Edit tour

Windows Analysis Report
IRPF2024-0940959038w904598304w985036.msi

Overview

General Information

Sample name:	IRPF2024-0940959038w904598304w985036.msi
Analysis ID:	1513060
MD5:	55e1b6a518bc3e243d8d856ee17430aa
SHA1:	f83dc91c91f89d6a321892d54b4de229041b07d1
SHA256:	baf5979f4c227be5b3f1bf4f03e5902e8b7fcc2dad38068f363a0096cb12a536
Tags:	msi
Infos:

Detection

Score:	76
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

AI detected suspicious sample

Creates multiple autostart registry keys

Overwrites code with unconditional jumps - possibly settings hooks in foreign process

PE file contains section with special chars

Switches to a custom stack to bypass stack traces

Checks for available system drives (often done to infect USB drives)

Checks if the current process is being debugged

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates files inside the system directory

Deletes files inside the Windows folder

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Entry point lies outside standard sections

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

HTTP GET or POST without a user agent

Launches processes in debugging mode, may be used to hinder debugging

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

One or more processes crash

PE file contains executable resources (Code or Archives)

PE file contains more sections than normal

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Sigma detected: CurrentVersion Autorun Keys Modification

Suricata IDS alerts with low severity for network traffic

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

msiexec.exe (PID: 6860 cmdline: "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\IRPF2024-0940959038w904598304w985036.msi" MD5: E5DA170027542E25EDE42FC54C929077)

msiexec.exe (PID: 4892 cmdline: C:\Windows\system32\msiexec.exe /V MD5: E5DA170027542E25EDE42FC54C929077)

msiexec.exe (PID: 2244 cmdline: C:\Windows\syswow64\MsiExec.exe -Embedding 5B841E4EC1525DEC8E125CA4E79284A2 MD5: 9D09DC1EDA745A5F87553048E57620CF)

Flexpcis.exe (PID: 5976 cmdline: "C:\Users\user\Contacts\Flexpcis.exe" MD5: E04F15D35A1807C4D74D2538D5FE28C9)

Flexpcis.exe (PID: 1008 cmdline: "C:\Users\user\Contacts\Flexpcis.exe" MD5: E04F15D35A1807C4D74D2538D5FE28C9)

WerFault.exe (PID: 6068 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 1008 -s 628 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 6024 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 1008 -s 628 MD5: C31336C1EFC2CCB44B4326EA793040F2)

Flexpcis.exe (PID: 672 cmdline: "C:\Users\user\Contacts\Flexpcis.exe" MD5: E04F15D35A1807C4D74D2538D5FE28C9)

WerFault.exe (PID: 1080 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 672 -s 724 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 6440 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 672 -s 628 MD5: C31336C1EFC2CCB44B4326EA793040F2)

Flexpcis.exe (PID: 5648 cmdline: "C:\Users\user\Contacts\Flexpcis.exe" MD5: E04F15D35A1807C4D74D2538D5FE28C9)

WerFault.exe (PID: 6736 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 5648 -s 628 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 3912 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 5648 -s 628 MD5: C31336C1EFC2CCB44B4326EA793040F2)

Flexpcis.exe (PID: 5908 cmdline: "C:\Users\user\Contacts\Flexpcis.exe" MD5: E04F15D35A1807C4D74D2538D5FE28C9)

WerFault.exe (PID: 2704 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 5908 -s 624 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 5516 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 5908 -s 1004 MD5: C31336C1EFC2CCB44B4326EA793040F2)

cleanup

Sigma Signatures

System Summary

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\Contacts\Flexpcis.exe, EventID: 13, EventType: SetValue, Image: C:\Windows\System32\msiexec.exe, ProcessId: 4892, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Novo Valor

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-18T12:32:28.265873+0200	2803304	3	Unknown Traffic	192.168.2.6	49715	50.116.112.138	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for dropped file

Source: C:\Users\user\Contacts\Drivespan.dll

Virustotal: Detection: 32%

Perma Link

Multi AV Scanner detection for submitted file

Source: IRPF2024-0940959038w904598304w985036.msi

Virustotal: Detection: 7%

Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.8% probability

Source:

Binary string: c:\builds\workspace\Applications\Transfer_common\src\Release\Transfer.pdb source: Flexpcis.exe, 00000004.00000000.2175400389.000000000011F000.00000002.00000001.01000000.00000003.sdmp, Flexpcis.exe, 00000006.00000000.2285448613.000000000011F000.00000002.00000001.01000000.00000003.sdmp, Flexpcis.exe, 00000006.00000002.2741170201.000000000011F000.00000002.00000001.01000000.00000003.sdmp, Flexpcis.exe, 00000009.00000000.2372725998.000000000011F000.00000002.00000001.01000000.00000003.sdmp, Flexpcis.exe, 00000009.00000002.2826466455.000000000011F000.00000002.00000001.01000000.00000003.sdmp

Source: C:\Windows\System32\msiexec.exe	File opened: z:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: x:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: v:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: t:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: r:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: p:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: n:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: l:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: j:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: h:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: f:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: b:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: y:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: w:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: u:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: s:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: q:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: o:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: m:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: k:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: i:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: g:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: e:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: c:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: a:	Jump to behavior

Source: C:\Users\user\Contacts\Flexpcis.exe

Code function: 6_2_001175CA FindFirstFileExW,

6_2_001175CA

Source: global traffic

HTTP traffic detected: GET /dddd/inspecionando.php HTTP/1.1Host: www.rodovalhoadvogados.com.brCache-Control: no-cache

Source: Network traffic

Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.6:49715 -> 50.116.112.138:80

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET /dddd/inspecionando.php HTTP/1.1Host: www.rodovalhoadvogados.com.brCache-Control: no-cache

Source: global traffic

DNS traffic detected: DNS query: www.rodovalhoadvogados.com.br

Source: Flexpcis.exe, 00000006.00000003.2578838717.0000000003000000.00000004.00001000.00020000.00000000.sdmp, Flexpcis.exe, 00000006.00000002.2793239128.000000006458C000.00000020.00000001.01000000.00000004.sdmp, Flexpcis.exe, 00000009.00000003.2717965588.00000000035B0000.00000004.00001000.00020000.00000000.sdmp, Flexpcis.exe, 00000009.00000002.2833202804.000000006458C000.00000020.00000001.01000000.00000004.sdmp

String found in binary or memory: http://www.indyproject.org/

System Summary

PE file contains section with special chars

Source: Drivespan.dll.2.dr

Static PE information: section name: .}w/

Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\3c0868.msi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIFFA.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI1078.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI10C7.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI1135.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI1194.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\inprogressinstallinfo.ipi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\SourceHash{8AE8C42A-5150-4814-B7AC-A22D49C22F14}	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI129E.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\3c086b.msi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\3c086b.msi	Jump to behavior

Source: C:\Windows\System32\msiexec.exe

File deleted: C:\Windows\Installer\MSIFFA.tmp

Jump to behavior

Source: C:\Users\user\Contacts\Flexpcis.exe

Code function: 6_2_0011CD15

6_2_0011CD15

Source: Joe Sandbox View	Dropped File: C:\Users\user\Contacts\Flexpcis.exe 7E4132835419E4C415D048B64A5FC2813B8D2FF72BB5586D857DCDF6A90A45F2
Source: Joe Sandbox View	Dropped File: C:\Windows\Installer\MSI1078.tmp 118A551EEF23BF842ED470316AA1A50BF17B6D656652879802D4ACC0184608CA

Source: C:\Users\user\Contacts\Flexpcis.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 1008 -s 628

Source: Drivespan.dll.2.dr

Static PE information: Resource name: RT_VERSION type: Intel ia64 COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970

Source: Drivespan.dll.2.dr

Static PE information: Number of sections : 16 > 10

Source: classification engine

Classification label: mal76.evad.winMSI@18/59@1/1

Source: C:\Users\user\Contacts\Flexpcis.exe

Code function: 6_2_00111510 GetModuleFileNameW,GetCurrentProcessId,Process32NextW,CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,Process32NextW,Sleep,CloseHandle,Sleep,

6_2_00111510

Source: C:\Windows\System32\msiexec.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\CML12F7.tmp

Jump to behavior

Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess672
Source: C:\Users\user\Contacts\Flexpcis.exe	Mutant created: \Sessions\1\BaseNamedObjects\gg24UGs6BG
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess5648
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess1008
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess5908

Source: C:\Windows\System32\msiexec.exe

File created: C:\Windows\TEMP\~DF608BC4025E100561.TMP

Jump to behavior

Source: C:\Users\user\Contacts\Flexpcis.exe	Command line argument: -Restart	6_2_001117A0
Source: C:\Users\user\Contacts\Flexpcis.exe	Command line argument: drivespan.dll	6_2_001117A0
Source: C:\Users\user\Contacts\Flexpcis.exe	Command line argument: drivespan.dll	6_2_001117A0
Source: C:\Users\user\Contacts\Flexpcis.exe	Command line argument: run	6_2_001117A0
Source: C:\Users\user\Contacts\Flexpcis.exe	Command line argument: #v	6_2_001117A0

Source: C:\Users\user\Contacts\Flexpcis.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior

Source: C:\Users\user\Contacts\Flexpcis.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: IRPF2024-0940959038w904598304w985036.msi

Virustotal: Detection: 7%

Source: unknown	Process created: C:\Windows\System32\msiexec.exe "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\IRPF2024-0940959038w904598304w985036.msi"
Source: unknown	Process created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 5B841E4EC1525DEC8E125CA4E79284A2
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Users\user\Contacts\Flexpcis.exe "C:\Users\user\Contacts\Flexpcis.exe"
Source: unknown	Process created: C:\Users\user\Contacts\Flexpcis.exe "C:\Users\user\Contacts\Flexpcis.exe"
Source: unknown	Process created: C:\Users\user\Contacts\Flexpcis.exe "C:\Users\user\Contacts\Flexpcis.exe"
Source: unknown	Process created: C:\Users\user\Contacts\Flexpcis.exe "C:\Users\user\Contacts\Flexpcis.exe"
Source: C:\Users\user\Contacts\Flexpcis.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 1008 -s 628
Source: unknown	Process created: C:\Users\user\Contacts\Flexpcis.exe "C:\Users\user\Contacts\Flexpcis.exe"
Source: C:\Users\user\Contacts\Flexpcis.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 1008 -s 628
Source: C:\Users\user\Contacts\Flexpcis.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 672 -s 724
Source: C:\Users\user\Contacts\Flexpcis.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 672 -s 628
Source: C:\Users\user\Contacts\Flexpcis.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5908 -s 624
Source: C:\Users\user\Contacts\Flexpcis.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5908 -s 1004
Source: C:\Users\user\Contacts\Flexpcis.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5648 -s 628
Source: C:\Users\user\Contacts\Flexpcis.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5648 -s 628
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 5B841E4EC1525DEC8E125CA4E79284A2	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Users\user\Contacts\Flexpcis.exe "C:\Users\user\Contacts\Flexpcis.exe"	Jump to behavior

Source: C:\Windows\System32\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: srpapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: tsappcmp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: tsappcmp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windows.ui.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windowmanagementapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: inputhost.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windows.ui.immersive.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Section loaded: drivespan.dll	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Section loaded: magnification.dll	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Section loaded: d3d9.dll	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Section loaded: security.dll	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Section loaded: olepro32.dll	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Section loaded: idndl.dll	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Section loaded: windows.applicationmodel.store.dll	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Section loaded: webservices.dll	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Section loaded: drivespan.dll	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Section loaded: magnification.dll	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Section loaded: d3d9.dll	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Section loaded: security.dll	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Section loaded: olepro32.dll	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Section loaded: idndl.dll	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Section loaded: windows.applicationmodel.store.dll	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Section loaded: webservices.dll	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Section loaded: drivespan.dll	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Section loaded: magnification.dll	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Section loaded: d3d9.dll	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Section loaded: security.dll	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Section loaded: olepro32.dll	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Section loaded: idndl.dll	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Section loaded: windows.applicationmodel.store.dll	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Section loaded: webservices.dll	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Section loaded: drivespan.dll	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Section loaded: magnification.dll	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Section loaded: d3d9.dll	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Section loaded: security.dll	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Section loaded: olepro32.dll	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Section loaded: idndl.dll	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Section loaded: windows.applicationmodel.store.dll	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Section loaded: webservices.dll	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Section loaded: drivespan.dll	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Section loaded: magnification.dll	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Section loaded: d3d9.dll	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Section loaded: security.dll	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Section loaded: olepro32.dll	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Section loaded: idndl.dll	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Section loaded: windows.applicationmodel.store.dll	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Section loaded: webservices.dll	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior

Source: C:\Users\user\Contacts\Flexpcis.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: IRPF2024-0940959038w904598304w985036.msi

Static file information: File size 41998336 > 1048576

Source:

Source: C:\Users\user\Contacts\Flexpcis.exe

Code function: 6_2_00111000 LdrInitializeThunk,SHGetFolderPathW,PathFileExistsW,PathFileExistsW,PathFileExistsW,MoveFileExW,PathFileExistsW,LoadLibraryW,LoadLibraryW,GetProcAddress,GetProcAddress,FreeLibrary,LoadLibraryW,GetProcAddress,FreeLibrary,LoadLibraryW,GetProcAddress,FreeLibrary,FreeLibrary,

6_2_00111000

Source: initial sample

Static PE information: section where entry point is pointing to: .}w/

Source: Drivespan.dll.2.dr	Static PE information: section name: .didata
Source: Drivespan.dll.2.dr	Static PE information: section name: .aJ4
Source: Drivespan.dll.2.dr	Static PE information: section name: .7VB
Source: Drivespan.dll.2.dr	Static PE information: section name: .debug
Source: Drivespan.dll.2.dr	Static PE information: section name: ./VW
Source: Drivespan.dll.2.dr	Static PE information: section name: .eW.
Source: Drivespan.dll.2.dr	Static PE information: section name: .}w/

Source: C:\Users\user\Contacts\Flexpcis.exe

Code function: 6_2_00113016 push ecx; ret

6_2_00113029

Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI1194.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\Contacts\Drivespan.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\Contacts\Flexpcis.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI1135.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIFFA.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI1078.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI10C7.tmp	Jump to dropped file

Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI1194.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI1135.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIFFA.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI1078.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI10C7.tmp	Jump to dropped file

Boot Survival

Creates multiple autostart registry keys

Source: C:\Windows\System32\msiexec.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Novo Valor			Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Flexpcis.exe			Jump to behavior

Source: C:\Windows\System32\msiexec.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Novo Valor	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Novo Valor	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Flexpcis.exe	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Flexpcis.exe	Jump to behavior

Hooking and other Techniques for Hiding and Protection

Overwrites code with unconditional jumps - possibly settings hooks in foreign process

Source: C:\Users\user\Contacts\Flexpcis.exe	Memory written: PID: 5976 base: 2570005 value: E9 8B 2F E1 74	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Memory written: PID: 5976 base: 77382F90 value: E9 7A D0 1E 8B	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Memory written: PID: 5976 base: 2690005 value: E9 2B BA CB 74	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Memory written: PID: 5976 base: 7734BA30 value: E9 DA 45 34 8B	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Memory written: PID: 5976 base: 26A0008 value: E9 8B 8E CF 74	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Memory written: PID: 5976 base: 77398E90 value: E9 80 71 30 8B	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Memory written: PID: 5976 base: 26C0005 value: E9 8B 4D 27 74	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Memory written: PID: 5976 base: 76934D90 value: E9 7A B2 D8 8B	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Memory written: PID: 5976 base: 26D0005 value: E9 EB EB 27 74	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Memory written: PID: 5976 base: 7694EBF0 value: E9 1A 14 D8 8B	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Memory written: PID: 5976 base: 26E0005 value: E9 8B 8A 24 73	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Memory written: PID: 5976 base: 75928A90 value: E9 7A 75 DB 8C	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Memory written: PID: 5976 base: 26F0005 value: E9 2B 02 26 73	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Memory written: PID: 5976 base: 75950230 value: E9 DA FD D9 8C	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Memory written: PID: 1008 base: ED0005 value: E9 8B 2F 4B 76	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Memory written: PID: 1008 base: 77382F90 value: E9 7A D0 B4 89	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Memory written: PID: 1008 base: EE0005 value: E9 2B BA 46 76	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Memory written: PID: 1008 base: 7734BA30 value: E9 DA 45 B9 89	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Memory written: PID: 1008 base: EF0008 value: E9 8B 8E 4A 76	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Memory written: PID: 1008 base: 77398E90 value: E9 80 71 B5 89	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Memory written: PID: 1008 base: 1320005 value: E9 8B 4D 61 75	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Memory written: PID: 1008 base: 76934D90 value: E9 7A B2 9E 8A	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Memory written: PID: 1008 base: 1330005 value: E9 EB EB 61 75	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Memory written: PID: 1008 base: 7694EBF0 value: E9 1A 14 9E 8A	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Memory written: PID: 1008 base: 2F30005 value: E9 8B 8A 9F 72	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Memory written: PID: 1008 base: 75928A90 value: E9 7A 75 60 8D	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Memory written: PID: 1008 base: 2F40005 value: E9 2B 02 A1 72	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Memory written: PID: 1008 base: 75950230 value: E9 DA FD 5E 8D	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Memory written: PID: 672 base: 14D0005 value: E9 8B 2F EB 75	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Memory written: PID: 672 base: 77382F90 value: E9 7A D0 14 8A	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Memory written: PID: 672 base: 15F0005 value: E9 2B BA D5 75	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Memory written: PID: 672 base: 7734BA30 value: E9 DA 45 2A 8A	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Memory written: PID: 672 base: 1600008 value: E9 8B 8E D9 75	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Memory written: PID: 672 base: 77398E90 value: E9 80 71 26 8A	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Memory written: PID: 672 base: 1620005 value: E9 8B 4D 31 75	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Memory written: PID: 672 base: 76934D90 value: E9 7A B2 CE 8A	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Memory written: PID: 672 base: 1630005 value: E9 EB EB 31 75	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Memory written: PID: 672 base: 7694EBF0 value: E9 1A 14 CE 8A	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Memory written: PID: 672 base: 1640005 value: E9 8B 8A 2E 74	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Memory written: PID: 672 base: 75928A90 value: E9 7A 75 D1 8B	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Memory written: PID: 672 base: 1650005 value: E9 2B 02 30 74	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Memory written: PID: 672 base: 75950230 value: E9 DA FD CF 8B	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Memory written: PID: 5648 base: 520005 value: E9 8B 2F E6 76	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Memory written: PID: 5648 base: 77382F90 value: E9 7A D0 19 89	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Memory written: PID: 5648 base: 530005 value: E9 2B BA E1 76	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Memory written: PID: 5648 base: 7734BA30 value: E9 DA 45 1E 89	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Memory written: PID: 5648 base: 540008 value: E9 8B 8E E5 76	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Memory written: PID: 5648 base: 77398E90 value: E9 80 71 1A 89	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Memory written: PID: 5648 base: 6C0005 value: E9 8B 4D 27 76	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Memory written: PID: 5648 base: 76934D90 value: E9 7A B2 D8 89	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Memory written: PID: 5648 base: 6D0005 value: E9 EB EB 27 76	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Memory written: PID: 5648 base: 7694EBF0 value: E9 1A 14 D8 89	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Memory written: PID: 5648 base: 6E0005 value: E9 8B 8A 24 75	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Memory written: PID: 5648 base: 75928A90 value: E9 7A 75 DB 8A	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Memory written: PID: 5648 base: 8D0005 value: E9 2B 02 08 75	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Memory written: PID: 5648 base: 75950230 value: E9 DA FD F7 8A	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Memory written: PID: 5908 base: 5A0005 value: E9 8B 2F DE 76	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Memory written: PID: 5908 base: 77382F90 value: E9 7A D0 21 89	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Memory written: PID: 5908 base: 6D0005 value: E9 2B BA C7 76	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Memory written: PID: 5908 base: 7734BA30 value: E9 DA 45 38 89	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Memory written: PID: 5908 base: 6E0008 value: E9 8B 8E CB 76	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Memory written: PID: 5908 base: 77398E90 value: E9 80 71 34 89	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Memory written: PID: 5908 base: 700005 value: E9 8B 4D 23 76	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Memory written: PID: 5908 base: 76934D90 value: E9 7A B2 DC 89	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Memory written: PID: 5908 base: 710005 value: E9 EB EB 23 76	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Memory written: PID: 5908 base: 7694EBF0 value: E9 1A 14 DC 89	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Memory written: PID: 5908 base: AB0005 value: E9 8B 8A E7 74	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Memory written: PID: 5908 base: 75928A90 value: E9 7A 75 18 8B	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Memory written: PID: 5908 base: 2620005 value: E9 2B 02 33 73	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Memory written: PID: 5908 base: 75950230 value: E9 DA FD CC 8C	Jump to behavior

Source: C:\Users\user\Contacts\Flexpcis.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Jump to behavior

Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\Contacts\Flexpcis.exe	API/Special instruction interceptor: Address: 6A513CF4
Source: C:\Users\user\Contacts\Flexpcis.exe	API/Special instruction interceptor: Address: 6C870B5A
Source: C:\Users\user\Contacts\Flexpcis.exe	API/Special instruction interceptor: Address: 6A4D3123
Source: C:\Users\user\Contacts\Flexpcis.exe	API/Special instruction interceptor: Address: 6A4C919F
Source: C:\Users\user\Contacts\Flexpcis.exe	API/Special instruction interceptor: Address: 6A2C91B3
Source: C:\Users\user\Contacts\Flexpcis.exe	API/Special instruction interceptor: Address: 6C8ADCC2
Source: C:\Users\user\Contacts\Flexpcis.exe	API/Special instruction interceptor: Address: 6C223C19
Source: C:\Users\user\Contacts\Flexpcis.exe	API/Special instruction interceptor: Address: 6C737130
Source: C:\Users\user\Contacts\Flexpcis.exe	API/Special instruction interceptor: Address: 6C2077D4
Source: C:\Users\user\Contacts\Flexpcis.exe	API/Special instruction interceptor: Address: 6A21540D
Source: C:\Users\user\Contacts\Flexpcis.exe	API/Special instruction interceptor: Address: 6C851945
Source: C:\Users\user\Contacts\Flexpcis.exe	API/Special instruction interceptor: Address: 6C712EA2
Source: C:\Users\user\Contacts\Flexpcis.exe	API/Special instruction interceptor: Address: 6C818836
Source: C:\Users\user\Contacts\Flexpcis.exe	API/Special instruction interceptor: Address: 6A291EDE
Source: C:\Users\user\Contacts\Flexpcis.exe	API/Special instruction interceptor: Address: 6C578217
Source: C:\Users\user\Contacts\Flexpcis.exe	API/Special instruction interceptor: Address: 6C713F92
Source: C:\Users\user\Contacts\Flexpcis.exe	API/Special instruction interceptor: Address: 6A49F506
Source: C:\Users\user\Contacts\Flexpcis.exe	API/Special instruction interceptor: Address: 6C2122CD
Source: C:\Users\user\Contacts\Flexpcis.exe	API/Special instruction interceptor: Address: 6C875B11
Source: C:\Users\user\Contacts\Flexpcis.exe	API/Special instruction interceptor: Address: 6A4F952E
Source: C:\Users\user\Contacts\Flexpcis.exe	API/Special instruction interceptor: Address: 6C810BA2
Source: C:\Users\user\Contacts\Flexpcis.exe	API/Special instruction interceptor: Address: 6C87BCC9
Source: C:\Users\user\Contacts\Flexpcis.exe	API/Special instruction interceptor: Address: 6A202318
Source: C:\Users\user\Contacts\Flexpcis.exe	API/Special instruction interceptor: Address: 6A451E42
Source: C:\Users\user\Contacts\Flexpcis.exe	API/Special instruction interceptor: Address: 6C1E4B24
Source: C:\Users\user\Contacts\Flexpcis.exe	API/Special instruction interceptor: Address: 6C20E356
Source: C:\Users\user\Contacts\Flexpcis.exe	API/Special instruction interceptor: Address: 6A36CF98
Source: C:\Users\user\Contacts\Flexpcis.exe	API/Special instruction interceptor: Address: 6C747FE0
Source: C:\Users\user\Contacts\Flexpcis.exe	API/Special instruction interceptor: Address: 6C597817
Source: C:\Users\user\Contacts\Flexpcis.exe	API/Special instruction interceptor: Address: 6C591B3D
Source: C:\Users\user\Contacts\Flexpcis.exe	API/Special instruction interceptor: Address: 6C1E63E1
Source: C:\Users\user\Contacts\Flexpcis.exe	API/Special instruction interceptor: Address: 6A5060BA
Source: C:\Users\user\Contacts\Flexpcis.exe	API/Special instruction interceptor: Address: 6C8556C2
Source: C:\Users\user\Contacts\Flexpcis.exe	API/Special instruction interceptor: Address: 6C8C7728
Source: C:\Users\user\Contacts\Flexpcis.exe	API/Special instruction interceptor: Address: 6A43A6D8
Source: C:\Users\user\Contacts\Flexpcis.exe	API/Special instruction interceptor: Address: 6C825152
Source: C:\Users\user\Contacts\Flexpcis.exe	API/Special instruction interceptor: Address: 6A4F05F6
Source: C:\Users\user\Contacts\Flexpcis.exe	API/Special instruction interceptor: Address: 6A4CEE1A
Source: C:\Users\user\Contacts\Flexpcis.exe	API/Special instruction interceptor: Address: 6C8216A2
Source: C:\Users\user\Contacts\Flexpcis.exe	API/Special instruction interceptor: Address: 6C1EA1E6
Source: C:\Users\user\Contacts\Flexpcis.exe	API/Special instruction interceptor: Address: 6C58B9E9
Source: C:\Users\user\Contacts\Flexpcis.exe	API/Special instruction interceptor: Address: 6C59A056
Source: C:\Users\user\Contacts\Flexpcis.exe	API/Special instruction interceptor: Address: 6A42A367
Source: C:\Users\user\Contacts\Flexpcis.exe	API/Special instruction interceptor: Address: 6A43B8C9
Source: C:\Users\user\Contacts\Flexpcis.exe	API/Special instruction interceptor: Address: 6C83CEE4
Source: C:\Users\user\Contacts\Flexpcis.exe	API/Special instruction interceptor: Address: 6A2148E8
Source: C:\Users\user\Contacts\Flexpcis.exe	API/Special instruction interceptor: Address: 6C2366E3
Source: C:\Users\user\Contacts\Flexpcis.exe	API/Special instruction interceptor: Address: 6A4E9A7A
Source: C:\Users\user\Contacts\Flexpcis.exe	API/Special instruction interceptor: Address: 6C8D4DC8
Source: C:\Users\user\Contacts\Flexpcis.exe	API/Special instruction interceptor: Address: 6B7795B7
Source: C:\Users\user\Contacts\Flexpcis.exe	API/Special instruction interceptor: Address: 6A4E3C0B
Source: C:\Users\user\Contacts\Flexpcis.exe	API/Special instruction interceptor: Address: 6C1E9BA8
Source: C:\Users\user\Contacts\Flexpcis.exe	API/Special instruction interceptor: Address: 6C8A0DFE
Source: C:\Users\user\Contacts\Flexpcis.exe	API/Special instruction interceptor: Address: 6C8C570F
Source: C:\Users\user\Contacts\Flexpcis.exe	API/Special instruction interceptor: Address: 6C71CEF2

Source: C:\Users\user\Contacts\Flexpcis.exe

Code function: 6_2_00111510 GetModuleFileNameW,GetCurrentProcessId,Process32NextW,CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,Process32NextW,Sleep,CloseHandle,Sleep,

6_2_00111510

Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI1194.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI1135.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSIFFA.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI1078.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI10C7.tmp	Jump to dropped file

Source: C:\Users\user\Contacts\Flexpcis.exe

API coverage: 5.3 %

Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior

Source: C:\Users\user\Contacts\Flexpcis.exe

Code function: 6_2_001175CA FindFirstFileExW,

6_2_001175CA

Source: Flexpcis.exe, 00000009.00000002.2834178120.00000000677DD000.00000002.00000001.01000000.00000004.sdmp	Binary or memory string: @Idassignednumbers@IdPORT_vmnet
Source: Flexpcis.exe, 00000009.00000002.2834178120.00000000677DD000.00000002.00000001.01000000.00000004.sdmp	Binary or memory string: @Idassignednumbers@IdPORT_vmnet$@Idassignednumbers@IdPORT_genrad_mux
Source: Flexpcis.exe, 00000006.00000003.2681373979.0000000000F3C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\System32\msiexec.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Contacts\Flexpcis.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Contacts\Flexpcis.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Contacts\Flexpcis.exe

6_2_00111000

Source: C:\Users\user\Contacts\Flexpcis.exe

Code function: 6_2_001155D7 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

6_2_001155D7

Source: C:\Users\user\Contacts\Flexpcis.exe

Code function: 6_2_00111510 GetModuleFileNameW,GetCurrentProcessId,Process32NextW,CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,Process32NextW,Sleep,CloseHandle,Sleep,

6_2_00111510

Source: C:\Users\user\Contacts\Flexpcis.exe

6_2_00111000

Source: C:\Users\user\Contacts\Flexpcis.exe

Code function: 6_2_00116268 mov eax, dword ptr fs:[00000030h]

6_2_00116268

Source: C:\Users\user\Contacts\Flexpcis.exe

Code function: 6_2_00119302 GetProcessHeap,

6_2_00119302

Source: C:\Windows\System32\msiexec.exe

Process created: C:\Users\user\Contacts\Flexpcis.exe "C:\Users\user\Contacts\Flexpcis.exe"

Jump to behavior

Source: C:\Users\user\Contacts\Flexpcis.exe	Code function: 6_2_00112821 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	6_2_00112821
Source: C:\Users\user\Contacts\Flexpcis.exe	Code function: 6_2_001155D7 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	6_2_001155D7
Source: C:\Users\user\Contacts\Flexpcis.exe	Code function: 6_2_00112DC9 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	6_2_00112DC9
Source: C:\Users\user\Contacts\Flexpcis.exe	Code function: 6_2_00112F17 SetUnhandledExceptionFilter,	6_2_00112F17

Source: Flexpcis.exe, 00000006.00000002.2816061489.0000000066DDD000.00000002.00000001.01000000.00000004.sdmp, Flexpcis.exe, 00000009.00000002.2834178120.0000000066DDD000.00000002.00000001.01000000.00000004.sdmp

Binary or memory string: @Winapi@Windows@DOF_PROGMAN

Source: C:\Users\user\Contacts\Flexpcis.exe

Code function: 6_2_0011305C cpuid

6_2_0011305C

Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Users\user\Contacts\Flexpcis.exe

Code function: 6_2_00112CB2 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

6_2_00112CB2

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Replication Through Removable Media	2 Command and Scripting Interpreter	11 Registry Run Keys / Startup Folder	2 Process Injection	21 Masquerading	1 Credential API Hooking	1 System Time Discovery	Remote Services	1 Credential API Hooking	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	11 Registry Run Keys / Startup Folder	1 Disable or Modify Tools	LSASS Memory	1 Query Registry	Remote Desktop Protocol	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	1 Virtualization/Sandbox Evasion	Security Account Manager	241 Security Software Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	2 Process Injection	NTDS	1 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Obfuscated Files or Information	LSA Secrets	3 Process Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	11 Peripheral Device Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 File Deletion	DCSync	1 File and Directory Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	123 System Information Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
IRPF2024-0940959038w904598304w985036.msi	8%	Virustotal		Browse
IRPF2024-0940959038w904598304w985036.msi	8%	ReversingLabs

Dropped Files

Source	Detection	Scanner	Link
C:\Users\user\Contacts\Drivespan.dll	33%	Virustotal	Browse
C:\Users\user\Contacts\Flexpcis.exe	0%	ReversingLabs
C:\Users\user\Contacts\Flexpcis.exe	0%	Virustotal	Browse
C:\Windows\Installer\MSI1078.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI1078.tmp	0%	Virustotal	Browse
C:\Windows\Installer\MSI10C7.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI10C7.tmp	0%	Virustotal	Browse
C:\Windows\Installer\MSI1135.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI1135.tmp	0%	Virustotal	Browse
C:\Windows\Installer\MSI1194.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI1194.tmp	0%	Virustotal	Browse
C:\Windows\Installer\MSIFFA.tmp	0%	ReversingLabs
C:\Windows\Installer\MSIFFA.tmp	0%	Virustotal	Browse

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
www.rodovalhoadvogados.com.br	2%	Virustotal		Browse
rodovalhoadvogados.com.br	2%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
http://www.indyproject.org/	0%	URL Reputation	safe
http://www.rodovalhoadvogados.com.br/dddd/inspecionando.php	0%	Avira URL Cloud	safe
http://www.rodovalhoadvogados.com.br/dddd/inspecionando.php	2%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
rodovalhoadvogados.com.br	50.116.112.138	true	false	2%, Virustotal, Browse	unknown
www.rodovalhoadvogados.com.br	unknown	unknown	false	2%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://www.rodovalhoadvogados.com.br/dddd/inspecionando.php	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.indyproject.org/	Flexpcis.exe, 00000006.00000003.2578838717.0000000003000000.00000004.00001000.00020000.00000000.sdmp, Flexpcis.exe, 00000006.00000002.2793239128.000000006458C000.00000020.00000001.01000000.00000004.sdmp, Flexpcis.exe, 00000009.00000003.2717965588.00000000035B0000.00000004.00001000.00020000.00000000.sdmp, Flexpcis.exe, 00000009.00000002.2833202804.000000006458C000.00000020.00000001.01000000.00000004.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
50.116.112.138	rodovalhoadvogados.com.br	United States		46606	UNIFIEDLAYER-AS-1US	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1513060
Start date and time:	2024-09-18 12:31:12 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 50s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	33
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	IRPF2024-0940959038w904598304w985036.msi
Detection:	MAL
Classification:	mal76.evad.winMSI@18/59@1/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 4 Number of non-executed functions: 26
Cookbook Comments:	Found application associated with file extension: .msi Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 20.42.73.29, 20.189.173.21, 20.42.65.92, 13.89.179.12
Excluded domains from analysis (whitelisted): client.wns.windows.com, onedsblobprdeus17.eastus.cloudapp.azure.com, ocsp.digicert.com, slscr.update.microsoft.com, blobcollector.events.data.trafficmanager.net, onedsblobprdeus15.eastus.cloudapp.azure.com, tile-service.weather.microsoft.com, onedsblobprdwus16.westus.cloudapp.azure.com, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, onedsblobprdcus17.centralus.cloudapp.azure.com, fe3cr.delivery.mp.microsoft.com
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
06:32:24	API Interceptor	1x Sleep call for process: Flexpcis.exe modified
06:32:57	API Interceptor	8x Sleep call for process: WerFault.exe modified
12:32:10	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run Novo Valor C:\Users\user\Contacts\Flexpcis.exe
12:32:18	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run Novo Valor C:\Users\user\Contacts\Flexpcis.exe
12:32:28	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run Flexpcis.exe C:\Users\user\Contacts\Flexpcis.exe
12:32:43	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run Flexpcis.exe C:\Users\user\Contacts\Flexpcis.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
50.116.112.138	https://www.google.de/amp/s/socorrocargas.com%2fwp-admin%2fcss%2fcolors%2fblue%2fuyp4llyf%2fYWtlc3NsZXJAaW50ZXJhY3Rpb25zLmNvbQ==	Get hash	malicious	Unknown	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
UNIFIEDLAYER-AS-1US	awb_shipping_doc_03072024224782020031808174CN18030724000000324(991KB).vbs	Get hash	malicious	GuLoader	Browse	192.185.217.247
	EIirQiZnX9.img	Get hash	malicious	AgentTesla, GuLoader	Browse	192.185.13.234
	https://www.seggprotegido.com.br/core/fonts/css/	Get hash	malicious	Unknown	Browse	162.214.199.240
	Hamilton Heating Air RFP Proposal 204FFP10.docx	Get hash	malicious	Unknown	Browse	108.167.132.147
	Hamilton Heating Air RFP Proposal 204FFP10.docx	Get hash	malicious	Unknown	Browse	108.167.132.147
	VAT Approval_Jul-Aug 2024 Salesforce LTD.eml	Get hash	malicious	Unknown	Browse	192.185.185.200
	QUOTATION_SEPQTRA071244PDF.scr.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	198.57.247.184
	QUOTATION_SEPQTRA071244PDF.scr.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	198.57.247.184
	Davislaw_Document_3Pages_Fine.pdf.html	Get hash	malicious	HTMLPhisher	Browse	69.49.245.172
	Documenti di spedizione 0003948855990055.bat.exe	Get hash	malicious	AgentTesla	Browse	192.185.13.234

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\Contacts\Flexpcis.exe	NFeNFCe.msi	Get hash	malicious	Unknown	Browse
C:\Users\user\Contacts\Flexpcis.exe	Fct63e39.msi	Get hash	malicious	Unknown	Browse
C:\Windows\Installer\MSI1078.tmp	danf082024xml.msi	Get hash	malicious	Unknown	Browse
	https://rfindustria.com.br/wp-content/uploads/Nota_2024brs.zip	Get hash	malicious	Unknown	Browse
	XML202407brs.msi	Get hash	malicious	Unknown	Browse
	fin.746.msi	Get hash	malicious	Unknown	Browse
	Setup.msi	Get hash	malicious	Unknown	Browse
	NF_e_07_2024_XML__.msi	Get hash	malicious	Unknown	Browse
	Dramatisation.msi	Get hash	malicious	Matanbuchus	Browse
	NF_e_22_05_36543547357358BR.msi	Get hash	malicious	Unknown	Browse
	HomeDesk.msi	Get hash	malicious	Unknown	Browse
	NFs_468.msi	Get hash	malicious	VMdetect	Browse

Created / dropped Files

C:\Config.Msi\3c086a.rbs

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	modified
Size (bytes):	11646
Entropy (8bit):	5.5289030362271285
Encrypted:	false
SSDEEP:	96:VYRBoAK8A1oi6IyRC1BnQrnFLRUnBb5qYUkUTEETCYThq0NUkUTEETCGjkdhyvpr:VYk9B1oiHSABY3QEOEcQEOkJE//pVS
MD5:	4CDF3D3C1C6C66CB6FED4F1ADF84C0C5
SHA1:	36F77E4E1A901118B2D51685265DDB5785B31EF2
SHA-256:	08604F44E23BEE486FA548E65EC40CC2442ACEFA314A71209E311E21F0E24204
SHA-512:	1457FAB807B1B4EDED428ACDC30467D1957673A1CD9105FA9BB3CACAA16F88ABBABF6C6065CCB6F05FAF3D833CB90985D60E15482D4F35CF89ADB5E6D39C7254
Malicious:	false
Preview:	...@IXOS.@.....@.42Y.@.....@.....@.....@.....@.....@......&.{8AE8C42A-5150-4814-B7AC-A22D49C22F14} .Microsoft-Edge-Web-View2-Runtime(.IRPF2024-0940959038w904598304w985036.msi.@.....@.....@.....@........&.{182C5263-9A4F-4811-9832-23486A29A112}.....@.....@.....@.....@.......@.....@.....@.......@.... .Microsoft-Edge-Web-View2-Runtime......Rollback..A.....o. .d.e. .r.e.s.t.a.u.r.a.....o.....RollbackCleanup..Removendo arquivos de backup..Arquivo: [1]....ProcessComponents%.Atualizando o registro de componentes..&.{D85BA408-01F5-4AFD-AD63-1EA8CE77B976}&.{8AE8C42A-5150-4814-B7AC-A22D49C22F14}.@......&.{B5D76D82-8DC1-4B7E-8DC8-49EA79186188}&.{8AE8C42A-5150-4814-B7AC-A22D49C22F14}.@......&.{BC4FEDCD-3E0E-4107-9E61-FB50233A89F0}&.{8AE8C42A-5150-4814-B7AC-A22D49C22F14}.@......&.{484CC30A-1C9E-4E93-BFCE-F924EF61B954}&.{8AE8C42A-5150-4814-B7AC-A22D49C22F14}.@......&.{C36507B6-9328-4E18-9954-CF8127F08E40}&.{8AE8C42A-5150-4814-B7AC-A22D49C22F14}.@......&.{2DF34131-CE60-4311-A01A-81420BB1044D}&.{8AE8C4

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Flexpcis.exe_ac4eb928f71a1238ac277513c9446589b80efc4_10d4e3e1_4445af09-0b96-4657-937e-3716b5d9cb35\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.0434207362542725
Encrypted:	false
SSDEEP:	192:wJGpkkpvKGf0e9lXjHBuZrFa2dzuiFVZ24IO8T:/koiGMe9lXj4zuiFVY4IO8T
MD5:	B9C0B85C5478E24F7C4E0A8336A18CBC
SHA1:	C14BF840DCD06C0EF6F8F2848944EA501A02594A
SHA-256:	A863A928BA011A41D87B41354E13CF3FB7561D33D2571F3FFBEC3928CADBCADA
SHA-512:	779531D08C4A4F790B96CBC4FECFB43404EB5FCB2808CCD877C7BA950E07C324E27E22B6143DA8DA0A2DE6AE76C9AB4A16DDB2B0B6E9EE48EE6E1AC62BEA8C29
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.1.1.2.9.1.7.9.5.6.3.3.4.8.0.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.1.1.2.9.1.8.1.8.2.9.0.5.2.3.....R.e.p.o.r.t.S.t.a.t.u.s.=.6.5.5.4.5.6.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.4.4.4.5.a.f.0.9.-.0.b.9.6.-.4.6.5.7.-.9.3.7.e.-.3.7.1.6.b.5.d.9.c.b.3.5.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.f.b.0.a.5.2.2.6.-.4.5.5.2.-.4.8.9.c.-.9.7.8.9.-.d.5.2.3.7.d.f.d.1.4.6.b.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.F.l.e.x.p.c.i.s...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.T.r.a.n.s.f.e.r...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.3.f.0.-.0.0.0.1.-.0.0.1.5.-.0.d.7.0.-.a.0.0.9.b.6.0.9.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.b.1.a.b.7.9.5.a.c.3.d.e.3.6.7.c.2.f.1.b.7.b.6.f.0.c.e.2.7.e.2.2.0.0.0.0.0.9.0.4.!.0.0.0.0.9.a.4.2.b.3.8.7.b.a.b.d.e.a.7.1.9.d.5.4.c.1.e.1.1.b.a.a.e.9.f.d.b.9.8.9.7.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Flexpcis.exe_ac4eb928f71a1238ac277513c9446589b80efc4_10d4e3e1_b85dc046-0db7-4a6d-a980-f7495a372184\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.0435057707797224
Encrypted:	false
SSDEEP:	192:gMwfphGf0e9lXjHBuZrFa2dzuiFEZ24IO8T:bwBhGMe9lXj4zuiFEY4IO8T
MD5:	59CC69217B26AF8DC3840357DC516ABF
SHA1:	92B457317F3C26FAE5198E27A7C3A66EA5FB748A
SHA-256:	124C594540939C39232F6B61713A56082AAE6197595E7DE8F7478F02907ABE3D
SHA-512:	DB99F75CB4B0D1C8D779A881CF27847A7301C7516ABEE9425F9AD5207193FCD07B415181C86662AC119152960413191AE0246EBF580F063B27EB49C2E135A6AF
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.1.1.2.9.1.9.8.7.3.1.8.3.1.4.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.1.1.2.9.1.9.9.5.1.3.1.3.3.8.....R.e.p.o.r.t.S.t.a.t.u.s.=.6.5.5.4.5.6.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.b.8.5.d.c.0.4.6.-.0.d.b.7.-.4.a.6.d.-.a.9.8.0.-.f.7.4.9.5.a.3.7.2.1.8.4.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.1.e.a.f.3.8.6.4.-.4.a.9.2.-.4.8.f.1.-.8.e.7.1.-.7.3.4.f.8.3.6.8.8.a.c.9.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.F.l.e.x.p.c.i.s...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.T.r.a.n.s.f.e.r...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.7.1.4.-.0.0.0.1.-.0.0.1.5.-.3.1.e.7.-.b.d.1.d.b.6.0.9.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.b.1.a.b.7.9.5.a.c.3.d.e.3.6.7.c.2.f.1.b.7.b.6.f.0.c.e.2.7.e.2.2.0.0.0.0.0.9.0.4.!.0.0.0.0.9.a.4.2.b.3.8.7.b.a.b.d.e.a.7.1.9.d.5.4.c.1.e.1.1.b.a.a.e.9.f.d.b.9.8.9.7.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Flexpcis.exe_ac4eb928f71a1238ac277513c9446589b80efc4_10d4e3e1_e78915f5-aa93-4fad-82fd-884065e182d9\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.0432694951173203
Encrypted:	false
SSDEEP:	192:3ex/Bp0/Gf0e9lXjHBuZrFa2dzuiFWZ24IO8T:3cv0GMe9lXj4zuiFWY4IO8T
MD5:	496DD89DF9206A97258E6BE934EAB5B9
SHA1:	F0108D9A47C7987D84CDD305E88844D741E05171
SHA-256:	D901A6395B0D05DC8366BE9ECC1C856DC69D8038389A55CB6DB9F3A3DDBFAE0F
SHA-512:	14E9A6FBA4CF22614928B0D0F03E11294159075F1EBF0B2AEC34CABD94F4F5EC2A06CAA2F9D77465B5A81BFE13FF91B0084F3C55CF887A1644A378F8F8223D63
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.1.1.2.9.3.6.0.7.3.2.7.3.2.4.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.1.1.2.9.3.6.1.1.7.0.2.1.3.5.....R.e.p.o.r.t.S.t.a.t.u.s.=.6.5.5.4.5.6.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.e.7.8.9.1.5.f.5.-.a.a.9.3.-.4.f.a.d.-.8.2.f.d.-.8.8.4.0.6.5.e.1.8.2.d.9.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.a.b.7.2.3.0.d.d.-.1.e.b.6.-.4.d.9.4.-.9.c.4.5.-.8.6.e.4.d.6.7.5.b.4.e.6.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.F.l.e.x.p.c.i.s...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.T.r.a.n.s.f.e.r...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.6.1.0.-.0.0.0.1.-.0.0.1.5.-.1.7.f.a.-.9.2.1.4.b.6.0.9.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.b.1.a.b.7.9.5.a.c.3.d.e.3.6.7.c.2.f.1.b.7.b.6.f.0.c.e.2.7.e.2.2.0.0.0.0.0.9.0.4.!.0.0.0.0.9.a.4.2.b.3.8.7.b.a.b.d.e.a.7.1.9.d.5.4.c.1.e.1.1.b.a.a.e.9.f.d.b.9.8.9.7.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Flexpcis.exe_ac4eb928f71a1238ac277513c9446589b80efc4_10d4e3e1_e8cefdc1-d6bf-40ae-a7d0-50cf71a27795\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.0430448476876315
Encrypted:	false
SSDEEP:	192:cpNpcdGf0e9lXjHBuZrFa2dzuiFVZ24IO8T:+rOGMe9lXj4zuiFVY4IO8T
MD5:	301469500A71D0898E3E3EA3BDE5626D
SHA1:	4C621869E07F1DE4992B5482361D116645EC6628
SHA-256:	0EAE3D4E607AB2CEFCC07CA090BC2ECBFA2D8A83F43E73543B1677EBCE62F2B8
SHA-512:	57ECCA8B05B16895194C3101C12690B78ADE38BB9D72268F2E4AAB40761EB64676EDC2A41F2C4BA1AB66A5BFED4EF99BB4A0CE2E94D2DAC6E5EB9617FC9FCDE3
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.1.1.2.9.1.8.9.4.9.4.0.7.9.1.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.1.1.2.9.1.9.1.1.6.5.9.1.4.9.....R.e.p.o.r.t.S.t.a.t.u.s.=.6.5.5.4.5.6.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.e.8.c.e.f.d.c.1.-.d.6.b.f.-.4.0.a.e.-.a.7.d.0.-.5.0.c.f.7.1.a.2.7.7.9.5.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.e.f.d.b.1.4.7.2.-.b.8.d.5.-.4.a.1.c.-.a.e.3.0.-.7.9.5.7.e.9.c.e.0.c.b.3.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.F.l.e.x.p.c.i.s...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.T.r.a.n.s.f.e.r...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.2.a.0.-.0.0.0.1.-.0.0.1.5.-.3.4.7.d.-.d.3.0.e.b.6.0.9.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.b.1.a.b.7.9.5.a.c.3.d.e.3.6.7.c.2.f.1.b.7.b.6.f.0.c.e.2.7.e.2.2.0.0.0.0.0.9.0.4.!.0.0.0.0.9.a.4.2.b.3.8.7.b.a.b.d.e.a.7.1.9.d.5.4.c.1.e.1.1.b.a.a.e.9.f.d.b.9.8.9.7.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Flexpcis.exe_e87c0a2afe35b309f14a3a7c9edd366c81c413_10d4e3e1_06495a97-ff68-4d31-89ea-66637693f022\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.0437457163568764
Encrypted:	false
SSDEEP:	192:iUBpu/GJ0m8k1WjHBuZrFa2dzuiFWZ24IO8T:lvuGqm8k1Wj4zuiFWY4IO8T
MD5:	7453D9EBC4ACBE5EC97FF0E8151B1558
SHA1:	2D108DD96CC81B4CCEA435B5DB547E5CC275FECA
SHA-256:	D543BF8250A48ADC0D058F802D3126DDAF9F6A7895C3BC69E6A411DAF5F4563C
SHA-512:	3409BFCB138A292F58EECA1E6DFB00AD758BE7D6EA317D0D382DE88E2C963C58AD55506F71A332C6A56FBB567890E3E64257B22D28AEC82C452A75AAF250A7EF
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.1.1.2.9.3.5.8.5.5.3.1.3.0.8.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.1.1.2.9.3.5.9.4.9.0.6.2.4.7.....R.e.p.o.r.t.S.t.a.t.u.s.=.6.5.5.4.5.6.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.0.6.4.9.5.a.9.7.-.f.f.6.8.-.4.d.3.1.-.8.9.e.a.-.6.6.6.3.7.6.9.3.f.0.2.2.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.a.9.1.1.a.9.9.5.-.7.3.b.c.-.4.1.7.f.-.8.9.a.c.-.b.5.3.e.2.d.f.9.0.6.b.1.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.F.l.e.x.p.c.i.s...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.T.r.a.n.s.f.e.r...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.6.1.0.-.0.0.0.1.-.0.0.1.5.-.1.7.f.a.-.9.2.1.4.b.6.0.9.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.b.1.a.b.7.9.5.a.c.3.d.e.3.6.7.c.2.f.1.b.7.b.6.f.0.c.e.2.7.e.2.2.0.0.0.0.0.9.0.4.!.0.0.0.0.9.a.4.2.b.3.8.7.b.a.b.d.e.a.7.1.9.d.5.4.c.1.e.1.1.b.a.a.e.9.f.d.b.9.8.9.7.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Flexpcis.exe_e87c0a2afe35b309f14a3a7c9edd366c81c413_10d4e3e1_892afd6e-3d10-419b-9842-cef2a2414149\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.0435866658089477
Encrypted:	false
SSDEEP:	192:guYPkp7KGJ0m8k1WjHBuZrFa2dzuiFVZ24IO8T:gPPo2Gqm8k1Wj4zuiFVY4IO8T
MD5:	8985BD42C1DC26284994EB732AFEF21E
SHA1:	C8AD648B3BED31716E885D1D9B5565175FA5AF48
SHA-256:	80701700900BF1C105A1D8E68C7424518F9B9E8CC52D98013866FFAF324CC21A
SHA-512:	C18CAA16229910DEAD2868DE9C714254CEDFE8D276FDB1DAC093B4A69B83D3137A6335713777904E86CCFFCD2209828EBF0BB6177A6C0FB8517CF9AD5FB258A3
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.1.1.2.9.1.7.0.0.4.3.3.2.4.5.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.1.1.2.9.1.7.2.3.5.5.7.7.5.8.....R.e.p.o.r.t.S.t.a.t.u.s.=.6.5.5.4.5.6.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.8.9.2.a.f.d.6.e.-.3.d.1.0.-.4.1.9.b.-.9.8.4.2.-.c.e.f.2.a.2.4.1.4.1.4.9.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.b.0.b.b.1.b.d.5.-.4.3.c.2.-.4.b.e.8.-.b.2.d.d.-.b.7.f.c.7.8.a.d.8.1.2.a.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.F.l.e.x.p.c.i.s...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.T.r.a.n.s.f.e.r...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.3.f.0.-.0.0.0.1.-.0.0.1.5.-.0.d.7.0.-.a.0.0.9.b.6.0.9.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.b.1.a.b.7.9.5.a.c.3.d.e.3.6.7.c.2.f.1.b.7.b.6.f.0.c.e.2.7.e.2.2.0.0.0.0.0.9.0.4.!.0.0.0.0.9.a.4.2.b.3.8.7.b.a.b.d.e.a.7.1.9.d.5.4.c.1.e.1.1.b.a.a.e.9.f.d.b.9.8.9.7.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Flexpcis.exe_e87c0a2afe35b309f14a3a7c9edd366c81c413_10d4e3e1_b4825b46-7409-459a-9772-542b33cc2059\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.0437700758068336
Encrypted:	false
SSDEEP:	192:HIx8wfp+GJ0m8k1WjHBuZrFa2dzuiFVZ24IO8T:Hc8wB+Gqm8k1Wj4zuiFVY4IO8T
MD5:	5F90D6AAA90F3887EBAC4880DF36D7A4
SHA1:	0D32D0A695E7C4F049D4B607554094D79232765C
SHA-256:	6FF9F650B42F81DADFA9FEA3349972E9889D6A49B9CA7248F95A467A9A3EAA6B
SHA-512:	D9211A5011ABB06BE1B4F848E8364986B073DF1A69CACB99DC521B3D3C2FB95507539A7A0FE859DFF9F1C707F8389D7A7A28CE98995A60830980CD0858D4100B
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.1.1.2.9.1.9.6.4.6.6.8.3.5.8.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.1.1.2.9.1.9.7.2.3.2.5.0.0.9.....R.e.p.o.r.t.S.t.a.t.u.s.=.6.5.5.4.5.6.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.b.4.8.2.5.b.4.6.-.7.4.0.9.-.4.5.9.a.-.9.7.7.2.-.5.4.2.b.3.3.c.c.2.0.5.9.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.a.0.f.c.0.8.7.2.-.8.d.8.a.-.4.d.b.d.-.9.2.9.7.-.5.3.e.1.6.6.5.d.8.f.1.8.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.F.l.e.x.p.c.i.s...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.T.r.a.n.s.f.e.r...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.7.1.4.-.0.0.0.1.-.0.0.1.5.-.3.1.e.7.-.b.d.1.d.b.6.0.9.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.b.1.a.b.7.9.5.a.c.3.d.e.3.6.7.c.2.f.1.b.7.b.6.f.0.c.e.2.7.e.2.2.0.0.0.0.0.9.0.4.!.0.0.0.0.9.a.4.2.b.3.8.7.b.a.b.d.e.a.7.1.9.d.5.4.c.1.e.1.1.b.a.a.e.9.f.d.b.9.8.9.7.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Flexpcis.exe_e87c0a2afe35b309f14a3a7c9edd366c81c413_10d4e3e1_b916971a-da99-4f41-82bc-2f6d10279bb3\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.0434664434430376
Encrypted:	false
SSDEEP:	192:aPNpYdGJ0m8k1WjHBuZrFa2dzuiFVZ24IO8T:yrqGqm8k1Wj4zuiFVY4IO8T
MD5:	5828F406EC2F7F098AC13605CCFF8151
SHA1:	A6662C285F0BE9FAFD5952C0455D665587014B79
SHA-256:	1302AD46AAAAE77EA50D788EA009D6003AC95F402AAEFB742A1AD77D6E9DD99C
SHA-512:	D4A18AA375147107E4E1FC968E34A07B1E645C0D7465E0DA849B513C0670C3103E8E8F9FB80804CB4E737290E4E6CECBA23BCA69906D187A12DC46E1EEC351C4
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.1.1.2.9.1.8.3.0.7.4.6.7.1.5.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.1.1.2.9.1.8.5.5.5.9.0.3.5.5.....R.e.p.o.r.t.S.t.a.t.u.s.=.6.5.5.4.5.6.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.b.9.1.6.9.7.1.a.-.d.a.9.9.-.4.f.4.1.-.8.2.b.c.-.2.f.6.d.1.0.2.7.9.b.b.3.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.f.4.b.c.a.5.4.c.-.8.f.c.3.-.4.c.2.d.-.b.1.b.e.-.2.2.9.e.d.a.1.0.c.e.d.0.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.F.l.e.x.p.c.i.s...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.T.r.a.n.s.f.e.r...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.2.a.0.-.0.0.0.1.-.0.0.1.5.-.3.4.7.d.-.d.3.0.e.b.6.0.9.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.b.1.a.b.7.9.5.a.c.3.d.e.3.6.7.c.2.f.1.b.7.b.6.f.0.c.e.2.7.e.2.2.0.0.0.0.0.9.0.4.!.0.0.0.0.9.a.4.2.b.3.8.7.b.a.b.d.e.a.7.1.9.d.5.4.c.1.e.1.1.b.a.a.e.9.f.d.b.9.8.9.7.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2988.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Wed Sep 18 10:33:16 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	42678
Entropy (8bit):	2.42003571774741
Encrypted:	false
SSDEEP:	192:m4qvuoQvePOxO36VTiFxjyAQb7JYnDe0Z7dhYkBOwkKssOP/nC6XKmVf:qWtveG0KVeFxjyAQnKe0Z7HBdkHaKVf
MD5:	53388F2EAAF917799FF47D10D1C7DCD4
SHA1:	710D6225BFC1DD95C88B6D902E9B047178D72B18
SHA-256:	56A9416269C67A7D1E4BE45C69674ED4D9DD5EBAA9C2A2BCAA6EB02D5EE65D6D
SHA-512:	4A6B6AFECECF73BA878259F6D5479A182186E9C5EC4AFA4368F7A3E6522DFA6508BEDCEDC8C0D39FA8F8C65EC79804CBFA8ABF6EE53062F0A697CB6B720E0F3F
Malicious:	false
Preview:	MDMP..a..... .......l..f............4...........T...<............/..........T.......8...........T...........p"..F............ ..........\|"..............................................................................eJ.......#......GenuineIntel............T...........T..f............................. ..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2AA2.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8332
Entropy (8bit):	3.6992376863950933
Encrypted:	false
SSDEEP:	192:R6l7wVeJp1J6wfCA6Y2DnSUSegmfqRWpr+89bIesf94m:R6lXJpL6ICA6YqSUSegmfqREIdfH
MD5:	BF202347B27CAC103A04F864443D3BD9
SHA1:	11B1E360FCAF183ABEDF0E4DE9BDB63758921882
SHA-256:	5F5E8BE203BA48632B9D8511544FF873D37FD34FA8857D4DD680CA52596317EE
SHA-512:	C2673C6D830A2B1D8634C658C979CEC33D5A3B92D9717382EB5971A35D822A5CA352C08E3117C9C9E80B6B46D370BE81C5110A9E16661BC565F2739429E574D0
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.5.9.0.8.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2AE1.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4636
Entropy (8bit):	4.450052278007118
Encrypted:	false
SSDEEP:	48:cvIwWl8zs20Jg77aI9xM/7WpW8VYjuYm8M4JlGN0GFQBLl+q8KWaUeUM/312X14d:uIjfHI7PM/K7VaJl/Bp5lUM92F4d
MD5:	7DAE8C70A462C001D88444EE24F04DFE
SHA1:	B64752EB1945529B14D17FB4DBC768E3C6077DAA
SHA-256:	3F42004060CE869319587FFF37A50A1FB0F9BAD03B42CAED1714C23A6B647AC4
SHA-512:	ACFD4A50ADE3E2D1767FB746C4967C6206A1133D78E921EA2AE490F0C5F612D470F0DBF054859C476BF332A8D7575BCCAB14F786A897A9E092D1B5CDF438F10F
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="505535" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3271.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Wed Sep 18 10:33:19 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	43950
Entropy (8bit):	2.463486387188757
Encrypted:	false
SSDEEP:	192:ZoqvuoQveZbVOxO36VTUpWT8G/YnDO0Z7dhYkBO0OxGHjVBH4kNzftp3o:RWtveZ00KVIpWT+O0Z7HB5JBzFFo
MD5:	91E06D228A79B77877B867A37A7DA91F
SHA1:	2792668454CF13598EC93DD29B7691A4B433850B
SHA-256:	53D978C43AF37346F3A2B1AB875DFA3B3D2EAA13A0087E9BA6739454311CE4E7
SHA-512:	EFBAE8A37D4D8B868FFA2F76269232EAE73FFEAFEC5C00CE6617384EEA18A43F91BF2BF094F0AD6A0CFF72E53E515BCB80A5F4DED9FD56386204A14FA89C2113
Malicious:	false
Preview:	MDMP..a..... .......o..f............4...........T...<............/..........T.......8...........T........... "............... ..........\|"..............................................................................eJ.......#......GenuineIntel............T...........T..f............................. ..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER339B.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8332
Entropy (8bit):	3.6985632931918406
Encrypted:	false
SSDEEP:	192:R6l7wVeJp156WxK46Y2DqSU1Zgmf4lpDr89bvesfyFm:R6lXJpb68K46YXSU1Zgmf48vdfJ
MD5:	39D1710BA67DE3E44300642A84AC04EA
SHA1:	FF0CA133C33E1674D1D3E6805809B23FDD9AFD4F
SHA-256:	D41853104843FB8B554D7A017A967D7B21949562B05ACF85535EFCCF1A089115
SHA-512:	7478BE4A997D0F25E1EB63E06A3DC1CF536405F61F2C2C6EC440D1BBD5C103DC81F4EA401120D5374C843586095C8C2CD95CEAE67DE3820DE5AC7AB2515FF573
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.5.9.0.8.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER33CB.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4636
Entropy (8bit):	4.451965979312779
Encrypted:	false
SSDEEP:	48:cvIwWl8zs2FJg77aI9xM/7WpW8VYjGPYm8M4JlGN0/aFCm+q8KWaKOjUM/312X1G:uIjf6I7PM/K7V3SJlbG55jUM92F4d
MD5:	2A3C4104E8B0DA6E8546F939C78DB9F9
SHA1:	28581831C00908C18EEA5095E90244CF8DD78944
SHA-256:	20EFDA7E9B1B53D85EC41CC1DBBC69618618E44C3F94DF4A5AEBFA554C700B51
SHA-512:	347A4CD33970554EBE2EF6EE3B31083A3AA08ADD1B3E486DB2225D169280C208AA34C9AFEC81640AC39DA451DCB7C124C6D69E1CE94DAE9DE6199BE3AAB1455C
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="505536" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERA2C5.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Wed Sep 18 10:35:59 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	40862
Entropy (8bit):	2.499516489329535
Encrypted:	false
SSDEEP:	384:wWpveM10KVvVrAQZx1ZtGR4kff4ni/IG8:bRV10KVvvZxYW0hQG8
MD5:	D7DED52A6E4FA50FD32B89781028BCB5
SHA1:	60B4F783A5E12807D2348D1F87E1CA88DE5F6C03
SHA-256:	5B87DE4C8F4B89F9168F7766A2615FFC0EACE20773ACCB4DE10EC24DAB314355
SHA-512:	D51773EA1DD788437D60D7CD4416EC6413CDD3761C81B3014EEA58DDAF8D72D6B74E870583C342BEEC6AB5008C0FD8ED0D7F4D089458C5DE2C719DD9FD41C39F
Malicious:	false
Preview:	MDMP..a..... ..........f............4...........T...<............/..........T.......8...........T...........p"...}........... ..........\|"..............................................................................eJ.......#......GenuineIntel............T...........E..f............................. ..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERA5A4.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8338
Entropy (8bit):	3.6967298622257583
Encrypted:	false
SSDEEP:	192:R6l7wVeJo46V8x6Y2DASUlfgmfqRWpr989bt/sf7Pm:R6lXJ36V8x6YdSUlfgmfqRZtkfa
MD5:	9CB9A274959AE5C17D544EEF11532E63
SHA1:	FDA499D7E09AE8D7E5C1AFD185D397D4934E4F8B
SHA-256:	82059B1D2013B3D44B96C89E16761C366D075FBBB6DF533041D2095018CFDE95
SHA-512:	994EE153E934029ED4C28FB3DD7D0FE044097C6D11B5A1652FFEFA3B6E6433152189758B3731A232135BFD7A64EF08B33F14CD465C5F6EACD8475D834FE6D3D4
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.5.6.4.8.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERA5C5.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4636
Entropy (8bit):	4.449199010341961
Encrypted:	false
SSDEEP:	48:cvIwWl8zs2vJg77aI9xM/7WpW8VYjuYm8M4JlGN0GFs+q8KWaUmyUM/312X1Ud:uIjfAI7PM/K7VuJlP5lyUM92FUd
MD5:	8AAE269294FB51589F1E0D60FA25F1C6
SHA1:	54B22791BCC9417AC3ED3B057CC9487E6145F3AA
SHA-256:	0092558086035E60E879BE8F28129D27A1C40DF1E9C9C5DF0776A0C158A5C937
SHA-512:	E0DACC6290C497D96F1B8F297BE4FC0413662DAAB063B33E20BF6BFD5A4021AFAFE0D878DD17F890D30F9368CA9B863B4645CBCA3FC4C3FED3C79EB2E32022ED
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="505538" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERAB41.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Wed Sep 18 10:36:00 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	42134
Entropy (8bit):	2.541544481295443
Encrypted:	false
SSDEEP:	192:Nrqvu0QveDOxO36VTnCO2WlEx1ZJDGR44lzNT0k9tyylkJ:0Wpve60KVsWlEx1ZtGR4kzNDmck
MD5:	44B4B62A6AC3134FB1E4A156C4BDA591
SHA1:	DDEFE7135FEFC1759C89522BF262546261A46AFC
SHA-256:	F5CC371890636CDBFAC1F92F0925F8AFC7BEE5D0553CB519E3B2D187125D24CB
SHA-512:	8F4FFF4BD4CAD0648239ABAE2C95C4F232CAF293001FA0E18F66FDDEA1F1BBA807D2700A0478B6375B54529BF2ACA0A095E2759F859E871714647449BBFF4BBA
Malicious:	false
Preview:	MDMP..a..... ..........f............4...........T...<............/..........T.......8...........T........... "..v............ ..........\|"..............................................................................eJ.......#......GenuineIntel............T...........E..f............................. ..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERABEE.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8338
Entropy (8bit):	3.696079060612583
Encrypted:	false
SSDEEP:	192:R6l7wVeJos6oMB6Y2DjSU4JYgmf4lpDT89ba/sfE+m:R6lXJz6oMB6YuSU4JYgmf40akf0
MD5:	6F0D3685FAFE63C2D8A4460A701CBD96
SHA1:	FAAC0A4AE13EB27C6F8C817996ADBE0B9F716BFA
SHA-256:	C9CF5280700D2501B82E72E079AD4ABD65D47B5F8EAD0AE2E10DEB6ED462B53E
SHA-512:	AC7F631263F44735626EF26D774611FD8EEA1768393BE16A8FA3F70D283944C4D1892CFF5F7F869A05D06BC3FD4A8EEECA74C75FCD2D7447515836157DD36E32
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.5.6.4.8.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERAC2D.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4636
Entropy (8bit):	4.45134752519171
Encrypted:	false
SSDEEP:	48:cvIwWl8zs2vJg77aI9xM/7WpW8VYjrYm8M4JlGN0/aFeL+q8KWaKODyUM/312X1a:uIjfAI7PM/K7VvJlbt55DyUM92FUd
MD5:	148D5A141ECE8C1DD3E5E28C2CF451DD
SHA1:	F931151F026760B850749AE6BF1A0FCF3DF9167B
SHA-256:	72CE288584C959BB777625DB8677A68116F11C5BB6C22758E321DCB17D66192C
SHA-512:	7990D9C318EFCFC42B6DA4516D4F592DC009F8B0426F824473B2FEA8CFA456B85882112586AB55D3F7C437D2D28CA8AA700984E49CC0035BCB4A055005DC093C
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="505538" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERC2EE.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Wed Sep 18 10:32:50 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	42678
Entropy (8bit):	2.422041826173391
Encrypted:	false
SSDEEP:	384:5lWQveK0KVoGQi8lJIlKXZVEMOAQ/uDve1KZ:5UO70KVoGhMOuMi
MD5:	D1B68FF4E27FBB2752C9F19413892B18
SHA1:	F7F355935AD4B32B81E312CC73E87DFABC569131
SHA-256:	826EC730E643220692C5854AFFA6CFD42425D722501D67E101662036D621BDA6
SHA-512:	9527D0E2508982BBA284A0C1BB09E164F5D1F41FD5898B6649CA910A5DF294D05357B9B069990D20937651566E113DF43AFD3F77E9786F7DF21260B977F55869
Malicious:	false
Preview:	MDMP..a..... .......R..f............4...........T...<............/..........T.......8...........T...........p"..F............ ..........\|"..............................................................................eJ.......#......GenuineIntel............T...........2..f............................. ..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERC4D3.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8336
Entropy (8bit):	3.6964693759924145
Encrypted:	false
SSDEEP:	192:R6l7wVeJMf56husgo6Y2DjSUH6hgmfqRWprC89bLUsfr5m:R6lXJMB6ULo6Y+SUH6hgmfqRQLHf4
MD5:	3BF35C7AE6FC736760FDCAC695128A06
SHA1:	ED73C2DE9DD15B096EC136C44AF214038FD742F7
SHA-256:	6CF4AD68FFCED3BCAB04D532EAC0DB01A0578D235170881F15EE6EA0B407B92C
SHA-512:	AA71A59BDAEA1774AF826FA8870878F3FE6B1D9D32CE566441EF16375870BDCD80369C87C5E7308E6F7CF2F62B8DE71EA05CC3860C4AD063F88B682051B0D264
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.1.0.0.8.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERC503.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4636
Entropy (8bit):	4.44688119961079
Encrypted:	false
SSDEEP:	48:cvIwWl8zs20Jg77aI9xM/7WpW8VYjeYm8M4JlGN0GFY+q8KWaUTEUM/312X1bd:uIjfHI7PM/K7VeJlf54EUM92Fbd
MD5:	1781602D3A6E8D2363B92546F2E0C114
SHA1:	F130DEF17517DFCCE13DB1A292F2FF81AC5C9DBF
SHA-256:	763AD46020394B21CADB2F9093F493C88EE20EC3532897EBF438FF53B5C2B886
SHA-512:	63850DD1B96E7672773391BBC96C7918086351F7C938B48B15813A76C82D0890AF85E552C32E188D36E4D90CF1E7E31D34720009AB8C4F0432441A76BDC70CA4
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="505535" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE5F.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Wed Sep 18 10:33:09 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	42596
Entropy (8bit):	2.5615366832978688
Encrypted:	false
SSDEEP:	192:/iqvuuQvezGdOxO36VTxBXdKZU7ZLg6EQa13hz9UptBEmH:xW7vezGQ0KVtBNKZU7ZL9E3HmtSmH
MD5:	570E3E7A3DE9FEE2BCEED9EB874E3F2F
SHA1:	CF0A60A7B5AF3E0C8DB3AC6F7F586C3E7F0EDE19
SHA-256:	575852187DEA344CB30FEA56752F89C05321188AAA35C42D3D8F595F5ECC2D67
SHA-512:	8F4529ACB364DBDD6D03AA53CA7E7FD192CACDAA3DFFF2AACB53C740F01D845BB0A79D8252DC747BDC24F8F3D12A9864131730144D41C0A77BAA7E90796945A1
Malicious:	false
Preview:	MDMP..a..... .......e..f............4...........T...<............/..........T.......8...........T............!............... ..........\|"..............................................................................eJ.......#......GenuineIntel............T...........;..f............................. ..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE7AC.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Wed Sep 18 10:33:00 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	43950
Entropy (8bit):	2.4657807595327528
Encrypted:	false
SSDEEP:	192:21qqvunQve7E3OxO36VTAy83l5IlKXZVEMsINoUCPl86RcGDknt276vMe:qRWQveAe0KVMT3l5IlKXZVEMFHg6nZke
MD5:	174E6E63A5A719414522B8694A6563F3
SHA1:	0C715A51792619981AA2E192CB09C53BC10B053C
SHA-256:	1D453F583F1063BEA17C6FD2ADB4290F6C1FF8B811169F7C12CB14694B4AEA5C
SHA-512:	C1F4968ADAE309EAF0D161B0523E2D6C26847CDD0C654628A64ADD05DC8FBE293ACD364AF74415F465B0A71A91452D1FD062ECB7A6C576799FCE31ABC208936E
Malicious:	false
Preview:	MDMP..a..... .......\..f............4...........T...<............/..........T.......8...........T........... "............... ..........\|"..............................................................................eJ.......#......GenuineIntel............T...........2..f............................. ..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WEREAE9.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8334
Entropy (8bit):	3.6984711181632295
Encrypted:	false
SSDEEP:	192:R6l7wVeJMfU6cH2ge6Y2D7SUu6Rgmf4lpDw89bPUsfflm:R6lXJMc6sNe6Y2SUu6Rgmf49PHfw
MD5:	05A7B57275BAC01CDFF3A2E8B819B7CD
SHA1:	2E5994065A36FC7451130C8D9A5E3CD77D8D9B0C
SHA-256:	1B8DE1DFE248342B43809ED1EBEED605BF564559272D1DC0C79D576ADBAA0D4B
SHA-512:	8E1A3AA9FB7443551A079FCEA5916E64AFCFCB6406230749EC88B3C39BB2108946994A8EB982A2D2C16EBF0FB0C0D3E46C6BF5D23015A796CF2CF9BF9D8E1207
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.1.0.0.8.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WEREB96.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4636
Entropy (8bit):	4.451517424712948
Encrypted:	false
SSDEEP:	48:cvIwWl8zs20Jg77aI9xM/7WpW8VYj7Ym8M4JlGN0/aF8+q8KWaKOiEUM/312X1bd:uIjfHI7PM/K7VDJlbH55iEUM92Fbd
MD5:	0E268E4E66107B8FB6D31AA841B4F6DE
SHA1:	4F5A3DF637239763F8A54EB9110B1E5C88368B3D
SHA-256:	BC4EF89A096ED904DC292C05022E81D379556A92C6642718EC41F0FC60FB089E
SHA-512:	CFFC6A89DCF20810869E5030613B6F5008A5DF525836F18BF346C32C5EC38E97D483FDF2C4073FCAE6176AAAE220B4691C0424A9535E3019084E9CD4AB0E17B6
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="505535" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERF568.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Wed Sep 18 10:33:03 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	41304
Entropy (8bit):	2.5185124044955223
Encrypted:	false
SSDEEP:	384:hW7veCa70KVrveIKZs7ZL9YAQisX/0YPrQv:ob/a0KVrrvANv0v
MD5:	1CDC461906579DA1D25F446311C1F6CE
SHA1:	1BFBCCBC817302A7FF54DA981299F4A7512C0691
SHA-256:	C68FE4D5529699D9AA43F084CD825882F0990725AC7A5CE68A6579B537171BBE
SHA-512:	ECBCD6A0C74ABB1308027D947868A69932C15E93437AA1FD6CE9A840829E730D82DDB3C328B4BEA33852C7361E49C5561C8CD77A0C4EA42432B8DF1F27003C3B
Malicious:	false
Preview:	MDMP..a..... ......._..f............4...........T...<............/..........T.......8...........T........... "..8............ ..........\|"..............................................................................eJ.......#......GenuineIntel............T...........;..f............................. ..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERF663.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8328
Entropy (8bit):	3.6975312828566493
Encrypted:	false
SSDEEP:	192:R6l7wVeJs66l8Nec6Y2DiSUq8VgmfqRWprz89bUZsfu8m:R6lXJZ6cec6YfSUq2gmfqR3Uyfc
MD5:	19D989E1D8389BB46F55A0EFDDA1AF62
SHA1:	9D4AD1E6FC89197C22C9E3262833D0B3F9C408B9
SHA-256:	1F0FB0B9B7C1B7940C654532BAF1DED2106610CE801175A2486FAB7BE498E585
SHA-512:	7870792FDA5E0186F0C546972FC94BC7673C023CFD83F7060A2281D91714213BA4C7F8BE6E9CBB0C169134EA3FC97F0411CFE2C930FB2E04801D95A4DE1937E1
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.7.2.<./.P.i.d.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERF693.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4636
Entropy (8bit):	4.446811118575354
Encrypted:	false
SSDEEP:	48:cvIwWl8zs20Jg77aI9xM/7WpW8VYjqYm8M4JlGN0GFI+q8KWaUPVUM/312X1Od:uIjfHI7PM/K7VOJl/5MVUM92FOd
MD5:	710A105E23268543E341C7C27F8CDDE4
SHA1:	9EE2AA588CF848A507BAC6B950634A45BBD0BBE3
SHA-256:	C27EF771A717AC4F8BB0A4663FBDF24D1591BE98512D7C4D126AB8D350043CD0
SHA-512:	6A5A264678580EE51DD345B1C319488DEA4FBCE9C98F8B4D2FC2FE89067F40CC1EC32D3BB7162D0904442DB98DD05FADF4CDEC536C0591FE2213E6914A19FD8A
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="505535" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERF98.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8328
Entropy (8bit):	3.6968568528588643
Encrypted:	false
SSDEEP:	192:R6l7wVeJsv6l0XgW6Y2D4vSUD8egmf4lpDa89b+Zsf9Km:R6lXJM66gW6YPvSUDNgmf4T+yfR
MD5:	339637AEB69ED7A90A0B3BCB350B3197
SHA1:	608960533A7BB59D38FB74DCAC12EB0ADB2E3C9D
SHA-256:	16FABBF54352734811FBF361533C0A5B6CBFDA387335CF24CD6EDB6CADDAFA28
SHA-512:	C0E8E77B86E178B97A93563903571B80164D48186604841420F1D27D0741F2394F93FFE3E80802461CB066EED4D03812F4A5E2C4DEDBFBC557C7CB844DEB1FAE
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.7.2.<./.P.i.d.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERFE7.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4636
Entropy (8bit):	4.449176099981711
Encrypted:	false
SSDEEP:	48:cvIwWl8zs20Jg77aI9xM/7WpW8VYj7Ym8M4JlGN0/aFb+q8KWaKOCVUM/312X1Od:uIjfHI7PM/K7VzJlbk55CVUM92FOd
MD5:	231D14965155BA97D9C7C6DA386E4624
SHA1:	BCB4E59943DBCF5F203A85A52867FE09C1F6D445
SHA-256:	C7DBF18B0CFC5F4DD5513E6FB58D423F978235A48CC68D3B08B55A08E78B4FEC
SHA-512:	9A6AEB176AC59C5E7275E9A592478EAD09F3F499FE846EECA813686BD97328D7C61942F7DABF9EEA38253970B8134DF58BB6F028C04CEB86D45AAF9C43B76CE4
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="505535" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Users\user\AppData\Local\045012

Download File

Process:	C:\Users\user\Contacts\Flexpcis.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	32
Entropy (8bit):	4.226409765557392
Encrypted:	false
SSDEEP:	3:1Eypy62gpZ:1XpydOZ
MD5:	C04AF24293BB4A166A030312DB058FDD
SHA1:	572F86124B0BA912154ABCA2E5E0D035721DAAF1
SHA-256:	5AD826FC409D425903A533B7DC22EFC20E65BEC695B388F566354750CE72F68D
SHA-512:	29BB251046F1D9B3D814A009F1CFCB6096FC82A1327C6377A1D6728777B34E8B3F39B5E37A7374633830773F995A2B42B6199B501A71CED62026CD5355C48CCC
Malicious:	false
Preview:	[Generate Pasta]..XPOSpgXHzHda..

C:\Users\user\Contacts\Drivespan.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	40893952
Entropy (8bit):	7.994388187390278
Encrypted:	true
SSDEEP:	786432:IK77DrSzdarnCa3k7aNLG2e2am1WbBRx+cFhNWT22wn9gw:IwDrW4zCaUQLGhXmcVRBhNWTtwn
MD5:	A84EA0B3230101C7AAEE1D4DE79F615F
SHA1:	ADF02B601C87A9CF2277C1D996767700AA5876F7
SHA-256:	A4392E381DBEB93EA88CB227615C5CBEE1ECFEE3E78FFC39F95FD0C958DEF744
SHA-512:	5D0F1C07270D44620604A6A19ACC5ADC5CD2E694D71F83DAD4548FD20B9F962BDE45C4AF0D6ADD1D7C250F0115B15C5CA3809FDF97591CCCD56E3F48F9172EA0
Malicious:	true
Antivirus:	Antivirus: Virustotal, Detection: 33%, Browse
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........PE..L......f...........!.....$O...^.......N......@O...@.......................................@...........................!.....\.M.T.......X......................P.............................................................5......................text.....N......................... ..`.itext..t=....O..................... ..`.data........@O.....................@....bss..........P..........................idata...?...`S.....................@....didata.0.....S.....................@....edata........S.....................@..@.rdata..E.....S.....................@..@.aJ4.........S.....................@..@.7VB.....:....Z.....................@..@.debug....K...d.....................@..@./VW......d......................... ..`.eW.................................@....}w/......o.......o................. ..`.rsrc...X.............o.............@..@.reloc..P............o.

C:\Users\user\Contacts\Flexpcis.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	138520
Entropy (8bit):	5.97678172694547
Encrypted:	false
SSDEEP:	3072:h1tkoMvK2ZjKlrH5ySykwTzwk5aOz1b3aDczMns53:h1tkpZyCj1mDcIu3
MD5:	E04F15D35A1807C4D74D2538D5FE28C9
SHA1:	9A42B387BABDEA719D54C1E11BAAE9FDB9897F71
SHA-256:	7E4132835419E4C415D048B64A5FC2813B8D2FF72BB5586D857DCDF6A90A45F2
SHA-512:	0FA81E472CC65AC3E0DC6427D72002905C577B61C98CBB2859829EF5A139B1AC81FA09D680614C4EA94D599919E67C62F28475AF813400106DDDABE57180AAE9
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Joe Sandbox View:	Filename: NFeNFCe.msi, Detection: malicious, Browse Filename: Fct63e39.msi, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......`u.h$.f;$.f;$.f;...;-.f;...;].f;...;<.f;.Je:6.f;.Jc:..f;.Jb:6.f;..;-.f;$.g;y.f;.Jo:&.f;.J.;%.f;$..;%.f;.Jd:%.f;Rich$.f;........PE..L....&.].........."..................(............@..........................@......Q.....@.................................DI..d.......8................3...0......@;..p............................;..@...............4............................text.../........................... ..`.rdata..L`.......b..................@..@.data........`.......8..............@....gfids...............B..............@..@.rsrc...8............D..............@..@.reloc.......0......................@..B................................................................................................................................................................................................................................................................

C:\Windows\Installer\3c0868.msi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Security: 0, Code page: 1252, Revision Number: {182C5263-9A4F-4811-9832-23486A29A112}, Number of Words: 10, Subject: Microsoft-Edge-Web-View2-Runtime, Author: Microsoft, Name of Creating Application: Microsoft-Edge-Web-View2-Runtime, Template: ;1046, Comments: A base dados do instalador contm a lgica e os dados necessrios para instalar o Microsoft-Edge-Web-View2-Runtime., Title: Installation Database, Keywords: Installer, MSI, Database, Create Time/Date: Tue Sep 17 18:28:10 2024, Last Saved Time/Date: Tue Sep 17 18:28:10 2024, Last Printed: Tue Sep 17 18:28:10 2024, Number of Pages: 450
Category:	dropped
Size (bytes):	41998336
Entropy (8bit):	7.988801588430793
Encrypted:	false
SSDEEP:	786432:b4ztbf6AoshmMYKXPrhcY32uoS59BVT8KoYcIxuhs7lekMqT0:b4pbSTS7YK/WY3tJ5jhrVxuhsZek
MD5:	55E1B6A518BC3E243D8D856EE17430AA
SHA1:	F83DC91C91F89D6A321892D54B4DE229041B07D1
SHA-256:	BAF5979F4C227BE5B3F1BF4F03E5902E8B7FCC2DAD38068F363A0096CB12A536
SHA-512:	CAFAA29EAD2294CFDD2B63912B6DCABD3853FA2D691065B3F398D689F06931DF3AD72F9F4A2C7EBBB9E53B7B77B318489FF6B9785129FDBAC576BC835BF5FCDC
Malicious:	false
Preview:	......................>.......................................................G.......c.......p...........................................................................................................................................................................................................................................................................................................................................................................................................................................=...............#...4........................................................................................... ...!..."...,...$...%...&...'...(...)...*...+...1...-......./...0...5...2...3...>...@...6...7...8...9...:...;...<.......#...?...F...A...B...C...D...E...............I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z...[...\...]...^..._...`...a...b...c...d...e...f...g...h...i...j...k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\Windows\Installer\3c086b.msi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Security: 0, Code page: 1252, Revision Number: {182C5263-9A4F-4811-9832-23486A29A112}, Number of Words: 10, Subject: Microsoft-Edge-Web-View2-Runtime, Author: Microsoft, Name of Creating Application: Microsoft-Edge-Web-View2-Runtime, Template: ;1046, Comments: A base dados do instalador contm a lgica e os dados necessrios para instalar o Microsoft-Edge-Web-View2-Runtime., Title: Installation Database, Keywords: Installer, MSI, Database, Create Time/Date: Tue Sep 17 18:28:10 2024, Last Saved Time/Date: Tue Sep 17 18:28:10 2024, Last Printed: Tue Sep 17 18:28:10 2024, Number of Pages: 450
Category:	dropped
Size (bytes):	41998336
Entropy (8bit):	7.988801588430793
Encrypted:	false
SSDEEP:	786432:b4ztbf6AoshmMYKXPrhcY32uoS59BVT8KoYcIxuhs7lekMqT0:b4pbSTS7YK/WY3tJ5jhrVxuhsZek
MD5:	55E1B6A518BC3E243D8D856EE17430AA
SHA1:	F83DC91C91F89D6A321892D54B4DE229041B07D1
SHA-256:	BAF5979F4C227BE5B3F1BF4F03E5902E8B7FCC2DAD38068F363A0096CB12A536
SHA-512:	CAFAA29EAD2294CFDD2B63912B6DCABD3853FA2D691065B3F398D689F06931DF3AD72F9F4A2C7EBBB9E53B7B77B318489FF6B9785129FDBAC576BC835BF5FCDC
Malicious:	false
Preview:	......................>.......................................................G.......c.......p...........................................................................................................................................................................................................................................................................................................................................................................................................................................=...............#...4........................................................................................... ...!..."...,...$...%...&...'...(...)...*...+...1...-......./...0...5...2...3...>...@...6...7...8...9...:...;...<.......#...?...F...A...B...C...D...E...............I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z...[...\...]...^..._...`...a...b...c...d...e...f...g...h...i...j...k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\Windows\Installer\MSI1078.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	756688
Entropy (8bit):	6.616698594957689
Encrypted:	false
SSDEEP:	12288:UCw0mKFlJ/FFhmNKxhjszLF9lph0lhSMXlez0yw5v2cX+f/8O:U70fnJ/PhmNKnYzLFhh0lhSMXlM0yw50
MD5:	EE45C6DFFAF86ED2A76D8F969C390C08
SHA1:	FF5B2942FFA7D28ED3F72208E8E76391B2991B5A
SHA-256:	118A551EEF23BF842ED470316AA1A50BF17B6D656652879802D4ACC0184608CA
SHA-512:	A92BC7AFF5DA3DC33263EA3D43CF617D47A2A6C589118F7EE3C5F293D63171778A7A37815EC23CB426558546CF0A1E694C67C7CBC36CCA92677DE566D1D71664
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Joe Sandbox View:	Filename: danf082024xml.msi, Detection: malicious, Browse Filename: , Detection: malicious, Browse Filename: XML202407brs.msi, Detection: malicious, Browse Filename: fin.746.msi, Detection: malicious, Browse Filename: Setup.msi, Detection: malicious, Browse Filename: NF_e_07_2024_XML__.msi, Detection: malicious, Browse Filename: Dramatisation.msi, Detection: malicious, Browse Filename: NF_e_22_05_36543547357358BR.msi, Detection: malicious, Browse Filename: HomeDesk.msi, Detection: malicious, Browse Filename: NFs_468.msi, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........!.1.@lb.@lb.@lb@2oc.@lb@2ic8@lbQ.hc.@lbQ.oc.@lbQ.ic.@lb@2hc.@lb@2jc.@lb@2mc.@lb.@mbVAlb`.ec.@lb`.lc.@lb`.b.@lb.@.b.@lb`.nc.@lbRich.@lb................PE..L...Q)1f.........."!...'............@................................................g....@A........................`...........,....................N...=.......x..p...p...............................@...............x............................text............................... ..`.rdata..............................@..@.data....%..........................@....rsrc...............................@..@.reloc...x.......z..................@..B................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI10C7.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	756688
Entropy (8bit):	6.616698594957689
Encrypted:	false
SSDEEP:	12288:UCw0mKFlJ/FFhmNKxhjszLF9lph0lhSMXlez0yw5v2cX+f/8O:U70fnJ/PhmNKnYzLFhh0lhSMXlM0yw50
MD5:	EE45C6DFFAF86ED2A76D8F969C390C08
SHA1:	FF5B2942FFA7D28ED3F72208E8E76391B2991B5A
SHA-256:	118A551EEF23BF842ED470316AA1A50BF17B6D656652879802D4ACC0184608CA
SHA-512:	A92BC7AFF5DA3DC33263EA3D43CF617D47A2A6C589118F7EE3C5F293D63171778A7A37815EC23CB426558546CF0A1E694C67C7CBC36CCA92677DE566D1D71664
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........!.1.@lb.@lb.@lb@2oc.@lb@2ic8@lbQ.hc.@lbQ.oc.@lbQ.ic.@lb@2hc.@lb@2jc.@lb@2mc.@lb.@mbVAlb`.ec.@lb`.lc.@lb`.b.@lb.@.b.@lb`.nc.@lbRich.@lb................PE..L...Q)1f.........."!...'............@................................................g....@A........................`...........,....................N...=.......x..p...p...............................@...............x............................text............................... ..`.rdata..............................@..@.data....%..........................@....rsrc...............................@..@.reloc...x.......z..................@..B................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI1135.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	756688
Entropy (8bit):	6.616698594957689
Encrypted:	false
SSDEEP:	12288:UCw0mKFlJ/FFhmNKxhjszLF9lph0lhSMXlez0yw5v2cX+f/8O:U70fnJ/PhmNKnYzLFhh0lhSMXlM0yw50
MD5:	EE45C6DFFAF86ED2A76D8F969C390C08
SHA1:	FF5B2942FFA7D28ED3F72208E8E76391B2991B5A
SHA-256:	118A551EEF23BF842ED470316AA1A50BF17B6D656652879802D4ACC0184608CA
SHA-512:	A92BC7AFF5DA3DC33263EA3D43CF617D47A2A6C589118F7EE3C5F293D63171778A7A37815EC23CB426558546CF0A1E694C67C7CBC36CCA92677DE566D1D71664
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........!.1.@lb.@lb.@lb@2oc.@lb@2ic8@lbQ.hc.@lbQ.oc.@lbQ.ic.@lb@2hc.@lb@2jc.@lb@2mc.@lb.@mbVAlb`.ec.@lb`.lc.@lb`.b.@lb.@.b.@lb`.nc.@lbRich.@lb................PE..L...Q)1f.........."!...'............@................................................g....@A........................`...........,....................N...=.......x..p...p...............................@...............x............................text............................... ..`.rdata..............................@..@.data....%..........................@....rsrc...............................@..@.reloc...x.......z..................@..B................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI1194.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	756688
Entropy (8bit):	6.616698594957689
Encrypted:	false
SSDEEP:	12288:UCw0mKFlJ/FFhmNKxhjszLF9lph0lhSMXlez0yw5v2cX+f/8O:U70fnJ/PhmNKnYzLFhh0lhSMXlM0yw50
MD5:	EE45C6DFFAF86ED2A76D8F969C390C08
SHA1:	FF5B2942FFA7D28ED3F72208E8E76391B2991B5A
SHA-256:	118A551EEF23BF842ED470316AA1A50BF17B6D656652879802D4ACC0184608CA
SHA-512:	A92BC7AFF5DA3DC33263EA3D43CF617D47A2A6C589118F7EE3C5F293D63171778A7A37815EC23CB426558546CF0A1E694C67C7CBC36CCA92677DE566D1D71664
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........!.1.@lb.@lb.@lb@2oc.@lb@2ic8@lbQ.hc.@lbQ.oc.@lbQ.ic.@lb@2hc.@lb@2jc.@lb@2mc.@lb.@mbVAlb`.ec.@lb`.lc.@lb`.b.@lb.@.b.@lb`.nc.@lbRich.@lb................PE..L...Q)1f.........."!...'............@................................................g....@A........................`...........,....................N...=.......x..p...p...............................@...............x............................text............................... ..`.rdata..............................@..@.data....%..........................@....rsrc...............................@..@.reloc...x.......z..................@..B................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI129E.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	3835
Entropy (8bit):	5.511858369461452
Encrypted:	false
SSDEEP:	96:kYRBoAkLi16R2smJ87N/i6iy1CQEFLIVBc+hIUQfZzF08e:kYk89w9iaWQ
MD5:	09D020362DA9A1D20AF7B8B9CAD7B9A3
SHA1:	6F560CED003EC5D5F0F388C60EFF692F0CD9A460
SHA-256:	E37D5A33E8BDBE98190F6C85A947FF77F71EBD752B764564493D4409244F2F8F
SHA-512:	61E7597111F8C71A7A69136DC6007CB3483A6AEF51548E4A9EC8E0076B1AB48B1F87122BD5FC3EA04D2A93B449D3AF74B82F9DB5815D961947FEFA223863D8F2
Malicious:	false
Preview:	...@IXOS.@.....@.42Y.@.....@.....@.....@.....@.....@......&.{8AE8C42A-5150-4814-B7AC-A22D49C22F14} .Microsoft-Edge-Web-View2-Runtime(.IRPF2024-0940959038w904598304w985036.msi.@.....@.....@.....@........&.{182C5263-9A4F-4811-9832-23486A29A112}.....@.....@.....@.....@.......@.....@.....@.......@.... .Microsoft-Edge-Web-View2-Runtime......Rollback..A.....o. .d.e. .r.e.s.t.a.u.r.a.....o.....RollbackCleanup..Removendo arquivos de backup..Arquivo: [1]...@.......@........ProcessComponents%.Atualizando o registro de componentes...@.....@.....@.]....&.{D85BA408-01F5-4AFD-AD63-1EA8CE77B976}..C:\Users\user\Contacts\.@.......@.....@.....@......&.{B5D76D82-8DC1-4B7E-8DC8-49EA79186188}?.01:\Software\Microsoft\Microsoft-Edge-Web-View2-Runtime\Version.@.......@.....@.....@......&.{BC4FEDCD-3E0E-4107-9E61-FB50233A89F0}..01:\Software\Microsoft\.@.......@.....@.....@......&.{484CC30A-1C9E-4E93-BFCE-F924EF61B954}..01:\Software\Microsoft\Windows\.@.......@.....@.....@......&.{C36507B6-9328-4E18-9954-CF

C:\Windows\Installer\MSIFFA.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	756688
Entropy (8bit):	6.616698594957689
Encrypted:	false
SSDEEP:	12288:UCw0mKFlJ/FFhmNKxhjszLF9lph0lhSMXlez0yw5v2cX+f/8O:U70fnJ/PhmNKnYzLFhh0lhSMXlM0yw50
MD5:	EE45C6DFFAF86ED2A76D8F969C390C08
SHA1:	FF5B2942FFA7D28ED3F72208E8E76391B2991B5A
SHA-256:	118A551EEF23BF842ED470316AA1A50BF17B6D656652879802D4ACC0184608CA
SHA-512:	A92BC7AFF5DA3DC33263EA3D43CF617D47A2A6C589118F7EE3C5F293D63171778A7A37815EC23CB426558546CF0A1E694C67C7CBC36CCA92677DE566D1D71664
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........!.1.@lb.@lb.@lb@2oc.@lb@2ic8@lbQ.hc.@lbQ.oc.@lbQ.ic.@lb@2hc.@lb@2jc.@lb@2mc.@lb.@mbVAlb`.ec.@lb`.lc.@lb`.b.@lb.@.b.@lb`.nc.@lbRich.@lb................PE..L...Q)1f.........."!...'............@................................................g....@A........................`...........,....................N...=.......x..p...p...............................@...............x............................text............................... ..`.rdata..............................@..@.data....%..........................@....rsrc...............................@..@.reloc...x.......z..................@..B................................................................................................................................................................................................................................................................................

C:\Windows\Installer\SourceHash{8AE8C42A-5150-4814-B7AC-A22D49C22F14}

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.1791049698547857
Encrypted:	false
SSDEEP:	12:JSbX72FjKAGiLIlHVRpTh/7777777777777777777777777vDHFkPON8l0i8Q:JgQI5XLXF
MD5:	EAA4944F4FE1707F6219B67807A5B1A6
SHA1:	1E2F21AC5F24F9B1655029D818E5EDB4147829C9
SHA-256:	1C6E1AFBCD578230CFD41EF6CE5607634D4151BAA18719855CAA0DC377354149
SHA-512:	EA8E64F2E6BE428718F57A34BABFE9966DACC9B902E8613AAD575A3E876BAA8163FCC360BBAC1E25055AAC7ADBB83DEBFEB88274BE11B4390BE5C9B8D6105011
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\inprogressinstallinfo.ipi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.5141807958742566
Encrypted:	false
SSDEEP:	48:o8PhruRc06WX4eFT57iAEXkISAkKAEbCyjMHJkISAkAToZ:3hr1uFTdizXkIJkRwC0MpkIJkrZ
MD5:	BA07F0B5F54FB688B1A85392A0558B01
SHA1:	3DD6B98EA980999CE163072D9D4E4AC69299F7E4
SHA-256:	A4EE36A7E613E5F0272EF589C12FBFC52B5712C1DBC804E8BEED3F7C49992B09
SHA-512:	AEA47CA1B6A1CBAD1B7CE25D1A5DA8CEACD3A4B6F94513068052F0BC92C91113F72184C0D043689E55F6DABB9FA0654DD9AA779F9EC2115B8994227534C64AD0
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	360001
Entropy (8bit):	5.363000044597883
Encrypted:	false
SSDEEP:	1536:6qELG7gK+RaOOp3LCCpfmLgYI66xgFF9Sq8K6MAS2OMUHl6Gin327D22A26KgauU:zTtbmkExhMJCIpE9
MD5:	BC10EA1CC84F57281ED562301328B7E5
SHA1:	8762E02044F1785649A4E3D12AF5449523266A6E
SHA-256:	F77D4A61EA4C593D2C657DBEAD20A32EFB639B5CCE41E5F2CEDB48AD3A77AEC9
SHA-512:	D4A5E73F67B4422A2B089558B0E607B851C4ACD1A0D3B00E735BB88F8E081B52FCB745C8F75A8829D60B6795438BC6C74B31AF397856197C864103C2DA2AC9BE
Malicious:	false
Preview:	.To learn about increasing the verbosity of the NGen log files please see http://go.microsoft.com/fwlink/?linkid=210113..12/07/2019 14:54:22.458 [5488]: Command line: D:\wd\compilerTemp\BMT.200yuild.1bk\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe executeQueuedItems /nologo ..12/07/2019 14:54:22.473 [5488]: Executing command from offline queue: install "System.Runtime.WindowsRuntime.UI.Xaml, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=b77a5c561934e089, processorArchitecture=msil" /NoDependencies /queue:1..12/07/2019 14:54:22.490 [5488]: Executing command from offline queue: install "System.Web.ApplicationServices, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil" /NoDependencies /queue:3..12/07/2019 14:54:22.490 [5488]: Exclusion list entry found for System.Web.ApplicationServices, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil; it will not be installed..12/07/2019 14:54:22.490 [

C:\Windows\Temp\~DF16F4CBC303799346.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.2167897095820628
Encrypted:	false
SSDEEP:	48:OQzuxthPIFX4fT5biAEXkISAkKAEbCyjMHJkISAkAToZ:nzOI8TtizXkIJkRwC0MpkIJkrZ
MD5:	CFCE3F6B0CE43024C62578F3EDE7B714
SHA1:	111B4B97E72578F23F3C5173A7370789B76773AF
SHA-256:	459D9CD453910DCAE8B17ABBA46D217B45147EF887C594EF3D99FE61A4189515
SHA-512:	515A192D4446B9347AFC6E4A9137E8C5894572CDA68BCC4707E2184EA300368DE96303D0733C0424BAECACD8589FB15401103468828840344B22C0732352D302
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF23C2E342538A7895.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF3AB89369EB04E383.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF608BC4025E100561.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	73728
Entropy (8bit):	0.11832641331826951
Encrypted:	false
SSDEEP:	24:twBIEbz+TxVgkIipVVgkSVgkIipVVgkKAEVkyjCyjMHVgwGqV2+kPeRvQ:jEmTUkISAkjkISAkKAEbCyjMHKZAv
MD5:	C3CA8F58D4DBFCB26772E9B27DAD0FDD
SHA1:	0777696421F464A251963FFD03C027A2EEF567B6
SHA-256:	3BC467469293F7FD01AB645E74645479F83E61E7224970F7FE01A7806DB797AD
SHA-512:	16665E04D20CC59CC2FF4CE3D7AD84626D67016A13C741C92C71FA6E91CCCF20919785E5725D1BF9589C6DEA25B96EDF97641CC736AA5193D58539BA288BC476
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF7A00D390EAD6A491.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.08235243325159758
Encrypted:	false
SSDEEP:	6:2/9LG7iVCnLG7iVrKOzPLHKOlrAXSyYldHYEoVky6l8:2F0i8n0itFzDHFkPON8
MD5:	4C8757C1D7C15C67D8F746CDD7315158
SHA1:	82FBA3C8CD117DDBEDDD06CAA592B76BE1692269
SHA-256:	BC07CE5591A7573A3489F80A75A24DE183697498483D174D7A13537CCE770BCC
SHA-512:	2C40B0FCC186093AA40EF0FC1E9F732F43EC75943635649566A118A79D2EEFB3C6CC40691C2445870A722938E118F242F5C47A2C81D9D69CB31A6F6AE6A7EF1F
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF7E197EEFE656D794.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.2167897095820628
Encrypted:	false
SSDEEP:	48:OQzuxthPIFX4fT5biAEXkISAkKAEbCyjMHJkISAkAToZ:nzOI8TtizXkIJkRwC0MpkIJkrZ
MD5:	CFCE3F6B0CE43024C62578F3EDE7B714
SHA1:	111B4B97E72578F23F3C5173A7370789B76773AF
SHA-256:	459D9CD453910DCAE8B17ABBA46D217B45147EF887C594EF3D99FE61A4189515
SHA-512:	515A192D4446B9347AFC6E4A9137E8C5894572CDA68BCC4707E2184EA300368DE96303D0733C0424BAECACD8589FB15401103468828840344B22C0732352D302
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF9259F7AAB6FE3BDC.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFA958147AE2964D71.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.5141807958742566
Encrypted:	false
SSDEEP:	48:o8PhruRc06WX4eFT57iAEXkISAkKAEbCyjMHJkISAkAToZ:3hr1uFTdizXkIJkRwC0MpkIJkrZ
MD5:	BA07F0B5F54FB688B1A85392A0558B01
SHA1:	3DD6B98EA980999CE163072D9D4E4AC69299F7E4
SHA-256:	A4EE36A7E613E5F0272EF589C12FBFC52B5712C1DBC804E8BEED3F7C49992B09
SHA-512:	AEA47CA1B6A1CBAD1B7CE25D1A5DA8CEACD3A4B6F94513068052F0BC92C91113F72184C0D043689E55F6DABB9FA0654DD9AA779F9EC2115B8994227534C64AD0
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFAC84E120CDD50405.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.2167897095820628
Encrypted:	false
SSDEEP:	48:OQzuxthPIFX4fT5biAEXkISAkKAEbCyjMHJkISAkAToZ:nzOI8TtizXkIJkRwC0MpkIJkrZ
MD5:	CFCE3F6B0CE43024C62578F3EDE7B714
SHA1:	111B4B97E72578F23F3C5173A7370789B76773AF
SHA-256:	459D9CD453910DCAE8B17ABBA46D217B45147EF887C594EF3D99FE61A4189515
SHA-512:	515A192D4446B9347AFC6E4A9137E8C5894572CDA68BCC4707E2184EA300368DE96303D0733C0424BAECACD8589FB15401103468828840344B22C0732352D302
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFB0C9AB7BFDFCC802.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.5141807958742566
Encrypted:	false
SSDEEP:	48:o8PhruRc06WX4eFT57iAEXkISAkKAEbCyjMHJkISAkAToZ:3hr1uFTdizXkIJkRwC0MpkIJkrZ
MD5:	BA07F0B5F54FB688B1A85392A0558B01
SHA1:	3DD6B98EA980999CE163072D9D4E4AC69299F7E4
SHA-256:	A4EE36A7E613E5F0272EF589C12FBFC52B5712C1DBC804E8BEED3F7C49992B09
SHA-512:	AEA47CA1B6A1CBAD1B7CE25D1A5DA8CEACD3A4B6F94513068052F0BC92C91113F72184C0D043689E55F6DABB9FA0654DD9AA779F9EC2115B8994227534C64AD0
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFD824F21E845D2FA0.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFFF84DA4F667A25C9.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Security: 0, Code page: 1252, Revision Number: {182C5263-9A4F-4811-9832-23486A29A112}, Number of Words: 10, Subject: Microsoft-Edge-Web-View2-Runtime, Author: Microsoft, Name of Creating Application: Microsoft-Edge-Web-View2-Runtime, Template: ;1046, Comments: A base dados do instalador contm a lgica e os dados necessrios para instalar o Microsoft-Edge-Web-View2-Runtime., Title: Installation Database, Keywords: Installer, MSI, Database, Create Time/Date: Tue Sep 17 18:28:10 2024, Last Saved Time/Date: Tue Sep 17 18:28:10 2024, Last Printed: Tue Sep 17 18:28:10 2024, Number of Pages: 450
Entropy (8bit):	7.988801588430793
TrID:	Windows SDK Setup Transform Script (63028/2) 47.91% Microsoft Windows Installer (60509/1) 46.00% Generic OLE2 / Multistream Compound File (8008/1) 6.09%
File name:	IRPF2024-0940959038w904598304w985036.msi
File size:	41'998'336 bytes
MD5:	55e1b6a518bc3e243d8d856ee17430aa
SHA1:	f83dc91c91f89d6a321892d54b4de229041b07d1
SHA256:	baf5979f4c227be5b3f1bf4f03e5902e8b7fcc2dad38068f363a0096cb12a536
SHA512:	cafaa29ead2294cfdd2b63912b6dcabd3853fa2d691065b3f398d689f06931df3ad72f9f4a2c7ebbb9e53b7b77b318489ff6b9785129fdbac576bc835bf5fcdc
SSDEEP:	786432:b4ztbf6AoshmMYKXPrhcY32uoS59BVT8KoYcIxuhs7lekMqT0:b4pbSTS7YK/WY3tJ5jhrVxuhsZek
TLSH:	F397332675C7C221D19C007BF964FE5E4176AE23433101E7B2F9B8BA94B5CC2A678B53
File Content Preview:	........................>.......................................................G.......c.......p..............................................................................................................................................................

File Icon


Icon Hash:	2d2e3797b32b2b99

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-09-18T12:32:28.265873+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49715	50.116.112.138	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 18, 2024 12:32:27.551683903 CEST	49715	80	192.168.2.6	50.116.112.138
Sep 18, 2024 12:32:27.556698084 CEST	80	49715	50.116.112.138	192.168.2.6
Sep 18, 2024 12:32:27.556780100 CEST	49715	80	192.168.2.6	50.116.112.138
Sep 18, 2024 12:32:27.556982040 CEST	49715	80	192.168.2.6	50.116.112.138
Sep 18, 2024 12:32:27.561822891 CEST	80	49715	50.116.112.138	192.168.2.6
Sep 18, 2024 12:32:28.265796900 CEST	80	49715	50.116.112.138	192.168.2.6
Sep 18, 2024 12:32:28.265872955 CEST	49715	80	192.168.2.6	50.116.112.138
Sep 18, 2024 12:32:33.266946077 CEST	80	49715	50.116.112.138	192.168.2.6
Sep 18, 2024 12:32:33.267091990 CEST	49715	80	192.168.2.6	50.116.112.138
Sep 18, 2024 12:34:17.156080008 CEST	49715	80	192.168.2.6	50.116.112.138
Sep 18, 2024 12:34:17.476052999 CEST	49715	80	192.168.2.6	50.116.112.138
Sep 18, 2024 12:34:18.163523912 CEST	49715	80	192.168.2.6	50.116.112.138
Sep 18, 2024 12:34:19.366631985 CEST	49715	80	192.168.2.6	50.116.112.138
Sep 18, 2024 12:34:21.772963047 CEST	49715	80	192.168.2.6	50.116.112.138
Sep 18, 2024 12:34:26.663595915 CEST	49715	80	192.168.2.6	50.116.112.138
Sep 18, 2024 12:34:36.366652966 CEST	49715	80	192.168.2.6	50.116.112.138

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 18, 2024 12:32:27.182374954 CEST	57622	53	192.168.2.6	1.1.1.1
Sep 18, 2024 12:32:27.502116919 CEST	53	57622	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Sep 18, 2024 12:32:27.182374954 CEST	192.168.2.6	1.1.1.1	0xc00a	Standard query (0)	www.rodovalhoadvogados.com.br	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Sep 18, 2024 12:32:27.502116919 CEST	1.1.1.1	192.168.2.6	0xc00a	No error (0)	www.rodovalhoadvogados.com.br	rodovalhoadvogados.com.br		CNAME (Canonical name)	IN (0x0001)	false
Sep 18, 2024 12:32:27.502116919 CEST	1.1.1.1	192.168.2.6	0xc00a	No error (0)	rodovalhoadvogados.com.br		50.116.112.138	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

www.rodovalhoadvogados.com.br

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49715	50.116.112.138	80	5976	C:\Users\user\Contacts\Flexpcis.exe

Timestamp	Bytes transferred	Direction	Data
Sep 18, 2024 12:32:27.556982040 CEST	102	OUT	GET /dddd/inspecionando.php HTTP/1.1 Host: www.rodovalhoadvogados.com.br Cache-Control: no-cache
Sep 18, 2024 12:32:28.265796900 CEST	169	IN	HTTP/1.1 200 OK Date: Wed, 18 Sep 2024 10:32:27 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade Content-Length: 0 Content-Type: text/html; charset=UTF-8

Target ID:	0
Start time:	06:32:02
Start date:	18/09/2024
Path:	C:\Windows\System32\msiexec.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\IRPF2024-0940959038w904598304w985036.msi"
Imagebase:	0x7ff698f90000
File size:	69'632 bytes
MD5 hash:	E5DA170027542E25EDE42FC54C929077
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	06:32:02
Start date:	18/09/2024
Path:	C:\Windows\System32\msiexec.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\msiexec.exe /V
Imagebase:	0x7ff698f90000
File size:	69'632 bytes
MD5 hash:	E5DA170027542E25EDE42FC54C929077
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	06:32:04
Start date:	18/09/2024
Path:	C:\Windows\SysWOW64\msiexec.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\syswow64\MsiExec.exe -Embedding 5B841E4EC1525DEC8E125CA4E79284A2
Imagebase:	0x880000
File size:	59'904 bytes
MD5 hash:	9D09DC1EDA745A5F87553048E57620CF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	06:32:07
Start date:	18/09/2024
Path:	C:\Users\user\Contacts\Flexpcis.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Contacts\Flexpcis.exe"
Imagebase:	0x110000
File size:	138'520 bytes
MD5 hash:	E04F15D35A1807C4D74D2538D5FE28C9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Antivirus matches:	Detection: 0%, ReversingLabs Detection: 0%, Virustotal, Browse
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	06:32:18
Start date:	18/09/2024
Path:	C:\Users\user\Contacts\Flexpcis.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Contacts\Flexpcis.exe"
Imagebase:	0x110000
File size:	138'520 bytes
MD5 hash:	E04F15D35A1807C4D74D2538D5FE28C9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	Borland Delphi
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	06:32:27
Start date:	18/09/2024
Path:	C:\Users\user\Contacts\Flexpcis.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Contacts\Flexpcis.exe"
Imagebase:	0x110000
File size:	138'520 bytes
MD5 hash:	E04F15D35A1807C4D74D2538D5FE28C9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	Borland Delphi
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	06:32:37
Start date:	18/09/2024
Path:	C:\Users\user\Contacts\Flexpcis.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Contacts\Flexpcis.exe"
Imagebase:	0x110000
File size:	138'520 bytes
MD5 hash:	E04F15D35A1807C4D74D2538D5FE28C9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	Borland Delphi
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	06:32:49
Start date:	18/09/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 1008 -s 628
Imagebase:	0x30000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	06:32:52
Start date:	18/09/2024
Path:	C:\Users\user\Contacts\Flexpcis.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Contacts\Flexpcis.exe"
Imagebase:	0x110000
File size:	138'520 bytes
MD5 hash:	E04F15D35A1807C4D74D2538D5FE28C9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	Borland Delphi
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	06:32:58
Start date:	18/09/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 1008 -s 628
Imagebase:	0x30000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	06:33:02
Start date:	18/09/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 672 -s 724
Imagebase:	0x30000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	06:33:09
Start date:	18/09/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 672 -s 628
Imagebase:	0x30000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	06:33:16
Start date:	18/09/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 5908 -s 624
Imagebase:	0x30000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	06:33:18
Start date:	18/09/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 5908 -s 1004
Imagebase:	0x30000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	06:35:58
Start date:	18/09/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 5648 -s 628
Imagebase:	0x30000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	06:36:00
Start date:	18/09/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 5648 -s 628
Imagebase:	0x30000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	3.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	5.9%
Total number of Nodes:	1987
Total number of Limit Nodes:	24

Executed Functions

Function 00111000 Relevance: 31.8, APIs: 13, Strings: 5, Instructions: 308
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SHGetFolderPathW.SHELL32(00000000,?,00000000,00000000,?), ref: 0011109B
PathFileExistsW.KERNELBASE(?,?), ref: 001111A3
PathFileExistsW.SHLWAPI(?), ref: 00111250
MoveFileExW.KERNEL32(?,?,00000001), ref: 00111282
PathFileExistsW.SHLWAPI(?), ref: 0011129D
LoadLibraryW.KERNEL32(?), ref: 001112CD
GetProcAddress.KERNEL32(00000000,ver), ref: 001112E5
FreeLibrary.KERNEL32(?), ref: 001112FF
FreeLibrary.KERNEL32(?), ref: 00111331
LoadLibraryW.KERNEL32(?), ref: 00111371
GetProcAddress.KERNEL32(00000000,ver), ref: 00111383
FreeLibrary.KERNEL32(?), ref: 00111395
FreeLibrary.KERNEL32(?), ref: 001113AF

Strings

drivespan.dll, xrefs: 00111044
#v, xrefs: 001112FF, 00111331, 00111395, 001113AF
ver, xrefs: 001112DF, 0011137D
new_drivespan.dll, xrefs: 00111202
\Nero\Transfer\Update\, xrefs: 00111102

Memory Dump Source

Source File: 00000006.00000002.2741089699.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000006.00000002.2741001883.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2741170201.000000000011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2741237485.0000000000126000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2741324925.0000000000128000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_110000_Flexpcis.jbxd

Similarity

API ID: Library$FileFreePath$Exists$AddressLoadProc$FolderMove
String ID: \Nero\Transfer\Update\$drivespan.dll$new_drivespan.dll$ver$#v
API String ID: 2307531666-1653122281
Opcode ID: f7b9afed8dd090d46f702cec596a34712920e5dfcbe67a1d4f33f564128a15bf
Instruction ID: 9765cf6fedd90a9302ed01ed8254494b3d11d4e5e3b96570038ed1d0955a92dd
Opcode Fuzzy Hash: f7b9afed8dd090d46f702cec596a34712920e5dfcbe67a1d4f33f564128a15bf
Instruction Fuzzy Hash: E4D12374955228AADF68DB24CC98BEDB7B9FB18700F1041E9E519A2250DB34AFC5CF60

Function 001117A0 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 98
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitCommonControlsEx.COMCTL32 ref: 001117CE
LoadLibraryW.KERNELBASE(?,?,?,?,-Restart,?,?), ref: 0011185F
LoadLibraryW.KERNEL32(drivespan.dll,drivespan.dll,?,?,?,-Restart,?,?), ref: 00111882
GetProcAddress.KERNEL32(00000000,run), ref: 00111894
FreeLibrary.KERNEL32(00000000,?,?,?,-Restart,?,?), ref: 001118A9

Strings

drivespan.dll, xrefs: 0011186B, 0011187D
#v, xrefs: 001118A9
-Restart, xrefs: 0011181A
run, xrefs: 0011188E

Memory Dump Source

Source File: 00000006.00000002.2741089699.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000006.00000002.2741001883.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2741170201.000000000011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2741237485.0000000000126000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2741324925.0000000000128000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_110000_Flexpcis.jbxd

Similarity

API ID: Library$Load$AddressCommonControlsFreeInitProc
String ID: -Restart$drivespan.dll$run$#v
API String ID: 1924428465-3485967269
Opcode ID: 67d8b612f18054a584e856e3bc4b4cd690acad7bab4e78544687eada85d29140
Instruction ID: 0533dfdc9ec023d8f40f61836a4835031dc1d88d1c7b3fc053f2cbd2389f5d5c
Opcode Fuzzy Hash: 67d8b612f18054a584e856e3bc4b4cd690acad7bab4e78544687eada85d29140
Instruction Fuzzy Hash: 0F31AD31514311AFC318AB20D845AAFB7E5FF99341F00893CF99692190EB34DA95CBA2

Function 00118654 Relevance: 1.6, APIs: 1, Instructions: 52
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00116BDB: RtlAllocateHeap.NTDLL(00000008,?,00000000), ref: 00116C1C

_free.LIBCMT ref: 001186C0

Memory Dump Source

Source File: 00000006.00000002.2741089699.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000006.00000002.2741001883.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2741170201.000000000011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2741237485.0000000000126000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2741324925.0000000000128000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_110000_Flexpcis.jbxd

Similarity

API ID: AllocateHeap_free
String ID:
API String ID: 614378929-0
Opcode ID: d3ebc13b0ebbb74cb065b0f551faa43160cc8f1f2a8b1336f13c8a4004e98a34
Instruction ID: e60028d6c0018f5b68881d21e66ebf59c78d985f30763a5118ea2b8ed9606635
Opcode Fuzzy Hash: d3ebc13b0ebbb74cb065b0f551faa43160cc8f1f2a8b1336f13c8a4004e98a34
Instruction Fuzzy Hash: 31012672204305ABE3298F659881D9AFBD9EB95370F25052DE58483280EF31A845C664

Function 00116BDB Relevance: 1.5, APIs: 1, Instructions: 39
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000), ref: 00116C1C

Memory Dump Source

Source File: 00000006.00000002.2741089699.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000006.00000002.2741001883.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2741170201.000000000011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2741237485.0000000000126000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2741324925.0000000000128000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_110000_Flexpcis.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 154a1d4e4747019ca817ee4bd1e9f9699052a1482f13142cf5c34be3ed4824c8
Instruction ID: e27ecdb8cdb1a2291cad67ebd894d78f1ae25963a2a900427301921abd0c2442
Opcode Fuzzy Hash: 154a1d4e4747019ca817ee4bd1e9f9699052a1482f13142cf5c34be3ed4824c8
Instruction Fuzzy Hash: FAF0E931209625EADB3D5B229C01BDB7B98EF51770B158035BC58D7191CF32D8C186E1

Non-executed Functions

Function 00111510 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 172
sleepprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000100,E53082D2), ref: 0011154C
GetCurrentProcessId.KERNEL32(?,00000001,-00000001,?), ref: 00111650
CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 0011168E
Process32FirstW.KERNEL32(00000000,0000022C), ref: 0011169E
Process32NextW.KERNEL32(00000000,0000022C), ref: 001116B5
Process32NextW.KERNEL32(00000000,0000022C), ref: 0011171F
Sleep.KERNEL32(00000064), ref: 00111734
CloseHandle.KERNEL32(00000000), ref: 0011173B
Sleep.KERNEL32(000000C8), ref: 00111759

Strings

\, xrefs: 001115B7
A#v, xrefs: 0011168E

Memory Dump Source

Source File: 00000006.00000002.2741089699.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000006.00000002.2741001883.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2741170201.000000000011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2741237485.0000000000126000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2741324925.0000000000128000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_110000_Flexpcis.jbxd

Similarity

API ID: Process32$NextSleep$CloseCreateCurrentFileFirstHandleModuleNameProcessSnapshotToolhelp32
String ID: A#v$\
API String ID: 8921262-2721266983
Opcode ID: 80847f95094aef6a907908f3a767f44509602fdab57f1d694a2360f4f18da494
Instruction ID: 3a16712415ccb573e3e7ffa21968a25df06fc830474a8fb1b8e4ac9102a06c88
Opcode Fuzzy Hash: 80847f95094aef6a907908f3a767f44509602fdab57f1d694a2360f4f18da494
Instruction Fuzzy Hash: 6B61A075900119AADB28EB60CD89BE9B7B9FF19304F0041E9E60AE2291E7355FC5CF64

Function 001155D7 Relevance: 4.6, APIs: 3, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,0011330B), ref: 001156CF
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,0011330B), ref: 001156D9
UnhandledExceptionFilter.KERNEL32(00000016,?,?,?,?,?,0011330B), ref: 001156E6

Memory Dump Source

Source File: 00000006.00000002.2741089699.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000006.00000002.2741001883.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2741170201.000000000011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2741237485.0000000000126000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2741324925.0000000000128000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_110000_Flexpcis.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: f861820707063993c3494ce4dc153da29c56cfc366f4176024e06e75548971fd
Instruction ID: 102fa33d7d40bbc53922b7794fa811dea68d59282d1dc5829143ce59546a564c
Opcode Fuzzy Hash: f861820707063993c3494ce4dc153da29c56cfc366f4176024e06e75548971fd
Instruction Fuzzy Hash: 8D31B174901228ABCB25DF64D9897CDBBB9AF58710F5041EAE80CA7291EB309BC58F45

Function 00116268 Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000003,?,0011623E,00000003,00124638,0000000C,00116395,00000003,00000002,00000000,?,00116BDA,00000003), ref: 00116289
TerminateProcess.KERNEL32(00000000,?,0011623E,00000003,00124638,0000000C,00116395,00000003,00000002,00000000,?,00116BDA,00000003), ref: 00116290
ExitProcess.KERNEL32 ref: 001162A2

Memory Dump Source

Source File: 00000006.00000002.2741089699.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000006.00000002.2741001883.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2741170201.000000000011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2741237485.0000000000126000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2741324925.0000000000128000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_110000_Flexpcis.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: f678fffb91e246f1b5a99ef1c6cbd39b4cd5f79781936fd24f58c379de64c54f
Instruction ID: 553375e9fcfee6ccc0f7a4ffeb0f9941f4a7dfd74a3643d519fced9c722a6fce
Opcode Fuzzy Hash: f678fffb91e246f1b5a99ef1c6cbd39b4cd5f79781936fd24f58c379de64c54f
Instruction Fuzzy Hash: D7E0BF31400558ABDF196F54DE09AD93BAAEB58391F008438F90586532DB36EDC2CA50

Function 001175CA Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 127COMMON

Download Yara Rule

Strings

/, xrefs: 00117694

Memory Dump Source

Source File: 00000006.00000002.2741089699.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000006.00000002.2741001883.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2741170201.000000000011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2741237485.0000000000126000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2741324925.0000000000128000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_110000_Flexpcis.jbxd

Similarity

API ID:
String ID: /
API String ID: 0-2043925204
Opcode ID: 3d3a3739f7b8c0bb4d399be11562dfdf1fb421bb1d1b150646e7d5d8126463f8
Instruction ID: 3bf3d98f51a8682f693ff7295a0c0b09db19d56ffa77f2b4ea44d015bd5d3cc0
Opcode Fuzzy Hash: 3d3a3739f7b8c0bb4d399be11562dfdf1fb421bb1d1b150646e7d5d8126463f8
Instruction Fuzzy Hash: 26410376904619ABDB289F79CC89EEB77B9EB84710F104278F905972C0E7309EC1CB64

Function 0011CD15 Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,0011CD10,?,?,00000008,?,?,0011C9B0,00000000), ref: 0011CF42

Memory Dump Source

Source File: 00000006.00000002.2741089699.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000006.00000002.2741001883.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2741170201.000000000011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2741237485.0000000000126000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2741324925.0000000000128000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_110000_Flexpcis.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 58c64a8cb825e8c4678ccbb8d437b2e053bfc4ddc7ee4b44b729bc787cae77e0
Instruction ID: a874a21068b77befd05931455f74e53e18a7e620de2a77daca06da090dfd387b
Opcode Fuzzy Hash: 58c64a8cb825e8c4678ccbb8d437b2e053bfc4ddc7ee4b44b729bc787cae77e0
Instruction Fuzzy Hash: 75B12E31650609DFD719CF28C486BA57FE1FF45364F258668E89ACF2A1C335E992CB80

Function 00112F17 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_00002F23,001126A2), ref: 00112F1C

Memory Dump Source

Source File: 00000006.00000002.2741089699.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000006.00000002.2741001883.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2741170201.000000000011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2741237485.0000000000126000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2741324925.0000000000128000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_110000_Flexpcis.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: d23073e1e6c101878ec1fd4645430fc34405e1c0f1f6323072fd3f6b958aa81a
Instruction ID: c557d3ef8a811bdb1c48e23c196f00985b7a9b661a8c8c1983d811096437586f
Opcode Fuzzy Hash: d23073e1e6c101878ec1fd4645430fc34405e1c0f1f6323072fd3f6b958aa81a
Instruction Fuzzy Hash:

Function 00119302 Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00119302

Memory Dump Source

Source File: 00000006.00000002.2741089699.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000006.00000002.2741001883.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2741170201.000000000011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2741237485.0000000000126000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2741324925.0000000000128000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_110000_Flexpcis.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 9509fadf51058f0344a4b876c44cd6288407936b5c4af2793983f2d6cb037f48
Instruction ID: cc241a306acef957578da4c6a70d0672341315d935a9f1884508a888bc9cd162
Opcode Fuzzy Hash: 9509fadf51058f0344a4b876c44cd6288407936b5c4af2793983f2d6cb037f48
Instruction Fuzzy Hash: DFA01230204240DB4300CF30AA452493794670459030840285800C0460D62040D16600

Function 00118F76 Relevance: 19.6, APIs: 13, Instructions: 114
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___free_lconv_mon.LIBCMT ref: 00118FBA

Part of subcall function 00118AF0: _free.LIBCMT ref: 00118B0D
Part of subcall function 00118AF0: _free.LIBCMT ref: 00118B1F
Part of subcall function 00118AF0: _free.LIBCMT ref: 00118B31
Part of subcall function 00118AF0: _free.LIBCMT ref: 00118B43
Part of subcall function 00118AF0: _free.LIBCMT ref: 00118B55
Part of subcall function 00118AF0: _free.LIBCMT ref: 00118B67
Part of subcall function 00118AF0: _free.LIBCMT ref: 00118B79
Part of subcall function 00118AF0: _free.LIBCMT ref: 00118B8B
Part of subcall function 00118AF0: _free.LIBCMT ref: 00118B9D
Part of subcall function 00118AF0: _free.LIBCMT ref: 00118BAF
Part of subcall function 00118AF0: _free.LIBCMT ref: 00118BC1
Part of subcall function 00118AF0: _free.LIBCMT ref: 00118BD3
Part of subcall function 00118AF0: _free.LIBCMT ref: 00118BE5

_free.LIBCMT ref: 00118FAF

Part of subcall function 00116B10: HeapFree.KERNEL32(00000000,00000000,?,00118C85,?,00000000,?,00000000,?,00118CAC,?,00000007,?,?,0011910E,?), ref: 00116B26
Part of subcall function 00116B10: GetLastError.KERNEL32(?,?,00118C85,?,00000000,?,00000000,?,00118CAC,?,00000007,?,?,0011910E,?,?), ref: 00116B38

_free.LIBCMT ref: 00118FD1
_free.LIBCMT ref: 00118FE6
_free.LIBCMT ref: 00118FF1
_free.LIBCMT ref: 00119013
_free.LIBCMT ref: 00119026
_free.LIBCMT ref: 00119034
_free.LIBCMT ref: 0011903F
_free.LIBCMT ref: 00119077
_free.LIBCMT ref: 0011907E
_free.LIBCMT ref: 0011909B
_free.LIBCMT ref: 001190B3

Memory Dump Source

Source File: 00000006.00000002.2741089699.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000006.00000002.2741001883.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2741170201.000000000011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2741237485.0000000000126000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2741324925.0000000000128000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_110000_Flexpcis.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: 88c7c4a2b19c57ac6e581e848b56327d2735d340900cb0f91c7b3a8424c85b85
Instruction ID: 0d91526d68b9a4256a01df274cc2051254a382a12367f0fa1830fef770fa3309
Opcode Fuzzy Hash: 88c7c4a2b19c57ac6e581e848b56327d2735d340900cb0f91c7b3a8424c85b85
Instruction Fuzzy Hash: BA313732704601AFEB28AA38E855BDA73E9AF14350F108839F468D7191DF36EDD0CB58

Function 00116F39 Relevance: 15.1, APIs: 10, Instructions: 54
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_free.LIBCMT ref: 00116F4D

Part of subcall function 00116B10: HeapFree.KERNEL32(00000000,00000000,?,00118C85,?,00000000,?,00000000,?,00118CAC,?,00000007,?,?,0011910E,?), ref: 00116B26
Part of subcall function 00116B10: GetLastError.KERNEL32(?,?,00118C85,?,00000000,?,00000000,?,00118CAC,?,00000007,?,?,0011910E,?,?), ref: 00116B38

_free.LIBCMT ref: 00116F59
_free.LIBCMT ref: 00116F64
_free.LIBCMT ref: 00116F6F
_free.LIBCMT ref: 00116F7A
_free.LIBCMT ref: 00116F85
_free.LIBCMT ref: 00116F90
_free.LIBCMT ref: 00116F9B
_free.LIBCMT ref: 00116FA6
_free.LIBCMT ref: 00116FB4

Memory Dump Source

Source File: 00000006.00000002.2741089699.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000006.00000002.2741001883.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2741170201.000000000011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2741237485.0000000000126000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2741324925.0000000000128000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_110000_Flexpcis.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 18d1231d0a75fa3595bc7754ead4933e02609548afb81c581e7f7f5625aeed87
Instruction ID: bd1fe43655bacc098caede1ca4f22893632622c48c9363cda4af03da68d76ef3
Opcode Fuzzy Hash: 18d1231d0a75fa3595bc7754ead4933e02609548afb81c581e7f7f5625aeed87
Instruction Fuzzy Hash: A0117476714108FFCB09EF94E952DDA3BA5EF14390B5145B5BA088F222DB32DE90DB84

Function 0011A33F Relevance: 12.2, APIs: 8, Instructions: 216
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MultiByteToWideChar.KERNEL32(?,00000000,?,?,00000000,00000000,00000100,?,00000000,?,?,?,0011A590,?,?,00000000), ref: 0011A399
__alloca_probe_16.LIBCMT ref: 0011A3D1
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?,?,?,?,0011A590,?,?,00000000,?,?,?), ref: 0011A41F
__alloca_probe_16.LIBCMT ref: 0011A4B6
WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,00000000,?,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 0011A519
__freea.LIBCMT ref: 0011A526

Part of subcall function 00116B4A: RtlAllocateHeap.NTDLL(00000000,0011330B,?), ref: 00116B7C

__freea.LIBCMT ref: 0011A52F
__freea.LIBCMT ref: 0011A554

Memory Dump Source

Source File: 00000006.00000002.2741089699.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000006.00000002.2741001883.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2741170201.000000000011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2741237485.0000000000126000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2741324925.0000000000128000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_110000_Flexpcis.jbxd

Similarity

API ID: ByteCharMultiWide__freea$__alloca_probe_16$AllocateHeap
String ID:
API String ID: 3864826663-0
Opcode ID: 5509558f9e19071e36100fd55e7b851d1db0bacdd017f9e6304b136e12f490be
Instruction ID: 72458b7b6d5bce7240f0a191849914b866d1aa23bdbe80ef66a88f685f8c5c1c
Opcode Fuzzy Hash: 5509558f9e19071e36100fd55e7b851d1db0bacdd017f9e6304b136e12f490be
Instruction Fuzzy Hash: 3351DC72612216AFDB2D8E64DC41EFB7BAAEF44710B594239FD05D6141EB34DCC0C6A2

Function 0011AC93 Relevance: 10.7, APIs: 7, Instructions: 152
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetConsoleCP.KERNEL32(?,00000000,?,?,?,?,?,?,?,0011B408,?,00000000,?,00000000,00000000), ref: 0011ACD5
__fassign.LIBCMT ref: 0011AD50
__fassign.LIBCMT ref: 0011AD6B
WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000001,?,00000005,00000000,00000000), ref: 0011AD91
WriteFile.KERNEL32(?,?,00000000,0011B408,00000000,?,?,?,?,?,?,?,?,?,0011B408,?), ref: 0011ADB0
WriteFile.KERNEL32(?,?,00000001,0011B408,00000000,?,?,?,?,?,?,?,?,?,0011B408,?), ref: 0011ADE9

Memory Dump Source

Source File: 00000006.00000002.2741089699.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000006.00000002.2741001883.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2741170201.000000000011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2741237485.0000000000126000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2741324925.0000000000128000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_110000_Flexpcis.jbxd

Similarity

API ID: FileWrite__fassign$ByteCharConsoleMultiWide
String ID:
API String ID: 1324828854-0
Opcode ID: 2a9386363752069c64f88583acc3c9605b4c1f7f3582e24771bf13d3ced8df47
Instruction ID: 0765a69513da1f6a72cda2644989b53275a87e52a7446665f43197a87a88efd5
Opcode Fuzzy Hash: 2a9386363752069c64f88583acc3c9605b4c1f7f3582e24771bf13d3ced8df47
Instruction Fuzzy Hash: E851E671D01249AFCF18CFA8DC95AEEBBF9EF09300F14412AE955E7291D7309991CBA1

Function 00118C93 Relevance: 10.6, APIs: 7, Instructions: 65
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00118C57: _free.LIBCMT ref: 00118C80

_free.LIBCMT ref: 00118CE1

Part of subcall function 00116B10: HeapFree.KERNEL32(00000000,00000000,?,00118C85,?,00000000,?,00000000,?,00118CAC,?,00000007,?,?,0011910E,?), ref: 00116B26
Part of subcall function 00116B10: GetLastError.KERNEL32(?,?,00118C85,?,00000000,?,00000000,?,00118CAC,?,00000007,?,?,0011910E,?,?), ref: 00116B38

_free.LIBCMT ref: 00118CEC
_free.LIBCMT ref: 00118CF7
_free.LIBCMT ref: 00118D4B
_free.LIBCMT ref: 00118D56
_free.LIBCMT ref: 00118D61
_free.LIBCMT ref: 00118D6C

Memory Dump Source

Source File: 00000006.00000002.2741089699.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000006.00000002.2741001883.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2741170201.000000000011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2741237485.0000000000126000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2741324925.0000000000128000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_110000_Flexpcis.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 0bb379ea52c51a684ff9bb70345eabbbe80e5a958499be13c44c1439a6277fea
Instruction ID: 0c09cb6c0bbb88432901245aaeee1c96516957d2ef035c03748bcc89f370bde6
Opcode Fuzzy Hash: 0bb379ea52c51a684ff9bb70345eabbbe80e5a958499be13c44c1439a6277fea
Instruction Fuzzy Hash: E211F971745B04FADA24BBB0DC46FCB779CAF14700F408C39B299A6092DF76B5D486A4

Function 00114AE0 Relevance: 10.6, APIs: 7, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00114AD7,00113E74,001244D8,00000010,0011363C,?,?,?,?,?,00000000,?), ref: 00114AEE
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00114AFC
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00114B15
SetLastError.KERNEL32(00000000,00114AD7,00113E74,001244D8,00000010,0011363C,?,?,?,?,?,00000000,?), ref: 00114B67

Memory Dump Source

Source File: 00000006.00000002.2741089699.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000006.00000002.2741001883.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2741170201.000000000011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2741237485.0000000000126000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2741324925.0000000000128000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_110000_Flexpcis.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: a60242514fa03a707726bbe683912458ccedcb467d2a4997a3402eaa826274d5
Instruction ID: 6888831e2ce06b4fa346b55e457881eac59ee1bc2044e2c987231b8b239d395b
Opcode Fuzzy Hash: a60242514fa03a707726bbe683912458ccedcb467d2a4997a3402eaa826274d5
Instruction Fuzzy Hash: A201D83260C711AFA73C17747C85FD66A99EF65BB57200339F125864E1EF518CD2614C

Function 001162ED Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 38libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,0011629E,00000003,?,0011623E,00000003,00124638,0000000C,00116395,00000003,00000002), ref: 0011630D
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00116320
FreeLibrary.KERNEL32(00000000,?,?,?,0011629E,00000003,?,0011623E,00000003,00124638,0000000C,00116395,00000003,00000002,00000000), ref: 00116343

Strings

#v, xrefs: 00116343
CorExitProcess, xrefs: 00116318
mscoree.dll, xrefs: 00116306

Memory Dump Source

Source File: 00000006.00000002.2741089699.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000006.00000002.2741001883.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2741170201.000000000011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2741237485.0000000000126000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2741324925.0000000000128000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_110000_Flexpcis.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll$#v
API String ID: 4061214504-833151533
Opcode ID: bfb69301cbac7ec6b7851348c042d8ad270ac411e2fa23bd28ed7a6ea260f708
Instruction ID: 2cabb5ed3b0416187cbc94a8b7cfc0955cf00a73dde772bda3bcf57b18888451
Opcode Fuzzy Hash: bfb69301cbac7ec6b7851348c042d8ad270ac411e2fa23bd28ed7a6ea260f708
Instruction Fuzzy Hash: B3F04F74A14208FBCB199F90DD09BDDBFB5EF48711F00417CF809A22A0DB3189C2DA94

Function 0011702E Relevance: 9.0, APIs: 6, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00116A8B,001246C0,0000000C,00112F63), ref: 00117032
_free.LIBCMT ref: 00117065
_free.LIBCMT ref: 0011708D
SetLastError.KERNEL32(00000000), ref: 0011709A
SetLastError.KERNEL32(00000000), ref: 001170A6
_abort.LIBCMT ref: 001170AC

Memory Dump Source

Source File: 00000006.00000002.2741089699.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000006.00000002.2741001883.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2741170201.000000000011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2741237485.0000000000126000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2741324925.0000000000128000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_110000_Flexpcis.jbxd

Similarity

API ID: ErrorLast$_free$_abort
String ID:
API String ID: 3160817290-0
Opcode ID: 67082e56c64b79f76860566fd4761d96617d1e6ac2cf130a3a2d6a7da7ae115d
Instruction ID: 2fd72f45da0311f4a7c8ed950488dde452ed1cbd6c451496fa5711a12f5854d2
Opcode Fuzzy Hash: 67082e56c64b79f76860566fd4761d96617d1e6ac2cf130a3a2d6a7da7ae115d
Instruction Fuzzy Hash: 6FF0A435608B0066C63E73346C1ABDF262AABDA761F354234F518D23D2FF2688C25124

Function 00118255 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 52libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,00000000,00000000,?,001181FC,?,00000000,00000000,00000000,?,001183F9,00000006,FlsSetValue), ref: 00118287
GetLastError.KERNEL32(?,001181FC,?,00000000,00000000,00000000,?,001183F9,00000006,FlsSetValue,00120278,00120280,00000000,00000364,?,00117100), ref: 00118293
LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,001181FC,?,00000000,00000000,00000000,?,001183F9,00000006,FlsSetValue,00120278,00120280,00000000), ref: 001182A1

Strings

#v, xrefs: 001182C3

Memory Dump Source

Source File: 00000006.00000002.2741089699.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000006.00000002.2741001883.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2741170201.000000000011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2741237485.0000000000126000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2741324925.0000000000128000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_110000_Flexpcis.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: #v
API String ID: 3177248105-554117064
Opcode ID: c31a4c57aab56dd7a00f69395b4b50da1c405d44ded9fd914a65c6cda4ac6583
Instruction ID: abaf544180b47078bc959b59eeb7cad645c583e3bf82d073107b1b02003d862c
Opcode Fuzzy Hash: c31a4c57aab56dd7a00f69395b4b50da1c405d44ded9fd914a65c6cda4ac6583
Instruction Fuzzy Hash: CF01F732212A22ABC72E8BA8EC44AE67799AF09761721C634F906D3540DB30D881C6E0

Function 00116731 Relevance: 7.6, APIs: 5, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 001167A3
_free.LIBCMT ref: 001167C3

Memory Dump Source

Source File: 00000006.00000002.2741089699.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000006.00000002.2741001883.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2741170201.000000000011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2741237485.0000000000126000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2741324925.0000000000128000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_110000_Flexpcis.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 40ca2a85b3ebedd0778df24ac286bbddad25dd9cda8d62b8234fe6d4ddce6632
Instruction ID: b77412764d26be57a46ea49a9878c3df1c92db99bdae5dd9a5726ce331e34838
Opcode Fuzzy Hash: 40ca2a85b3ebedd0778df24ac286bbddad25dd9cda8d62b8234fe6d4ddce6632
Instruction Fuzzy Hash: 0541A572A00210AFCB28DF78D881A9DB7F5EF99714F154579E515EB381DB32AD41CB80

Function 00118DBC Relevance: 7.6, APIs: 5, Instructions: 110COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,?,00000000,00000000,00000100,?,00000000,?,?,00000000), ref: 00118E09
__alloca_probe_16.LIBCMT ref: 00118E41
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00118E92
GetStringTypeW.KERNEL32(?,00000000,00000000,?), ref: 00118EA4
__freea.LIBCMT ref: 00118EAD

Part of subcall function 00116B4A: RtlAllocateHeap.NTDLL(00000000,0011330B,?), ref: 00116B7C

Memory Dump Source

Source File: 00000006.00000002.2741089699.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000006.00000002.2741001883.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2741170201.000000000011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2741237485.0000000000126000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2741324925.0000000000128000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_110000_Flexpcis.jbxd

Similarity

API ID: ByteCharMultiWide$AllocateHeapStringType__alloca_probe_16__freea
String ID:
API String ID: 313313983-0
Opcode ID: fb6176c3b33e2a63ac155d2fd5ac3ae0072a9679e241e9cd124b14250638f6d9
Instruction ID: de9955d04308f9450986eb24aa3297e6d4115693889718e3311ef6bf25877a83
Opcode Fuzzy Hash: fb6176c3b33e2a63ac155d2fd5ac3ae0072a9679e241e9cd124b14250638f6d9
Instruction Fuzzy Hash: 9031AD72A0121AABDF289F64DC85EEF7BA5EB50710B058138FC04D6191EB35DDA1CBA0

Function 001170B2 Relevance: 7.6, APIs: 5, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(0011330B,0011330B,?,001173D7,00116B8D,?,?,001147F0,?,?,00000000,?,?,0011322E,0011330B,?), ref: 001170B7
_free.LIBCMT ref: 001170EC
_free.LIBCMT ref: 00117113
SetLastError.KERNEL32(00000000,?,0011330B), ref: 00117120
SetLastError.KERNEL32(00000000,?,0011330B), ref: 00117129

Memory Dump Source

Source File: 00000006.00000002.2741089699.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000006.00000002.2741001883.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2741170201.000000000011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2741237485.0000000000126000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2741324925.0000000000128000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_110000_Flexpcis.jbxd

Similarity

API ID: ErrorLast$_free
String ID:
API String ID: 3170660625-0
Opcode ID: c01e23d537b6f0242e7a02d754408976c046577b05111037590b12c59b9945b1
Instruction ID: 495dff93e8507f0923cdf9ec2cfb86d4427a775af33f73c429fa0756ec195657
Opcode Fuzzy Hash: c01e23d537b6f0242e7a02d754408976c046577b05111037590b12c59b9945b1
Instruction Fuzzy Hash: 8001F43634CB00B7822E63346C859EF267EEBE9771B214138F915D23D2EF25C8C25024

Function 00118BEE Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00118C06

Part of subcall function 00116B10: HeapFree.KERNEL32(00000000,00000000,?,00118C85,?,00000000,?,00000000,?,00118CAC,?,00000007,?,?,0011910E,?), ref: 00116B26
Part of subcall function 00116B10: GetLastError.KERNEL32(?,?,00118C85,?,00000000,?,00000000,?,00118CAC,?,00000007,?,?,0011910E,?,?), ref: 00116B38

_free.LIBCMT ref: 00118C18
_free.LIBCMT ref: 00118C2A
_free.LIBCMT ref: 00118C3C
_free.LIBCMT ref: 00118C4E

Memory Dump Source

Source File: 00000006.00000002.2741089699.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000006.00000002.2741001883.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2741170201.000000000011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2741237485.0000000000126000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2741324925.0000000000128000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_110000_Flexpcis.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 69c1728f4ee483c74fc09754009e2f8711690577953299d1256d5977819af9dc
Instruction ID: d482350effabe1d50d46deca91f9daedbcaf6299af1320bc87f4de5a0a129cc9
Opcode Fuzzy Hash: 69c1728f4ee483c74fc09754009e2f8711690577953299d1256d5977819af9dc
Instruction Fuzzy Hash: 9AF0EC72709200BB862CEB68F586DD673EEAB00710B544C29F004D7941CF25FCD18AB8

Function 00116980 Relevance: 7.5, APIs: 5, Instructions: 30COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0011699E

Part of subcall function 00116B10: HeapFree.KERNEL32(00000000,00000000,?,00118C85,?,00000000,?,00000000,?,00118CAC,?,00000007,?,?,0011910E,?), ref: 00116B26
Part of subcall function 00116B10: GetLastError.KERNEL32(?,?,00118C85,?,00000000,?,00000000,?,00118CAC,?,00000007,?,?,0011910E,?,?), ref: 00116B38

_free.LIBCMT ref: 001169B0
_free.LIBCMT ref: 001169C3
_free.LIBCMT ref: 001169D4
_free.LIBCMT ref: 001169E5

Memory Dump Source

Source File: 00000006.00000002.2741089699.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000006.00000002.2741001883.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2741170201.000000000011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2741237485.0000000000126000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2741324925.0000000000128000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_110000_Flexpcis.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 0b5c5cd3c646f88132bfb900958f437b60ca65ada373151f517f9a3accee3116
Instruction ID: 7d941a6fa0dca8cb0ef8330539bae3852ebeae5dd46d2d9d52b83429ac0d556f
Opcode Fuzzy Hash: 0b5c5cd3c646f88132bfb900958f437b60ca65ada373151f517f9a3accee3116
Instruction Fuzzy Hash: B4F03070B09160FF8A2AAF24BC1184A37A4BB157543000516F814D26F5CB3758F7DF9D

Function 00115AFF Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\Contacts\Flexpcis.exe,00000104), ref: 00115B3A
_free.LIBCMT ref: 00115C05
_free.LIBCMT ref: 00115C0F

Strings

C:\Users\user\Contacts\Flexpcis.exe, xrefs: 00115B31, 00115B38, 00115B67, 00115B9F

Memory Dump Source

Source File: 00000006.00000002.2741089699.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000006.00000002.2741001883.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2741170201.000000000011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2741237485.0000000000126000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2741324925.0000000000128000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_110000_Flexpcis.jbxd

Similarity

API ID: _free$FileModuleName
String ID: C:\Users\user\Contacts\Flexpcis.exe
API String ID: 2506810119-3052542024
Opcode ID: 9b813e8d03f5469f6f74242b4601ac67e2b41c59265366e2243681064c2ff9e4
Instruction ID: f4a852f004bc91aee4abb13c33a04bc584d4930bb1d7c0fe63d2c8876e570b8c
Opcode Fuzzy Hash: 9b813e8d03f5469f6f74242b4601ac67e2b41c59265366e2243681064c2ff9e4
Instruction Fuzzy Hash: AB319F71A08658EFCB29DF99D8859DEBBBEEBC5310B1040B6F80497251D7708EC5CB94

Function 00111E40 Relevance: 6.1, APIs: 4, Instructions: 116COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00111EC4

Part of subcall function 001132DD: __CxxThrowException@8.LIBVCRUNTIME ref: 001132F4

Concurrency::cancel_current_task.LIBCPMT ref: 00111ED9
new.LIBCMT ref: 00111EDF
new.LIBCMT ref: 00111EF3

Memory Dump Source

Source File: 00000006.00000002.2741089699.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000006.00000002.2741001883.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2741170201.000000000011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2741237485.0000000000126000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2741324925.0000000000128000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_110000_Flexpcis.jbxd

Similarity

API ID: Concurrency::cancel_current_task$Exception@8Throw
String ID:
API String ID: 3339364867-0
Opcode ID: 017d9c8b81e5d4f69db123a6eac26bb976ead4edc04de306e4252b5d586b20f3
Instruction ID: da08ed44608f02d5380a72fe394dc176cc4ee8ace8558d12664f8ce4deb6c9cf
Opcode Fuzzy Hash: 017d9c8b81e5d4f69db123a6eac26bb976ead4edc04de306e4252b5d586b20f3
Instruction Fuzzy Hash: 9441C371A10601ABCB2CDF64D8816EAF7F9EB44350B100A3DE962C7690E730E989C761

Function 001135F7 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBVCRUNTIME ref: 0011360E

Part of subcall function 00113C46: ___AdjustPointer.LIBCMT ref: 00113C90

_UnwindNestedFrames.LIBCMT ref: 00113625
___FrameUnwindToState.LIBVCRUNTIME ref: 00113637
CallCatchBlock.LIBVCRUNTIME ref: 0011365B

Memory Dump Source

Source File: 00000006.00000002.2741089699.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000006.00000002.2741001883.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2741170201.000000000011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2741237485.0000000000126000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2741324925.0000000000128000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_110000_Flexpcis.jbxd

Similarity

API ID: CatchUnwind$AdjustBlockBuildCallFrameFramesNestedObjectPointerState
String ID:
API String ID: 2633735394-0
Opcode ID: c818ee3c194d0a60d1f22e1fc4dc6d3ef6eda792af7de8886e093e75c8865d1b
Instruction ID: 6218213cb11a698cedd69e90da8ceb6c74b6451d6afc31817db58a0c905f2cf2
Opcode Fuzzy Hash: c818ee3c194d0a60d1f22e1fc4dc6d3ef6eda792af7de8886e093e75c8865d1b
Instruction Fuzzy Hash: 49012932000109BBCF165F95DC01EDA7FBAFF58754F054024F92865125D732EAA1EBA4

Function 00112090 Relevance: 6.0, APIs: 4, Instructions: 40COMMON

Download Yara Rule

APIs

new.LIBCMT ref: 001120BA

Memory Dump Source

Source File: 00000006.00000002.2741089699.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000006.00000002.2741001883.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2741170201.000000000011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2741237485.0000000000126000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2741324925.0000000000128000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_110000_Flexpcis.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b4d3f94c81d3943c378cad470bf1a73962749ad578d4a4a79ac19c895b724af
Instruction ID: ee026d5b69adce893ebc3347d31b0ac2009570b8bef61697409560a67147f6e2
Opcode Fuzzy Hash: 4b4d3f94c81d3943c378cad470bf1a73962749ad578d4a4a79ac19c895b724af
Instruction Fuzzy Hash: 7BF0A0B27042040AD71CF774AC669EE72998B383607104739F12AC6281FB32E9F4C559

Function 001148B6 Relevance: 6.0, APIs: 4, Instructions: 14COMMON

Download Yara Rule

APIs

___vcrt_initialize_pure_virtual_call_handler.LIBVCRUNTIME ref: 001148B6
___vcrt_initialize_winapi_thunks.LIBVCRUNTIME ref: 001148BB
___vcrt_initialize_locks.LIBVCRUNTIME ref: 001148C0

Part of subcall function 0011514E: ___vcrt_InitializeCriticalSectionEx.LIBVCRUNTIME ref: 0011515F

___vcrt_uninitialize_locks.LIBVCRUNTIME ref: 001148D5

Memory Dump Source

Source File: 00000006.00000002.2741089699.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000006.00000002.2741001883.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2741170201.000000000011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2741237485.0000000000126000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2741324925.0000000000128000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_110000_Flexpcis.jbxd

Similarity

API ID: CriticalInitializeSection___vcrt____vcrt_initialize_locks___vcrt_initialize_pure_virtual_call_handler___vcrt_initialize_winapi_thunks___vcrt_uninitialize_locks
String ID:
API String ID: 1761009282-0
Opcode ID: e092bf8d1f2de1a436e08f72e43c775e9d4ad525a9e452ad70d54133d921d8c2
Instruction ID: 6053b9a1b883a8066d39e448733b73b823d17d3c64a0c3aa603746caf52aaf50
Opcode Fuzzy Hash: e092bf8d1f2de1a436e08f72e43c775e9d4ad525a9e452ad70d54133d921d8c2
Instruction Fuzzy Hash: EFC04C25014E81EA1E2DBEF121122ED03021CF2F86B9525F1E89117803AB5508CA197B

Description:	Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. In the case of Lateral Movement, this may occur through modification of executable files stored on removable media or by copying malware and renaming it to look like a legitimate file to trick users into executing it on a separate system. In the case of Initial Access, this may occur through manual manipulation of the media, modification of systems used to initially format the media, or modification to the media's firmware itself.
Tactics:	Initial Access, Lateral Movement
Data Sources:	Drive: Drive Creation, File: File Access, File: File Creation, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may hook into Windows application programming interface (API) functions to collect user credentials. Malicious hooking mechanisms may capture API calls that include parameters that reveal user authentication credentials.Unlike Keylogging , this technique focuses specifically on API functions that include parameters that reveal user credentials. Hooking involves redirecting calls to these functions and can be implemented via:
Tactics:	Collection, Credential Access
Data Sources:	Process: OS API Execution, Process: Process Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system.Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable storage. The information may be used to enhance their awareness of the system and network environment or may be used for further actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report IRPF2024-0940959038w904598304w985036.msi

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Config.Msi\3c086a.rbs

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Flexpcis.exe_ac4eb928f71a1238ac277513c9446589b80efc4_10d4e3e1_4445af09-0b96-4657-937e-3716b5d9cb35\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Flexpcis.exe_ac4eb928f71a1238ac277513c9446589b80efc4_10d4e3e1_b85dc046-0db7-4a6d-a980-f7495a372184\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Flexpcis.exe_ac4eb928f71a1238ac277513c9446589b80efc4_10d4e3e1_e78915f5-aa93-4fad-82fd-884065e182d9\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Flexpcis.exe_ac4eb928f71a1238ac277513c9446589b80efc4_10d4e3e1_e8cefdc1-d6bf-40ae-a7d0-50cf71a27795\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Flexpcis.exe_e87c0a2afe35b309f14a3a7c9edd366c81c413_10d4e3e1_06495a97-ff68-4d31-89ea-66637693f022\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Flexpcis.exe_e87c0a2afe35b309f14a3a7c9edd366c81c413_10d4e3e1_892afd6e-3d10-419b-9842-cef2a2414149\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Flexpcis.exe_e87c0a2afe35b309f14a3a7c9edd366c81c413_10d4e3e1_b4825b46-7409-459a-9772-542b33cc2059\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Flexpcis.exe_e87c0a2afe35b309f14a3a7c9edd366c81c413_10d4e3e1_b916971a-da99-4f41-82bc-2f6d10279bb3\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2988.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2AA2.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2AE1.tmp.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3271.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER339B.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER33CB.tmp.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERA2C5.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WERA5A4.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERA5C5.tmp.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERAB41.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WERABEE.tmp.WERInternalMetadata.xml

Windows Analysis Report
IRPF2024-0940959038w904598304w985036.msi

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre