942c7842519604d409812b7d57d0379c0f6dfd666b5
Opcode Fuzzy Hash: 907bd402f971a10c4ff396255b32c59365c7ec56178a91d25f8ce95495030ec2
Instruction Fuzzy Hash: F3419335A00606EFCB04DF6CD4909A9BBF1FF89354B1581AAE80597B50EB34ED60CF99

Function 00418290 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 209COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,0041823E,?,F69FE839,?,?,?,?,F69FE839), ref: 004182B1
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,0041823E,?,F69FE839,?,?,?,?,F69FE839), ref: 0041831B
?_Xlength_error@std@@YAXPBD@Z.MSVCP140(map/set<T> too long,?,0041823E,?,F69FE839,?,?,?,?,F69FE839), ref: 0041834F

Strings

map/set<T> too long, xrefs: 0041834A

Memory Dump Source

Source File: 00000006.00000002.4137209488.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.4137156906.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137406249.0000000000476000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137497400.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137574844.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137626631.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137684215.00000000004A3000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_wegame.jbxd

Similarity

API ID: Xlength_error@std@@_invalid_parameter_noinfo_noreturnfree
String ID: map/set<T> too long
API String ID: 2444646146-1285458680
Opcode ID: 3c1236fd4fad1716ced704368b88f06ed1eb9bdd4ca8095a0efc616993bb0051
Instruction ID: 7f64e8372992fb0e918a068c6b85cccb792a96c820d0d73f9c5a8f1de8edd6b9
Opcode Fuzzy Hash: 3c1236fd4fad1716ced704368b88f06ed1eb9bdd4ca8095a0efc616993bb0051
Instruction Fuzzy Hash: 908115706006418FC725CF19C588A56FBE1BF09318B29C59EE84D8B762DB39EC81CB48

Function 6C56CF10 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 167fileCOMMON

Download Yara Rule

APIs

fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,?,?), ref: 6C56CF5C

Strings

%.14g, xrefs: 6C56CF9F

Memory Dump Source

Source File: 00000006.00000002.4140707867.000000006C509000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000006.00000002.4140614744.000000006C500000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.4140707867.000000006C501000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.4141048756.000000006C57A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.4141124009.000000006C583000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.4141184681.000000006C584000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.4141184681.000000006C587000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c500000_wegame.jbxd

Similarity

API ID: fwrite
String ID: %.14g
API String ID: 3559309478-3267037135
Opcode ID: 9cae5813e3efe03aade4c3ae1d2700739b56347f504c24e3b25dcdc31bf51c9e
Instruction ID: c1fd6659720a4cc37a6b7d67458f082740fb541f7005e678abe40a45af095637
Opcode Fuzzy Hash: 9cae5813e3efe03aade4c3ae1d2700739b56347f504c24e3b25dcdc31bf51c9e
Instruction Fuzzy Hash: 3941F4716006019BCB10DF1EDC40A8AF3B6FF85328F548A59FC6597BA1E330F9558B91

Function 6C50ADD0 Relevance: 6.2, APIs: 4, Instructions: 240COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C509A2E,?), ref: 6C50AF0F
VirtualQuery.KERNEL32(?,?,0000001C), ref: 6C50AF28
VirtualFree.KERNEL32(?,00000000,00008000), ref: 6C50AF56
SetLastError.KERNEL32(00000000), ref: 6C50AF6B

Memory Dump Source

Source File: 00000006.00000002.4140707867.000000006C509000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000006.00000002.4140614744.000000006C500000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.4140707867.000000006C501000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.4141048756.000000006C57A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.4141124009.000000006C583000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.4141184681.000000006C584000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.4141184681.000000006C587000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c500000_wegame.jbxd

Similarity

API ID: ErrorLastVirtual$FreeQuery
String ID:
API String ID: 2187276999-0
Opcode ID: e7616c67557e8ac1322fdc5bda220c16ab7e53ed2c710ab2a515b176c7709de5
Instruction ID: 0eb4797bf8b5594aff6650b7d745d7c227f5c590a94ac2c3d9841c46914a662a
Opcode Fuzzy Hash: e7616c67557e8ac1322fdc5bda220c16ab7e53ed2c710ab2a515b176c7709de5
Instruction Fuzzy Hash: CCA138B47057068FD724CF19C890A5AB7F1BF89318F248A2DE465CBB51E730E945CB91

Function 6C50152D Relevance: 6.2, APIs: 4, Instructions: 199COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C56339A
GetLastError.KERNEL32 ref: 6C5633A6
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C563531
SetLastError.KERNEL32(?), ref: 6C563541

Memory Dump Source

Source File: 00000006.00000002.4140707867.000000006C501000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000006.00000002.4140614744.000000006C500000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.4140707867.000000006C509000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.4141048756.000000006C57A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.4141124009.000000006C583000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.4141184681.000000006C584000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.4141184681.000000006C587000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c500000_wegame.jbxd

Similarity

API ID: ErrorLast_errno
String ID:
API String ID: 3939687465-0
Opcode ID: 1e347bc0bf5a8b6999c4cb38008d1b5711dd640bcc6401016c6d10e94d4f47cf
Instruction ID: e7e0b208e6587eb35fe85ae97e051a7c09c6cf007f3c3e8cb0bd05d28f7b86ad
Opcode Fuzzy Hash: 1e347bc0bf5a8b6999c4cb38008d1b5711dd640bcc6401016c6d10e94d4f47cf
Instruction Fuzzy Hash: B66100716047058FC314CF29DC84AAAF7E0FF86314F44466AD89687F61E730E559CBA5

Function 6C5652F0 Relevance: 6.2, APIs: 3, Strings: 1, Instructions: 184COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000050,?,?), ref: 6C56549D
memcpy.VCRUNTIME140(00000050,?,?,00000050,?,?), ref: 6C5654B3
memcpy.VCRUNTIME140(?,?,?,00000050,?,?,00000050,?,?), ref: 6C5654CE

Strings

stop, xrefs: 6C565522

Memory Dump Source

Source File: 00000006.00000002.4140707867.000000006C509000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000006.00000002.4140614744.000000006C500000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.4140707867.000000006C501000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.4141048756.000000006C57A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.4141124009.000000006C583000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.4141184681.000000006C584000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.4141184681.000000006C587000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c500000_wegame.jbxd

Similarity

API ID: memcpy
String ID: stop
API String ID: 3510742995-3109426870
Opcode ID: 32b7a25ae34037639f4db5a4fcf3afdbb6b4a9257111fab2ae872d8f1c597bcb
Instruction ID: a40a2955c54bde7ccc28d736364a0bbd68db7ba83fb0bf2c3ad3d4f6c6cc2e64
Opcode Fuzzy Hash: 32b7a25ae34037639f4db5a4fcf3afdbb6b4a9257111fab2ae872d8f1c597bcb
Instruction Fuzzy Hash: E0818875504285DBCB14DF28C880AA6BBF0FF59304F0442AEFD889B356E735E995CBA1

Function 00414000 Relevance: 6.1, APIs: 4, Instructions: 84synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF,F69FE839,?,?,?,00000000,0046BC90,000000FF,?,00413883), ref: 0041403D
CloseHandle.KERNEL32(?,?,00000000,0046BC90,000000FF,?,00413883), ref: 0041405E
SetEvent.KERNEL32(?,00000000,?,00000000,0046BC90,000000FF,?,00413883), ref: 004140B1

Memory Dump Source

Source File: 00000006.00000002.4137209488.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.4137156906.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137406249.0000000000476000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137497400.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137574844.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137626631.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137684215.00000000004A3000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_wegame.jbxd

Similarity

API ID: CloseEventHandleObjectSingleWait
String ID:
API String ID: 2055531096-0
Opcode ID: 3b12b32b317a456505defa8f2cb76768b0773ca9c982143949615f68510830d8
Instruction ID: 484fc1974e43a7f3e7f75110cef3cce6bd0e3565dfa45da622cdca876c279fc6
Opcode Fuzzy Hash: 3b12b32b317a456505defa8f2cb76768b0773ca9c982143949615f68510830d8
Instruction Fuzzy Hash: 74319475604244DFDB10CF5AD884B96BBE8FB48721F0481AAED0DCB381D739D884CBA4

Function 6C5011A4 Relevance: 6.1, APIs: 4, Instructions: 53COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 6C509DB8
VirtualQuery.KERNEL32(?,0000001C,0000001C), ref: 6C509DCE
VirtualFree.KERNEL32(?,00000000,00008000), ref: 6C509DFC
SetLastError.KERNEL32(00000000), ref: 6C509E11

Memory Dump Source

Source File: 00000006.00000002.4140707867.000000006C501000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000006.00000002.4140614744.000000006C500000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.4140707867.000000006C509000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.4141048756.000000006C57A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.4141124009.000000006C583000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.4141184681.000000006C584000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.4141184681.000000006C587000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c500000_wegame.jbxd

Similarity

API ID: ErrorLastVirtual$FreeQuery
String ID:
API String ID: 2187276999-0
Opcode ID: 4ac11c3a914170cf319d9a29b8e8b73efdd89326b1565a9b753d38542ffb945d
Instruction ID: 33c476728170401b303b0f6dd5fc948f149e6a2f8f5208f8a3efe82418043608
Opcode Fuzzy Hash: 4ac11c3a914170cf319d9a29b8e8b73efdd89326b1565a9b753d38542ffb945d
Instruction Fuzzy Hash: DE11CB32349311DBDB00DE16DC40B5BB3B8BB86B45F190529F9809A509E731ED18CABA

Function 00420280 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 221COMMON

Download Yara Rule

APIs

Part of subcall function 0041C7B0: memset.VCRUNTIME140(?,00000000,0000009C,?,?), ref: 0041C7DD

?_Xlength_error@std@@YAXPBD@Z.MSVCP140(list<T> too long,?,?,-00000005,F69FE839,?,?,00000001), ref: 00420395

Strings

list<T> too long, xrefs: 00420390

Memory Dump Source

Source File: 00000006.00000002.4137209488.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.4137156906.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137406249.0000000000476000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137497400.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137574844.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137626631.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137684215.00000000004A3000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_wegame.jbxd

Similarity

API ID: Xlength_error@std@@memset
String ID: list<T> too long
API String ID: 1527646195-4027344264
Opcode ID: c183ac4c247af18236457f398187009457f5b10da10e454d691a1056fffd49de
Instruction ID: 7049f754ce7f7fdc0192e931f07cab5cc0646f13abc3e8938de8ff08e6044b8b
Opcode Fuzzy Hash: c183ac4c247af18236457f398187009457f5b10da10e454d691a1056fffd49de
Instruction Fuzzy Hash: 9A913770600224DFDF14CF64D884BAA77B5BF09308F4441EAED09AB392D779A984CF65

Function 004220E0 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 216COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,F69FE839,?,00000008), ref: 0042217F
?_Xlength_error@std@@YAXPBD@Z.MSVCP140(map/set<T> too long), ref: 004221AF

Strings

map/set<T> too long, xrefs: 004221AA

Memory Dump Source

Source File: 00000006.00000002.4137209488.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.4137156906.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137406249.0000000000476000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137497400.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137574844.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137626631.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137684215.00000000004A3000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_wegame.jbxd

Similarity

API ID: Xlength_error@std@@_invalid_parameter_noinfo_noreturn
String ID: map/set<T> too long
API String ID: 2650047715-1285458680
Opcode ID: 2969f62950be10b003436f3b1327de3452c0550c4b423c0016199dc75c1cddf5
Instruction ID: c4dfd470b7221d8a93e5fce9a388aa10284d42b45c94d4e77f5d005a009d3bbc
Opcode Fuzzy Hash: 2969f62950be10b003436f3b1327de3452c0550c4b423c0016199dc75c1cddf5
Instruction Fuzzy Hash: 14913870600251EFC715CF19D688A15FBE1BF09318B59C19AE80D8B762C7BAEC91CB58

Function 0046A260 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 152windowCOMMON

Download Yara Rule

APIs

FormatMessageA.KERNEL32(00001300,00000000,?,00000400,?,00000000,00000000,F69FE839), ref: 0046A2B1
LocalFree.KERNEL32(00000000,00000000,00000001), ref: 0046A3FB

Part of subcall function 00420F10: memcpy.VCRUNTIME140(00000000,00000000,00000000,004204D1,00000000,00000000,00000000,?,00423FD2,00000000,00000001), ref: 00420F37

Part of subcall function 0040C8D0: ?_Xout_of_range@std@@YAXPBD@Z.MSVCP140(invalid string position,004021E1), ref: 0040C8D5

Strings

Unknown error, xrefs: 0046A2D6

Memory Dump Source

Source File: 00000006.00000002.4137209488.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.4137156906.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137406249.0000000000476000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137497400.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137574844.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137626631.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137684215.00000000004A3000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_wegame.jbxd

Similarity

API ID: FormatFreeLocalMessageXout_of_range@std@@memcpy
String ID: Unknown error
API String ID: 1650512351-83687255
Opcode ID: 28043589d9540ca225c1abfaffd2b614afca6e6572f96fc9111a20ec48c5c524
Instruction ID: 0bb0acffc4febae4779684d8628c3fa293e0b9f3ef85ff41a24718c0fe1970c4
Opcode Fuzzy Hash: 28043589d9540ca225c1abfaffd2b614afca6e6572f96fc9111a20ec48c5c524
Instruction Fuzzy Hash: FB517B30A04249DFDB04CFA4C954BEEBBF5EF48314F24411AD801B7781E775AA85CBA6

Function 004620DD Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

Part of subcall function 00420F10: memcpy.VCRUNTIME140(00000000,00000000,00000000,004204D1,00000000,00000000,00000000,?,00423FD2,00000000,00000001), ref: 00420F37

WideCharToMultiByte.KERNEL32(00465CA7,00000000,?,00000001,00000000,00000000,00000000,00000000,(null),00000006,F69FE839,Function_0004BF7F,?,?,?,004741EB), ref: 00462144
WideCharToMultiByte.KERNEL32(00465CA7,00000000,?,00000001,Function_0004BF7F,00000000,00000000,00000000,00000000,00000000,?,?,?,004741EB,000000FF), ref: 00462170

Strings

(null), xrefs: 00462111

Memory Dump Source

Source File: 00000006.00000002.4137209488.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.4137156906.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137406249.0000000000476000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137497400.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137574844.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137626631.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137684215.00000000004A3000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_wegame.jbxd

Similarity

API ID: ByteCharMultiWide$memcpy
String ID: (null)
API String ID: 497159995-3941151225
Opcode ID: 5225d0f369c8b2602972eb926ee96a8c5d9c4c5a17799acdee48ad157279efc9
Instruction ID: ae727bc849bd5762f5848a6f917c4b8c9da25bb687e90bce87eac2231aabfe0c
Opcode Fuzzy Hash: 5225d0f369c8b2602972eb926ee96a8c5d9c4c5a17799acdee48ad157279efc9
Instruction Fuzzy Hash: 36117CB1600658BFEB21CF54DD85BABBBB9FB08754F00452EF51693290D3B59D108B64

Function 6C521BB0 Relevance: 5.3, APIs: 4, Instructions: 290COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?), ref: 6C521C3E
memset.VCRUNTIME140(?,00000000,?), ref: 6C521C5A

Memory Dump Source

Source File: 00000006.00000002.4140707867.000000006C509000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000006.00000002.4140614744.000000006C500000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.4140707867.000000006C501000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.4141048756.000000006C57A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.4141124009.000000006C583000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.4141184681.000000006C584000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.4141184681.000000006C587000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c500000_wegame.jbxd

Similarity

API ID: memcpymemset
String ID:
API String ID: 1297977491-0
Opcode ID: 3d87137e892351106c64cd0f2661191be611ec93d19a362d3217fe78aa0a1b82
Instruction ID: 5dceb78bc529b275d6353eb3dc364eb12a6b015f22a94adcad4c2784393f675f
Opcode Fuzzy Hash: 3d87137e892351106c64cd0f2661191be611ec93d19a362d3217fe78aa0a1b82
Instruction Fuzzy Hash: 975105726042149BC710DA59DC80E5BB3E9FBC8358F150A2DF969E7690E736ED04CB62

Function 0045C1B2 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 29COMMON

Download Yara Rule

APIs

?get_log_instance@base@@YAPAVILogger@1@XZ.COMMON ref: 0045C1B2

Part of subcall function 0043DD1B: __EH_prolog3.LIBCMT ref: 0043DD22

Part of subcall function 0043F2BB: __EH_prolog3_catch_GS.LIBCMT ref: 0043F2C2

Strings

e:\dailybuild_fix_5.4\wegame_client\codes\main\tgp_daemon\src\tgp_daemon_main.cpp, xrefs: 0045C1D6
[ReStart]lexical cast pid to string throw exception., xrefs: 0045C1ED

Memory Dump Source

Source File: 00000006.00000002.4137209488.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.4137156906.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137406249.0000000000476000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137497400.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137574844.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137626631.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137684215.00000000004A3000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_wegame.jbxd

Similarity

API ID: ?get_log_instance@base@@H_prolog3H_prolog3_catch_Logger@1@
String ID: [ReStart]lexical cast pid to string throw exception.$e:\dailybuild_fix_5.4\wegame_client\codes\main\tgp_daemon\src\tgp_daemon_main.cpp
API String ID: 750329627-3187714004
Opcode ID: 97c04f61376f4262aee37bab4515d34a2512730c36954df1c75e7c25105bfcfd
Instruction ID: 4e6c623674327d5d46a989626de2266fb6ce4e72c19b40c3f8bb11af0db0e268
Opcode Fuzzy Hash: 97c04f61376f4262aee37bab4515d34a2512730c36954df1c75e7c25105bfcfd
Instruction Fuzzy Hash: BBF0A771E8171166CA24E654CC46FDE33105B64B05F6040DAF8853B3C3DFAD5E49878D

Function 0044E1CC Relevance: 5.2, APIs: 4, Instructions: 190COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(00000000,?,4762F015,4762F015,00000003,00000000,00000000,-00000001,?), ref: 0044E274
memset.VCRUNTIME140(00000000,?,4762F015,4762F015,?,-00000001,00000004,?,00000003,00000000,00000000,-00000001,?), ref: 0044E2A4
memset.VCRUNTIME140(00000000,?,00000000,0044C5C2,?,00000000,00000003,00000003,00000000,00000000,-00000001,?,0044C5C2,00000000,?,Function_0004BF7F), ref: 0044E313

Memory Dump Source

Source File: 00000006.00000002.4137209488.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.4137156906.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137406249.0000000000476000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137497400.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137574844.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137626631.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.4137684215.00000000004A3000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_wegame.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: a1e67a3df24f69182845e6d35efe5563a3ae61b7702063ddbe6b2f643396bb24
Instruction ID: 6cd02c769e7a90b40abcc7e6d06c6c9006eb3398da6ed493155c8611137d7991
Opcode Fuzzy Hash: a1e67a3df24f69182845e6d35efe5563a3ae61b7702063ddbe6b2f643396bb24
Instruction Fuzzy Hash: E3516071A00119AFDB14DF66CD85DBF7BA9FF49304B04409AF945A7301E678EE108BAA

Function 6C509705 Relevance: 5.2, APIs: 4, Instructions: 153memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,?,00103000,00000004), ref: 6C50973D
SetLastError.KERNEL32(00000000), ref: 6C509746
VirtualAlloc.KERNEL32(00000000,?,00003000,00000004), ref: 6C5097BF
SetLastError.KERNEL32(00000000), ref: 6C5097C8

Memory Dump Source

Source File: 00000006.00000002.4140707867.000000006C509000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000006.00000002.4140614744.000000006C500000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.4140707867.000000006C501000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.4141048756.000000006C57A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.4141124009.000000006C583000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.4141184681.000000006C584000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.4141184681.000000006C587000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c500000_wegame.jbxd

Similarity

API ID: AllocErrorLastVirtual
String ID:
API String ID: 497505419-0
Opcode ID: 0a0bbd4c3454847723562e6818aac13f85c09f8f90e58c245a48f2e72b2a2ef2
Instruction ID: 6d13148074c28e5e30d0eebaab7ecd54724ff160153333425e26c40ee9ae297d
Opcode Fuzzy Hash: 0a0bbd4c3454847723562e6818aac13f85c09f8f90e58c245a48f2e72b2a2ef2
Instruction Fuzzy Hash: FF51B032B017159FD710CF14DC80A6AB7E9FF82718F14866DD959DBB49E332E80A8B91

Function 6C509700 Relevance: 5.1, APIs: 4, Instructions: 118memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,?,00103000,00000004), ref: 6C50973D
SetLastError.KERNEL32(00000000), ref: 6C509746
VirtualAlloc.KERNEL32(00000000,?,00003000,00000004), ref: 6C5097BF
SetLastError.KERNEL32(00000000), ref: 6C5097C8

Memory Dump Source

Source File: 00000006.00000002.4140707867.000000006C509000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000006.00000002.4140614744.000000006C500000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.4140707867.000000006C501000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.4141048756.000000006C57A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.4141124009.000000006C583000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.4141184681.000000006C584000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.4141184681.000000006C587000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c500000_wegame.jbxd

Similarity

API ID: AllocErrorLastVirtual
String ID:
API String ID: 497505419-0
Opcode ID: 6ed4e5beac525d58629144d50d185f7d306fd87bd4422e664cfc855928483bac
Instruction ID: 039393bdf8b51c07ea0de85c912a387a5cecbce5ae8a5a63d1b5d97847dc7eae
Opcode Fuzzy Hash: 6ed4e5beac525d58629144d50d185f7d306fd87bd4422e664cfc855928483bac
Instruction Fuzzy Hash: 20418032B013159BDB10CF64CC90B5AB7E9FF82718F15862DD959DBA45E732E80A8B90

Function 6C50111D Relevance: 5.1, APIs: 4, Instructions: 71memoryCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 6C509C72
VirtualAlloc.KERNEL32(00000000,00020000,00003000,00000004), ref: 6C509C88
SetLastError.KERNEL32(00000000), ref: 6C509C91
memset.VCRUNTIME140(00000008,00000000,000001B8), ref: 6C509CC2

Memory Dump Source

Source File: 00000006.00000002.4140707867.000000006C501000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C500000, based on PE: true

Associated: 00000006.00000002.4140614744.000000006C500000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.4140707867.000000006C509000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.4141048756.000000006C57A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.4141124009.000000006C583000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.4141184681.000000006C584000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.4141184681.000000006C587000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c500000_wegame.jbxd

Similarity

API ID: ErrorLast$AllocVirtualmemset
String ID:
API String ID: 141116005-0
Opcode ID: fdff5c8c73d18590aef6f0db49ada500862c4186f04b30c24f69bc8c6bcdf2c7
Instruction ID: a773f9dc28a6e6f9816f2240b14f04a3f57d6c5f6e876c8c6109bab7833c4cb3
Opcode Fuzzy Hash: fdff5c8c73d18590aef6f0db49ada500862c4186f04b30c24f69bc8c6bcdf2c7
Instruction Fuzzy Hash: 312126B3B412109BD7048F28EC94752BBD0AB82338F19433DE9298F6C6D3748405CB84

Description:	Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. In the case of Lateral Movement, this may occur through modification of executable files stored on removable media or by copying malware and renaming it to look like a legitimate file to trick users into executing it on a separate system. In the case of Initial Access, this may occur through manual manipulation of the media, modification of systems used to initially format the media, or modification to the media's firmware itself.
Tactics:	Initial Access, Lateral Movement
Data Sources:	Drive: Drive Creation, File: File Access, File: File Creation, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify or add LSASS drivers to obtain persistence on compromised systems. The Windows security subsystem is a set of components that manage and enforce the security policy for a computer or domain. The Local Security Authority (LSA) is the main component responsible for local security policy and user authentication. The LSA includes multiple dynamic link libraries (DLLs) associated with various other security functions, all of which run in the context of the LSA Subsystem Service (LSASS) lsass.exe process.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Driver: Driver Load, File: File Creation, File: File Modification, Module: Module Load
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use bootkits to persist on systems. Bootkits reside at a layer below the operating system and may make it difficult to perform full remediation unless an organization suspects one was used and can act accordingly.
Tactics:	Defense Evasion, Persistence
Data Sources:	Drive: Drive Modification
Platforms:	Linux, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report lets-test.msi

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Config.Msi\61335e.rbs

C:\Program Files (x86)\Common Files\Lua51.dll

C:\Program Files (x86)\Common Files\adapt_for_imports.dll

C:\Program Files (x86)\Common Files\beacon_sdk.dll

C:\Program Files (x86)\Common Files\common.dll

C:\Program Files (x86)\Common Files\log\wegame.20240718-184033-778.log

C:\Program Files (x86)\Common Files\log\wegame.mem.log

C:\Program Files (x86)\Common Files\wegame.exe

C:\Program Files (x86)\haxGhXjmBFM.exe

C:\Program Files (x86)\haxGhXjmBFM\LetsPRO.exe

Windows Analysis Report
lets-test.msi

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system.Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable storage. The information may be used to enhance their awareness of the system and network environment or may be used for further actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre