Windows Analysis Report
documents-pdf.exe

AI detected suspicious sample

Source: Yara match	File source: 16.2.yava_explore.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.2.yava_explore.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.2.yava_explore.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.yava_explore.exe.21a0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.3.yava_explore.exe.2290000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.2.yava_explore.exe.2210e67.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.yava_explore.exe.21a0e67.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.documents-pdf.exe.850e67.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.3.yava_explore.exe.2220000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.3.yava_explore.exe.2290000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.documents-pdf.exe.850e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.documents-pdf.exe.22c0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.documents-pdf.exe.22c0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.2.yava_explore.exe.2210e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.3.yava_explore.exe.2220000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.documents-pdf.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.documents-pdf.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.yava_explore.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000010.00000002.4507176842.000000000081D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.4507176842.0000000000828000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2128430234.0000000000981000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000002.2190470825.00000000006C0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2038922031.00000000022C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000003.2174054334.0000000002290000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2127973802.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000002.2190120515.0000000000400000.00000040.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000002.2190598574.0000000002210000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000003.2103257618.0000000002220000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.4507281694.00000000021A0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2128264560.0000000000850000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.4506857118.0000000000400000.00000040.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: documents-pdf.exe PID: 4508, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: yava_explore.exe PID: 5080, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: yava_explore.exe PID: 5744, type: MEMORYSTR

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.7% probability

Machine Learning detection for sample

Source: documents-pdf.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\documents-pdf.exe	Code function: 0_2_004338C8 CryptAcquireContextA,CryptGenRandom,CryptReleaseContext,	0_2_004338C8
Source: C:\Users\user\Desktop\documents-pdf.exe	Code function: 0_2_00883B2F CryptAcquireContextA,CryptGenRandom,CryptReleaseContext,	0_2_00883B2F
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 16_2_004338C8 CryptAcquireContextA,CryptGenRandom,CryptReleaseContext,	16_2_004338C8
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 16_2_021D3B2F CryptAcquireContextA,CryptGenRandom,CryptReleaseContext,	16_2_021D3B2F
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 31_2_004338C8 CryptAcquireContextA,CryptGenRandom,CryptReleaseContext,	31_2_004338C8
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 31_2_02243B2F CryptAcquireContextA,CryptGenRandom,CryptReleaseContext,	31_2_02243B2F

Source: documents-pdf.exe

Binary or memory string: -----BEGIN PUBLIC KEY-----

Exploits

Yara detected UAC Bypass using CMSTP

Source: Yara match	File source: 16.2.yava_explore.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.2.yava_explore.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.2.yava_explore.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.yava_explore.exe.21a0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.3.yava_explore.exe.2290000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.2.yava_explore.exe.2210e67.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.yava_explore.exe.21a0e67.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.documents-pdf.exe.850e67.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.3.yava_explore.exe.2220000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.3.yava_explore.exe.2290000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.documents-pdf.exe.850e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.documents-pdf.exe.22c0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.documents-pdf.exe.22c0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.2.yava_explore.exe.2210e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.3.yava_explore.exe.2220000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.documents-pdf.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.documents-pdf.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.yava_explore.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000003.2038922031.00000000022C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000003.2174054334.0000000002290000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2127973802.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000002.2190120515.0000000000400000.00000040.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000002.2190598574.0000000002210000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000003.2103257618.0000000002220000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.4507281694.00000000021A0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2128264560.0000000000850000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.4506857118.0000000000400000.00000040.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: documents-pdf.exe PID: 4508, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: yava_explore.exe PID: 5080, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: yava_explore.exe PID: 5744, type: MEMORYSTR

Privilege Escalation

Contains functionality to bypass UAC (CMSTPLUA)

Source: C:\Users\user\Desktop\documents-pdf.exe	Code function: 0_2_00407538 _wcslen,CoGetObject,	0_2_00407538
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 16_2_00407538 _wcslen,CoGetObject,	16_2_00407538
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 31_2_00407538 _wcslen,CoGetObject,	31_2_00407538

Source: documents-pdf.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\documents-pdf.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Suricata IDS alerts for network traffic

Source: C:\Users\user\Desktop\documents-pdf.exe	Code function: 0_2_0040928E __EH_prolog,__CxxThrowException@8,FindFirstFileW,FindNextFileW,FindClose,FindClose,	0_2_0040928E
Source: C:\Users\user\Desktop\documents-pdf.exe	Code function: 0_2_0041C322 FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,RemoveDirectoryW,FindClose,	0_2_0041C322
Source: C:\Users\user\Desktop\documents-pdf.exe	Code function: 0_2_0040C388 FindFirstFileW,PathFileExistsW,FindNextFileW,FindClose,FindClose,	0_2_0040C388
Source: C:\Users\user\Desktop\documents-pdf.exe	Code function: 0_2_004096A0 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,	0_2_004096A0
Source: C:\Users\user\Desktop\documents-pdf.exe	Code function: 0_2_00408847 __EH_prolog,FindFirstFileW,__CxxThrowException@8,FindNextFileW,FindClose,	0_2_00408847
Source: C:\Users\user\Desktop\documents-pdf.exe	Code function: 0_2_00407877 FindFirstFileW,FindNextFileW,	0_2_00407877
Source: C:\Users\user\Desktop\documents-pdf.exe	Code function: 0_2_0044E8F9 FindFirstFileExA,	0_2_0044E8F9
Source: C:\Users\user\Desktop\documents-pdf.exe	Code function: 0_2_0040BB6B FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,	0_2_0040BB6B
Source: C:\Users\user\Desktop\documents-pdf.exe	Code function: 0_2_00419B86 FindFirstFileW,FindNextFileW,FindNextFileW,	0_2_00419B86
Source: C:\Users\user\Desktop\documents-pdf.exe	Code function: 0_2_0040BD72 FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,	0_2_0040BD72
Source: C:\Users\user\Desktop\documents-pdf.exe	Code function: 0_2_0086C589 FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,RemoveDirectoryW,FindClose,	0_2_0086C589
Source: C:\Users\user\Desktop\documents-pdf.exe	Code function: 0_2_0085C5EF FindFirstFileW,PathFileExistsW,FindNextFileW,FindClose,FindClose,	0_2_0085C5EF
Source: C:\Users\user\Desktop\documents-pdf.exe	Code function: 0_2_00859907 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,	0_2_00859907
Source: C:\Users\user\Desktop\documents-pdf.exe	Code function: 0_2_00858AAE __EH_prolog,FindFirstFileW,__CxxThrowException@8,FindNextFileW,FindClose,	0_2_00858AAE
Source: C:\Users\user\Desktop\documents-pdf.exe	Code function: 0_2_00857ADE FindFirstFileW,FindNextFileW,	0_2_00857ADE
Source: C:\Users\user\Desktop\documents-pdf.exe	Code function: 0_2_0089EB60 FindFirstFileExA,	0_2_0089EB60
Source: C:\Users\user\Desktop\documents-pdf.exe	Code function: 0_2_0085BDD2 FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,	0_2_0085BDD2
Source: C:\Users\user\Desktop\documents-pdf.exe	Code function: 0_2_00869DED FindFirstFileW,	0_2_00869DED
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 16_2_0040928E __EH_prolog,__CxxThrowException@8,FindFirstFileW,FindNextFileW,FindClose,FindClose,	16_2_0040928E
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 16_2_0041C322 FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,RemoveDirectoryW,FindClose,	16_2_0041C322
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 16_2_0040C388 FindFirstFileW,PathFileExistsW,FindNextFileW,FindClose,FindClose,	16_2_0040C388
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 16_2_004096A0 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,	16_2_004096A0
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 16_2_00408847 __EH_prolog,FindFirstFileW,__CxxThrowException@8,FindNextFileW,FindClose,	16_2_00408847
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 16_2_00407877 FindFirstFileW,FindNextFileW,	16_2_00407877
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 16_2_0044E8F9 FindFirstFileExA,	16_2_0044E8F9
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 16_2_0040BB6B FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,	16_2_0040BB6B
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 16_2_00419B86 FindFirstFileW,FindNextFileW,FindNextFileW,	16_2_00419B86
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 16_2_0040BD72 FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,	16_2_0040BD72
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 16_2_021BC589 FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,RemoveDirectoryW,FindClose,	16_2_021BC589
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 16_2_021AC5EF FindFirstFileW,PathFileExistsW,FindNextFileW,FindClose,FindClose,	16_2_021AC5EF
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 16_2_021A8AAE __EH_prolog,FindFirstFileW,__CxxThrowException@8,FindNextFileW,FindClose,	16_2_021A8AAE
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 16_2_021A7ADE FindFirstFileW,FindNextFileW,	16_2_021A7ADE
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 16_2_021EEB60 FindFirstFileExA,	16_2_021EEB60
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 16_2_021A9907 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,	16_2_021A9907
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 16_2_021ABDD2 FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,	16_2_021ABDD2
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 16_2_021B9DED FindFirstFileW,	16_2_021B9DED
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 31_2_0040928E __EH_prolog,__CxxThrowException@8,FindFirstFileW,FindNextFileW,FindClose,FindClose,	31_2_0040928E
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 31_2_0041C322 FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,RemoveDirectoryW,FindClose,	31_2_0041C322
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 31_2_0040C388 FindFirstFileW,PathFileExistsW,FindNextFileW,FindClose,FindClose,	31_2_0040C388
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 31_2_004096A0 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,	31_2_004096A0
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 31_2_00408847 __EH_prolog,FindFirstFileW,__CxxThrowException@8,FindNextFileW,FindClose,	31_2_00408847
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 31_2_00407877 FindFirstFileW,FindNextFileW,	31_2_00407877
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 31_2_0044E8F9 FindFirstFileExA,	31_2_0044E8F9
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 31_2_0040BB6B FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,	31_2_0040BB6B
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 31_2_00419B86 FindFirstFileW,FindNextFileW,FindNextFileW,	31_2_00419B86
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 31_2_0040BD72 FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,	31_2_0040BD72
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 31_2_0222C589 FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,RemoveDirectoryW,FindClose,	31_2_0222C589
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 31_2_0221C5EF FindFirstFileW,PathFileExistsW,FindNextFileW,FindClose,FindClose,	31_2_0221C5EF
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 31_2_02218AAE __EH_prolog,FindFirstFileW,__CxxThrowException@8,FindNextFileW,FindClose,	31_2_02218AAE
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 31_2_02217ADE FindFirstFileW,FindNextFileW,	31_2_02217ADE
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 31_2_0225EB60 FindFirstFileExA,	31_2_0225EB60
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 31_2_02219907 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,	31_2_02219907
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 31_2_02229DED FindFirstFileW,	31_2_02229DED
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 31_2_0221BDD2 FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,	31_2_0221BDD2

Source: C:\Users\user\Desktop\documents-pdf.exe

Code function: 0_2_00407CD2 SetEvent,GetFileAttributesW,DeleteFileW,ShellExecuteW,GetLogicalDriveStringsA,SetFileAttributesW,DeleteFileA,Sleep,StrToIntA,CreateDirectoryW,

0_2_00407CD2

Networking

Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.5:49720 -> 198.23.227.212:32583
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.5:49736 -> 198.23.227.212:32583
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.5:49741 -> 198.23.227.212:32583
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.5:49722 -> 198.23.227.212:32583
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.5:49754 -> 198.23.227.212:32583
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.5:49730 -> 198.23.227.212:32583
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.5:49752 -> 198.23.227.212:32583
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.5:49757 -> 198.23.227.212:32583
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.5:49772 -> 198.23.227.212:32583
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.5:49766 -> 198.23.227.212:32583
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.5:49764 -> 198.23.227.212:32583
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.5:49760 -> 198.23.227.212:32583
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.5:49776 -> 198.23.227.212:32583
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.5:49785 -> 198.23.227.212:32583
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.5:49744 -> 198.23.227.212:32583
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.5:49799 -> 198.23.227.212:32583
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.5:49807 -> 198.23.227.212:32583
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.5:49804 -> 198.23.227.212:32583
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.5:49740 -> 198.23.227.212:32583
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.5:49819 -> 198.23.227.212:32583
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.5:49758 -> 198.23.227.212:32583
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.5:49767 -> 198.23.227.212:32583
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.5:49737 -> 198.23.227.212:32583
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.5:49825 -> 198.23.227.212:32583
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.5:49826 -> 198.23.227.212:32583
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.5:49761 -> 198.23.227.212:32583
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.5:49834 -> 198.23.227.212:32583
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.5:49816 -> 198.23.227.212:32583
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.5:49778 -> 198.23.227.212:32583
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.5:49735 -> 198.23.227.212:32583
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.5:49832 -> 198.23.227.212:32583
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.5:49731 -> 198.23.227.212:32583
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.5:49762 -> 198.23.227.212:32583
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.5:49769 -> 198.23.227.212:32583
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.5:49831 -> 198.23.227.212:32583
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.5:49822 -> 198.23.227.212:32583
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.5:49828 -> 198.23.227.212:32583
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.5:49733 -> 198.23.227.212:32583
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.5:49788 -> 198.23.227.212:32583
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.5:49725 -> 198.23.227.212:32583
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.5:49765 -> 198.23.227.212:32583
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.5:49802 -> 198.23.227.212:32583
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.5:49784 -> 198.23.227.212:32583
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.5:49753 -> 198.23.227.212:32583
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.5:49821 -> 198.23.227.212:32583
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.5:49781 -> 198.23.227.212:32583
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.5:49750 -> 198.23.227.212:32583
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.5:49798 -> 198.23.227.212:32583
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.5:49824 -> 198.23.227.212:32583
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.5:49782 -> 198.23.227.212:32583
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.5:49793 -> 198.23.227.212:32583
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.5:49739 -> 198.23.227.212:32583
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.5:49738 -> 198.23.227.212:32583
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.5:49794 -> 198.23.227.212:32583
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.5:49746 -> 198.23.227.212:32583
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.5:49748 -> 198.23.227.212:32583
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.5:49734 -> 198.23.227.212:32583
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.5:49835 -> 198.23.227.212:32583
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.5:49770 -> 198.23.227.212:32583
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.5:49789 -> 198.23.227.212:32583
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.5:49768 -> 198.23.227.212:32583
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.5:49806 -> 198.23.227.212:32583
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.5:49808 -> 198.23.227.212:32583
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.5:49756 -> 198.23.227.212:32583
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.5:49833 -> 198.23.227.212:32583
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.5:49773 -> 198.23.227.212:32583
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.5:49817 -> 198.23.227.212:32583
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.5:49759 -> 198.23.227.212:32583
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.5:49813 -> 198.23.227.212:32583
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.5:49783 -> 198.23.227.212:32583
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.5:49827 -> 198.23.227.212:32583
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.5:49790 -> 198.23.227.212:32583
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.5:49830 -> 198.23.227.212:32583
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.5:49800 -> 198.23.227.212:32583
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.5:49780 -> 198.23.227.212:32583
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.5:49805 -> 198.23.227.212:32583
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.5:49829 -> 198.23.227.212:32583
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.5:49779 -> 198.23.227.212:32583
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.5:49810 -> 198.23.227.212:32583
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.5:49775 -> 198.23.227.212:32583
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.5:49814 -> 198.23.227.212:32583
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.5:49795 -> 198.23.227.212:32583
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.5:49796 -> 198.23.227.212:32583
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.5:49755 -> 198.23.227.212:32583
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.5:49791 -> 198.23.227.212:32583
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.5:49812 -> 198.23.227.212:32583
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.5:49742 -> 198.23.227.212:32583
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.5:49797 -> 198.23.227.212:32583
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.5:49763 -> 198.23.227.212:32583
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.5:49749 -> 198.23.227.212:32583
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.5:49809 -> 198.23.227.212:32583
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.5:49786 -> 198.23.227.212:32583
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.5:49751 -> 198.23.227.212:32583
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.5:49723 -> 198.23.227.212:32583
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.5:49777 -> 198.23.227.212:32583
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.5:49774 -> 198.23.227.212:32583
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.5:49792 -> 198.23.227.212:32583
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.5:49815 -> 198.23.227.212:32583
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.5:49811 -> 198.23.227.212:32583
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.5:49823 -> 198.23.227.212:32583
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.5:49818 -> 198.23.227.212:32583
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.5:49803 -> 198.23.227.212:32583
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.5:49820 -> 198.23.227.212:32583
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.5:49743 -> 198.23.227.212:32583
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.5:49771 -> 198.23.227.212:32583
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.5:49787 -> 198.23.227.212:32583
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.5:49801 -> 198.23.227.212:32583

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: 198.23.227.212

Source: global traffic

TCP traffic: 192.168.2.5:49720 -> 198.23.227.212:32583

Source: Joe Sandbox View

ASN Name: AS-COLOCROSSINGUS AS-COLOCROSSINGUS

Source: unknown	TCP traffic detected without corresponding DNS query: 198.23.227.212
Source: unknown	TCP traffic detected without corresponding DNS query: 198.23.227.212
Source: unknown	TCP traffic detected without corresponding DNS query: 198.23.227.212
Source: unknown	TCP traffic detected without corresponding DNS query: 198.23.227.212
Source: unknown	TCP traffic detected without corresponding DNS query: 198.23.227.212
Source: unknown	TCP traffic detected without corresponding DNS query: 198.23.227.212
Source: unknown	TCP traffic detected without corresponding DNS query: 198.23.227.212
Source: unknown	TCP traffic detected without corresponding DNS query: 198.23.227.212
Source: unknown	TCP traffic detected without corresponding DNS query: 198.23.227.212
Source: unknown	TCP traffic detected without corresponding DNS query: 198.23.227.212
Source: unknown	TCP traffic detected without corresponding DNS query: 198.23.227.212
Source: unknown	TCP traffic detected without corresponding DNS query: 198.23.227.212
Source: unknown	TCP traffic detected without corresponding DNS query: 198.23.227.212
Source: unknown	TCP traffic detected without corresponding DNS query: 198.23.227.212
Source: unknown	TCP traffic detected without corresponding DNS query: 198.23.227.212
Source: unknown	TCP traffic detected without corresponding DNS query: 198.23.227.212
Source: unknown	TCP traffic detected without corresponding DNS query: 198.23.227.212
Source: unknown	TCP traffic detected without corresponding DNS query: 198.23.227.212
Source: unknown	TCP traffic detected without corresponding DNS query: 198.23.227.212
Source: unknown	TCP traffic detected without corresponding DNS query: 198.23.227.212
Source: unknown	TCP traffic detected without corresponding DNS query: 198.23.227.212
Source: unknown	TCP traffic detected without corresponding DNS query: 198.23.227.212
Source: unknown	TCP traffic detected without corresponding DNS query: 198.23.227.212
Source: unknown	TCP traffic detected without corresponding DNS query: 198.23.227.212
Source: unknown	TCP traffic detected without corresponding DNS query: 198.23.227.212
Source: unknown	TCP traffic detected without corresponding DNS query: 198.23.227.212
Source: unknown	TCP traffic detected without corresponding DNS query: 198.23.227.212
Source: unknown	TCP traffic detected without corresponding DNS query: 198.23.227.212
Source: unknown	TCP traffic detected without corresponding DNS query: 198.23.227.212
Source: unknown	TCP traffic detected without corresponding DNS query: 198.23.227.212
Source: unknown	TCP traffic detected without corresponding DNS query: 198.23.227.212
Source: unknown	TCP traffic detected without corresponding DNS query: 198.23.227.212
Source: unknown	TCP traffic detected without corresponding DNS query: 198.23.227.212
Source: unknown	TCP traffic detected without corresponding DNS query: 198.23.227.212
Source: unknown	TCP traffic detected without corresponding DNS query: 198.23.227.212
Source: unknown	TCP traffic detected without corresponding DNS query: 198.23.227.212
Source: unknown	TCP traffic detected without corresponding DNS query: 198.23.227.212
Source: unknown	TCP traffic detected without corresponding DNS query: 198.23.227.212
Source: unknown	TCP traffic detected without corresponding DNS query: 198.23.227.212
Source: unknown	TCP traffic detected without corresponding DNS query: 198.23.227.212
Source: unknown	TCP traffic detected without corresponding DNS query: 198.23.227.212
Source: unknown	TCP traffic detected without corresponding DNS query: 198.23.227.212
Source: unknown	TCP traffic detected without corresponding DNS query: 198.23.227.212
Source: unknown	TCP traffic detected without corresponding DNS query: 198.23.227.212
Source: unknown	TCP traffic detected without corresponding DNS query: 198.23.227.212
Source: unknown	TCP traffic detected without corresponding DNS query: 198.23.227.212
Source: unknown	TCP traffic detected without corresponding DNS query: 198.23.227.212
Source: unknown	TCP traffic detected without corresponding DNS query: 198.23.227.212
Source: unknown	TCP traffic detected without corresponding DNS query: 198.23.227.212
Source: unknown	TCP traffic detected without corresponding DNS query: 198.23.227.212

Source: C:\Users\user\Desktop\documents-pdf.exe

Code function: 0_2_0041B411 InternetOpenW,InternetOpenUrlW,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

0_2_0041B411

Source: yava_explore.exe	String found in binary or memory: http://geoplugin.net/json.gp
Source: documents-pdf.exe, 00000000.00000002.2127973802.0000000000400000.00000040.00000001.01000000.00000003.sdmp, documents-pdf.exe, 00000000.00000003.2038922031.00000000022C0000.00000004.00001000.00020000.00000000.sdmp, documents-pdf.exe, 00000000.00000002.2128264560.0000000000850000.00000040.00001000.00020000.00000000.sdmp, yava_explore.exe, 00000010.00000002.4506857118.0000000000400000.00000040.00000001.01000000.00000006.sdmp, yava_explore.exe, 00000010.00000003.2103257618.0000000002220000.00000004.00001000.00020000.00000000.sdmp, yava_explore.exe, 00000010.00000002.4507281694.00000000021A0000.00000040.00001000.00020000.00000000.sdmp, yava_explore.exe, 0000001F.00000002.2190598574.0000000002210000.00000040.00001000.00020000.00000000.sdmp, yava_explore.exe, 0000001F.00000003.2174054334.0000000002290000.00000004.00001000.00020000.00000000.sdmp, yava_explore.exe, 0000001F.00000002.2190120515.0000000000400000.00000040.00000001.01000000.00000006.sdmp	String found in binary or memory: http://geoplugin.net/json.gp/C
Source: Amcache.hve.3.dr	String found in binary or memory: http://upx.sf.net

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to register a low level keyboard hook

Source: C:\Users\user\Desktop\documents-pdf.exe

Code function: 0_2_0040A2F3 SetWindowsHookExA 0000000D,0040A2DF,00000000

0_2_0040A2F3

Source: C:\Users\user\Desktop\documents-pdf.exe

Code function: 0_2_0040B749 OpenClipboard,GetClipboardData,CloseClipboard,

0_2_0040B749

Source: C:\Users\user\Desktop\documents-pdf.exe	Code function: 0_2_004168FC OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,SetClipboardData,CloseClipboard,OpenClipboard,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,	0_2_004168FC
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 16_2_004168FC OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,SetClipboardData,CloseClipboard,OpenClipboard,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,	16_2_004168FC
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 31_2_004168FC OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,SetClipboardData,CloseClipboard,OpenClipboard,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,	31_2_004168FC

Source: C:\Users\user\Desktop\documents-pdf.exe

Code function: 0_2_0040B749 OpenClipboard,GetClipboardData,CloseClipboard,

0_2_0040B749

Source: C:\Users\user\Desktop\documents-pdf.exe

Code function: 0_2_0040A41B GetForegroundWindow,GetWindowThreadProcessId,GetKeyboardLayout,GetKeyState,GetKeyboardState,ToUnicodeEx,ToUnicodeEx,ToUnicodeEx,ToUnicodeEx,

0_2_0040A41B

Source: Yara match	File source: 16.2.yava_explore.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.2.yava_explore.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.2.yava_explore.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.yava_explore.exe.21a0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.3.yava_explore.exe.2290000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.2.yava_explore.exe.2210e67.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.yava_explore.exe.21a0e67.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.documents-pdf.exe.850e67.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.3.yava_explore.exe.2220000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.3.yava_explore.exe.2290000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.documents-pdf.exe.850e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.documents-pdf.exe.22c0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.documents-pdf.exe.22c0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.2.yava_explore.exe.2210e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.3.yava_explore.exe.2220000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.documents-pdf.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.documents-pdf.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.yava_explore.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000003.2038922031.00000000022C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000003.2174054334.0000000002290000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2127973802.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000002.2190120515.0000000000400000.00000040.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000002.2190598574.0000000002210000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000003.2103257618.0000000002220000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.4507281694.00000000021A0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2128264560.0000000000850000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.4506857118.0000000000400000.00000040.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: documents-pdf.exe PID: 4508, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: yava_explore.exe PID: 5080, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: yava_explore.exe PID: 5744, type: MEMORYSTR

E-Banking Fraud

Contains functionalty to change the wallpaper

Source: Yara match	File source: 16.2.yava_explore.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.2.yava_explore.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.2.yava_explore.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.yava_explore.exe.21a0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.3.yava_explore.exe.2290000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.2.yava_explore.exe.2210e67.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.yava_explore.exe.21a0e67.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.documents-pdf.exe.850e67.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.3.yava_explore.exe.2220000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.3.yava_explore.exe.2290000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.documents-pdf.exe.850e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.documents-pdf.exe.22c0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.documents-pdf.exe.22c0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.2.yava_explore.exe.2210e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.3.yava_explore.exe.2220000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.documents-pdf.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.documents-pdf.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.yava_explore.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000010.00000002.4507176842.000000000081D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.4507176842.0000000000828000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2128430234.0000000000981000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000002.2190470825.00000000006C0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2038922031.00000000022C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000003.2174054334.0000000002290000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2127973802.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000002.2190120515.0000000000400000.00000040.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000002.2190598574.0000000002210000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000003.2103257618.0000000002220000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.4507281694.00000000021A0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2128264560.0000000000850000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.4506857118.0000000000400000.00000040.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: documents-pdf.exe PID: 4508, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: yava_explore.exe PID: 5080, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: yava_explore.exe PID: 5744, type: MEMORYSTR

Spam, unwanted Advertisements and Ransom Demands

Source: C:\Users\user\Desktop\documents-pdf.exe	Code function: 0_2_0041CA73 SystemParametersInfoW,	0_2_0041CA73
Source: C:\Users\user\Desktop\documents-pdf.exe	Code function: 0_2_0086CCDA SystemParametersInfoW,	0_2_0086CCDA
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 16_2_0041CA73 SystemParametersInfoW,	16_2_0041CA73
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 16_2_021BCCDA SystemParametersInfoW,	16_2_021BCCDA
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 31_2_0041CA73 SystemParametersInfoW,	31_2_0041CA73
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 31_2_0222CCDA SystemParametersInfoW,	31_2_0222CCDA

System Summary

Malicious sample detected (through community Yara rule)

Source: 16.2.yava_explore.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 16.2.yava_explore.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 16.2.yava_explore.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 31.2.yava_explore.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 31.2.yava_explore.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 31.2.yava_explore.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 31.2.yava_explore.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 31.2.yava_explore.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 31.2.yava_explore.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 16.2.yava_explore.exe.21a0e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 16.2.yava_explore.exe.21a0e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 16.2.yava_explore.exe.21a0e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 31.3.yava_explore.exe.2290000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 31.3.yava_explore.exe.2290000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 31.3.yava_explore.exe.2290000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 31.2.yava_explore.exe.2210e67.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 31.2.yava_explore.exe.2210e67.1.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 31.2.yava_explore.exe.2210e67.1.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 16.2.yava_explore.exe.21a0e67.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 16.2.yava_explore.exe.21a0e67.1.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 16.2.yava_explore.exe.21a0e67.1.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 0.2.documents-pdf.exe.850e67.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 0.2.documents-pdf.exe.850e67.1.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 0.2.documents-pdf.exe.850e67.1.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 16.3.yava_explore.exe.2220000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 16.3.yava_explore.exe.2220000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 16.3.yava_explore.exe.2220000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 31.3.yava_explore.exe.2290000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 31.3.yava_explore.exe.2290000.0.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 31.3.yava_explore.exe.2290000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 0.2.documents-pdf.exe.850e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 0.2.documents-pdf.exe.850e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 0.2.documents-pdf.exe.850e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 0.3.documents-pdf.exe.22c0000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 0.3.documents-pdf.exe.22c0000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 0.3.documents-pdf.exe.22c0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 0.3.documents-pdf.exe.22c0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 0.3.documents-pdf.exe.22c0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 0.3.documents-pdf.exe.22c0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 31.2.yava_explore.exe.2210e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 31.2.yava_explore.exe.2210e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 31.2.yava_explore.exe.2210e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 16.3.yava_explore.exe.2220000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 16.3.yava_explore.exe.2220000.0.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 16.3.yava_explore.exe.2220000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 0.2.documents-pdf.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 0.2.documents-pdf.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 0.2.documents-pdf.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 0.2.documents-pdf.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 0.2.documents-pdf.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 0.2.documents-pdf.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 16.2.yava_explore.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 16.2.yava_explore.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 16.2.yava_explore.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 0000001F.00000002.2190431886.000000000067C000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000010.00000002.4507148871.00000000007D9000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000000.00000002.2128363256.000000000093D000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000000.00000003.2038922031.00000000022C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 00000000.00000003.2038922031.00000000022C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 00000000.00000003.2038922031.00000000022C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 0000001F.00000003.2174054334.0000000002290000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 0000001F.00000003.2174054334.0000000002290000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 0000001F.00000003.2174054334.0000000002290000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 00000000.00000002.2127973802.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 00000000.00000002.2127973802.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 00000000.00000002.2127973802.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 0000001F.00000002.2190120515.0000000000400000.00000040.00000001.01000000.00000006.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 0000001F.00000002.2190120515.0000000000400000.00000040.00000001.01000000.00000006.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 0000001F.00000002.2190120515.0000000000400000.00000040.00000001.01000000.00000006.sdmp, type: MEMORY	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 0000001F.00000002.2190598574.0000000002210000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 0000001F.00000002.2190598574.0000000002210000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000010.00000003.2103257618.0000000002220000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 00000010.00000003.2103257618.0000000002220000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 00000010.00000003.2103257618.0000000002220000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 00000010.00000002.4507281694.00000000021A0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 00000010.00000002.4507281694.00000000021A0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000000.00000002.2128264560.0000000000850000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 00000000.00000002.2128264560.0000000000850000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000010.00000002.4506857118.0000000000400000.00000040.00000001.01000000.00000006.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 00000010.00000002.4506857118.0000000000400000.00000040.00000001.01000000.00000006.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 00000010.00000002.4506857118.0000000000400000.00000040.00000001.01000000.00000006.sdmp, type: MEMORY	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: Process Memory Space: documents-pdf.exe PID: 4508, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: Process Memory Space: yava_explore.exe PID: 5080, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: Process Memory Space: yava_explore.exe PID: 5744, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown

Initial sample is a PE file and has a suspicious name

Source: initial sample

Static PE information: Filename: documents-pdf.exe

Sample has a suspicious name (potential lure to open the executable)

Source: documents-pdf.exe

Static file information: Suspicious name

Source: C:\Users\user\Desktop\documents-pdf.exe	Code function: 0_2_0041330D OpenProcess,NtQueryInformationProcess,GetCurrentProcess,DuplicateHandle,GetFinalPathNameByHandleW,CloseHandle,CreateFileMappingW,MapViewOfFile,GetFileSize,UnmapViewOfFile,CloseHandle,CloseHandle,CloseHandle,	0_2_0041330D
Source: C:\Users\user\Desktop\documents-pdf.exe	Code function: 0_2_0041D620 NtdllDefWindowProc_A,GetCursorPos,SetForegroundWindow,TrackPopupMenu,IsWindowVisible,ShowWindow,ShowWindow,SetForegroundWindow,Shell_NotifyIcon,ExitProcess,CreatePopupMenu,AppendMenuA,	0_2_0041D620
Source: C:\Users\user\Desktop\documents-pdf.exe	Code function: 0_2_0041BBC6 OpenProcess,NtResumeProcess,CloseHandle,	0_2_0041BBC6
Source: C:\Users\user\Desktop\documents-pdf.exe	Code function: 0_2_0041BB9A OpenProcess,NtSuspendProcess,CloseHandle,	0_2_0041BB9A
Source: C:\Users\user\Desktop\documents-pdf.exe	Code function: 0_2_00863574 OpenProcess,NtQueryInformationProcess,GetCurrentProcess,DuplicateHandle,GetFinalPathNameByHandleW,CloseHandle,CreateFileMappingW,MapViewOfFile,GetFileSize,UnmapViewOfFile,	0_2_00863574
Source: C:\Users\user\Desktop\documents-pdf.exe	Code function: 0_2_0086D887 NtdllDefWindowProc_A,GetCursorPos,SetForegroundWindow,TrackPopupMenu,IsWindowVisible,ShowWindow,ShowWindow,SetForegroundWindow,Shell_NotifyIcon,ExitProcess,CreatePopupMenu,AppendMenuA,	0_2_0086D887
Source: C:\Users\user\Desktop\documents-pdf.exe	Code function: 0_2_0086BE01 OpenProcess,NtSuspendProcess,CloseHandle,	0_2_0086BE01
Source: C:\Users\user\Desktop\documents-pdf.exe	Code function: 0_2_0086BE2D OpenProcess,NtResumeProcess,CloseHandle,	0_2_0086BE2D
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 16_2_0041330D OpenProcess,NtQueryInformationProcess,GetCurrentProcess,DuplicateHandle,GetFinalPathNameByHandleW,CloseHandle,CreateFileMappingW,MapViewOfFile,GetFileSize,UnmapViewOfFile,CloseHandle,CloseHandle,CloseHandle,	16_2_0041330D
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 16_2_0041D620 NtdllDefWindowProc_A,GetCursorPos,SetForegroundWindow,TrackPopupMenu,IsWindowVisible,ShowWindow,ShowWindow,SetForegroundWindow,Shell_NotifyIcon,ExitProcess,CreatePopupMenu,AppendMenuA,	16_2_0041D620
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 16_2_0041BBC6 OpenProcess,NtResumeProcess,CloseHandle,	16_2_0041BBC6
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 16_2_0041BB9A OpenProcess,NtSuspendProcess,CloseHandle,	16_2_0041BB9A
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 16_2_021B3574 OpenProcess,NtQueryInformationProcess,GetCurrentProcess,DuplicateHandle,GetFinalPathNameByHandleW,CloseHandle,CreateFileMappingW,MapViewOfFile,GetFileSize,UnmapViewOfFile,	16_2_021B3574
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 16_2_021BD887 NtdllDefWindowProc_A,GetCursorPos,SetForegroundWindow,TrackPopupMenu,IsWindowVisible,ShowWindow,ShowWindow,SetForegroundWindow,Shell_NotifyIcon,ExitProcess,CreatePopupMenu,AppendMenuA,	16_2_021BD887
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 16_2_021BBE01 OpenProcess,NtSuspendProcess,CloseHandle,	16_2_021BBE01
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 16_2_021BBE2D OpenProcess,NtResumeProcess,CloseHandle,	16_2_021BBE2D
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 31_2_0041330D OpenProcess,NtQueryInformationProcess,GetCurrentProcess,DuplicateHandle,GetFinalPathNameByHandleW,CloseHandle,CreateFileMappingW,MapViewOfFile,GetFileSize,UnmapViewOfFile,CloseHandle,CloseHandle,CloseHandle,	31_2_0041330D
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 31_2_0041D620 NtdllDefWindowProc_A,GetCursorPos,SetForegroundWindow,TrackPopupMenu,IsWindowVisible,ShowWindow,ShowWindow,SetForegroundWindow,Shell_NotifyIcon,ExitProcess,CreatePopupMenu,AppendMenuA,	31_2_0041D620
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 31_2_0041BBC6 OpenProcess,NtResumeProcess,CloseHandle,	31_2_0041BBC6
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 31_2_0041BB9A OpenProcess,NtSuspendProcess,CloseHandle,	31_2_0041BB9A
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 31_2_02223574 OpenProcess,NtQueryInformationProcess,GetCurrentProcess,DuplicateHandle,GetFinalPathNameByHandleW,CloseHandle,CreateFileMappingW,MapViewOfFile,GetFileSize,UnmapViewOfFile,	31_2_02223574
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 31_2_0222D887 NtdllDefWindowProc_A,GetCursorPos,SetForegroundWindow,TrackPopupMenu,IsWindowVisible,ShowWindow,ShowWindow,SetForegroundWindow,Shell_NotifyIcon,ExitProcess,CreatePopupMenu,AppendMenuA,	31_2_0222D887
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 31_2_0222BE2D OpenProcess,NtResumeProcess,CloseHandle,	31_2_0222BE2D
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 31_2_0222BE01 OpenProcess,NtSuspendProcess,CloseHandle,	31_2_0222BE01

Source: C:\Users\user\Desktop\documents-pdf.exe	Code function: 0_2_004167EF ExitWindowsEx,LoadLibraryA,GetProcAddress,	0_2_004167EF
Source: C:\Users\user\Desktop\documents-pdf.exe	Code function: 0_2_00866A5B ExitWindowsEx,LoadLibraryA,GetProcAddress,	0_2_00866A5B
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 16_2_004167EF ExitWindowsEx,LoadLibraryA,GetProcAddress,	16_2_004167EF
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 16_2_021B6A5B ExitWindowsEx,LoadLibraryA,GetProcAddress,	16_2_021B6A5B
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 31_2_004167EF ExitWindowsEx,LoadLibraryA,GetProcAddress,	31_2_004167EF
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 31_2_02226A5B ExitWindowsEx,LoadLibraryA,GetProcAddress,	31_2_02226A5B

Source: C:\Users\user\Desktop\documents-pdf.exe	Code function: 0_2_0043706A	0_2_0043706A
Source: C:\Users\user\Desktop\documents-pdf.exe	Code function: 0_2_00414005	0_2_00414005
Source: C:\Users\user\Desktop\documents-pdf.exe	Code function: 0_2_0043E11C	0_2_0043E11C
Source: C:\Users\user\Desktop\documents-pdf.exe	Code function: 0_2_004541D9	0_2_004541D9
Source: C:\Users\user\Desktop\documents-pdf.exe	Code function: 0_2_004381E8	0_2_004381E8
Source: C:\Users\user\Desktop\documents-pdf.exe	Code function: 0_2_0041F18B	0_2_0041F18B
Source: C:\Users\user\Desktop\documents-pdf.exe	Code function: 0_2_00446270	0_2_00446270
Source: C:\Users\user\Desktop\documents-pdf.exe	Code function: 0_2_0043E34B	0_2_0043E34B
Source: C:\Users\user\Desktop\documents-pdf.exe	Code function: 0_2_004533AB	0_2_004533AB
Source: C:\Users\user\Desktop\documents-pdf.exe	Code function: 0_2_0042742E	0_2_0042742E
Source: C:\Users\user\Desktop\documents-pdf.exe	Code function: 0_2_00437566	0_2_00437566
Source: C:\Users\user\Desktop\documents-pdf.exe	Code function: 0_2_0043E5A8	0_2_0043E5A8
Source: C:\Users\user\Desktop\documents-pdf.exe	Code function: 0_2_004387F0	0_2_004387F0
Source: C:\Users\user\Desktop\documents-pdf.exe	Code function: 0_2_0043797E	0_2_0043797E
Source: C:\Users\user\Desktop\documents-pdf.exe	Code function: 0_2_004339D7	0_2_004339D7
Source: C:\Users\user\Desktop\documents-pdf.exe	Code function: 0_2_0044DA49	0_2_0044DA49
Source: C:\Users\user\Desktop\documents-pdf.exe	Code function: 0_2_00427AD7	0_2_00427AD7
Source: C:\Users\user\Desktop\documents-pdf.exe	Code function: 0_2_0041DBF3	0_2_0041DBF3
Source: C:\Users\user\Desktop\documents-pdf.exe	Code function: 0_2_00427C40	0_2_00427C40
Source: C:\Users\user\Desktop\documents-pdf.exe	Code function: 0_2_00437DB3	0_2_00437DB3
Source: C:\Users\user\Desktop\documents-pdf.exe	Code function: 0_2_00435EEB	0_2_00435EEB
Source: C:\Users\user\Desktop\documents-pdf.exe	Code function: 0_2_0043DEED	0_2_0043DEED
Source: C:\Users\user\Desktop\documents-pdf.exe	Code function: 0_2_00426E9F	0_2_00426E9F
Source: C:\Users\user\Desktop\documents-pdf.exe	Code function: 0_2_00877106	0_2_00877106
Source: C:\Users\user\Desktop\documents-pdf.exe	Code function: 0_2_0088E154	0_2_0088E154
Source: C:\Users\user\Desktop\documents-pdf.exe	Code function: 0_2_008872D1	0_2_008872D1
Source: C:\Users\user\Desktop\documents-pdf.exe	Code function: 0_2_0088E383	0_2_0088E383
Source: C:\Users\user\Desktop\documents-pdf.exe	Code function: 0_2_0086F3F2	0_2_0086F3F2
Source: C:\Users\user\Desktop\documents-pdf.exe	Code function: 0_2_008964D7	0_2_008964D7
Source: C:\Users\user\Desktop\documents-pdf.exe	Code function: 0_2_0088E5B2	0_2_0088E5B2
Source: C:\Users\user\Desktop\documents-pdf.exe	Code function: 0_2_00877695	0_2_00877695
Source: C:\Users\user\Desktop\documents-pdf.exe	Code function: 0_2_008A3612	0_2_008A3612
Source: C:\Users\user\Desktop\documents-pdf.exe	Code function: 0_2_0088E80F	0_2_0088E80F
Source: C:\Users\user\Desktop\documents-pdf.exe	Code function: 0_2_00888A57	0_2_00888A57
Source: C:\Users\user\Desktop\documents-pdf.exe	Code function: 0_2_00883C3E	0_2_00883C3E
Source: C:\Users\user\Desktop\documents-pdf.exe	Code function: 0_2_00877D3E	0_2_00877D3E
Source: C:\Users\user\Desktop\documents-pdf.exe	Code function: 0_2_00877EA7	0_2_00877EA7
Source: C:\Users\user\Desktop\documents-pdf.exe	Code function: 0_2_0086DE5A	0_2_0086DE5A
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 16_2_0043706A	16_2_0043706A
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 16_2_00414005	16_2_00414005
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 16_2_0043E11C	16_2_0043E11C
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 16_2_004541D9	16_2_004541D9
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 16_2_004381E8	16_2_004381E8
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 16_2_0041F18B	16_2_0041F18B
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 16_2_00446270	16_2_00446270
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 16_2_0043E34B	16_2_0043E34B
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 16_2_004533AB	16_2_004533AB
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 16_2_0042742E	16_2_0042742E
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 16_2_00437566	16_2_00437566
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 16_2_0043E5A8	16_2_0043E5A8
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 16_2_004387F0	16_2_004387F0
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 16_2_0043797E	16_2_0043797E
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 16_2_004339D7	16_2_004339D7
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 16_2_0044DA49	16_2_0044DA49
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 16_2_00427AD7	16_2_00427AD7
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 16_2_0041DBF3	16_2_0041DBF3
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 16_2_00427C40	16_2_00427C40
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 16_2_00437DB3	16_2_00437DB3
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 16_2_00435EEB	16_2_00435EEB
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 16_2_0043DEED	16_2_0043DEED
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 16_2_00426E9F	16_2_00426E9F
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 16_2_021D72D1	16_2_021D72D1
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 16_2_021DE383	16_2_021DE383
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 16_2_021BF3F2	16_2_021BF3F2
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 16_2_021C7106	16_2_021C7106
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 16_2_021DE154	16_2_021DE154
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 16_2_021F3612	16_2_021F3612
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 16_2_021C7695	16_2_021C7695
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 16_2_021E64D7	16_2_021E64D7
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 16_2_021DE5B2	16_2_021DE5B2
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 16_2_021D8A57	16_2_021D8A57
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 16_2_021DE80F	16_2_021DE80F
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 16_2_021BDE5A	16_2_021BDE5A
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 16_2_021C7EA7	16_2_021C7EA7
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 16_2_021D3C3E	16_2_021D3C3E
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 16_2_021C7D3E	16_2_021C7D3E
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 31_2_0043706A	31_2_0043706A
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 31_2_00414005	31_2_00414005
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 31_2_0043E11C	31_2_0043E11C
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 31_2_004541D9	31_2_004541D9
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 31_2_004381E8	31_2_004381E8
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 31_2_0041F18B	31_2_0041F18B
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 31_2_00446270	31_2_00446270
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 31_2_0043E34B	31_2_0043E34B
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 31_2_004533AB	31_2_004533AB
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 31_2_0042742E	31_2_0042742E
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 31_2_00437566	31_2_00437566
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 31_2_0043E5A8	31_2_0043E5A8
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 31_2_004387F0	31_2_004387F0
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 31_2_0043797E	31_2_0043797E
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 31_2_004339D7	31_2_004339D7
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 31_2_0044DA49	31_2_0044DA49
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 31_2_00427AD7	31_2_00427AD7
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 31_2_0041DBF3	31_2_0041DBF3
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 31_2_00427C40	31_2_00427C40
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 31_2_00437DB3	31_2_00437DB3
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 31_2_00435EEB	31_2_00435EEB
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 31_2_0043DEED	31_2_0043DEED
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 31_2_00426E9F	31_2_00426E9F
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 31_2_022472D1	31_2_022472D1
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 31_2_0224E383	31_2_0224E383
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 31_2_0222F3F2	31_2_0222F3F2
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 31_2_02237106	31_2_02237106
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 31_2_0224E154	31_2_0224E154
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 31_2_02263612	31_2_02263612
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 31_2_02237695	31_2_02237695
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 31_2_022564D7	31_2_022564D7
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 31_2_0224E5B2	31_2_0224E5B2
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 31_2_02248A57	31_2_02248A57
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 31_2_0224E80F	31_2_0224E80F
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 31_2_0222DE5A	31_2_0222DE5A
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 31_2_02237EA7	31_2_02237EA7
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 31_2_02243C3E	31_2_02243C3E
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 31_2_02237D3E	31_2_02237D3E

Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: String function: 0040417E appears 46 times
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: String function: 02244A68 appears 41 times
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: String function: 022450D7 appears 45 times
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: String function: 00434801 appears 82 times
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: String function: 00457AA8 appears 34 times
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: String function: 00445951 appears 56 times
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: String function: 021D4A68 appears 41 times
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: String function: 00402213 appears 38 times
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: String function: 004052FD appears 32 times
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: String function: 021D50D7 appears 45 times
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: String function: 00434E70 appears 108 times
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: String function: 00401FAB appears 39 times
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: String function: 00411FA2 appears 32 times
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: String function: 00402093 appears 100 times
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: String function: 004020DF appears 40 times
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: String function: 004046F7 appears 34 times
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: String function: 00401E65 appears 69 times
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: String function: 0044854A appears 36 times
Source: C:\Users\user\Desktop\documents-pdf.exe	Code function: String function: 00402093 appears 50 times
Source: C:\Users\user\Desktop\documents-pdf.exe	Code function: String function: 008850D7 appears 45 times
Source: C:\Users\user\Desktop\documents-pdf.exe	Code function: String function: 00434801 appears 41 times
Source: C:\Users\user\Desktop\documents-pdf.exe	Code function: String function: 00401E65 appears 35 times
Source: C:\Users\user\Desktop\documents-pdf.exe	Code function: String function: 00434E70 appears 54 times
Source: C:\Users\user\Desktop\documents-pdf.exe	Code function: String function: 00884A68 appears 41 times

Source: C:\Users\user\Desktop\documents-pdf.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 4508 -s 956

Source: documents-pdf.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 16.2.yava_explore.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 16.2.yava_explore.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 16.2.yava_explore.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 31.2.yava_explore.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 31.2.yava_explore.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 31.2.yava_explore.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 31.2.yava_explore.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 31.2.yava_explore.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 31.2.yava_explore.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 16.2.yava_explore.exe.21a0e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 16.2.yava_explore.exe.21a0e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 16.2.yava_explore.exe.21a0e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 31.3.yava_explore.exe.2290000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 31.3.yava_explore.exe.2290000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 31.3.yava_explore.exe.2290000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 31.2.yava_explore.exe.2210e67.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 31.2.yava_explore.exe.2210e67.1.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 31.2.yava_explore.exe.2210e67.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 16.2.yava_explore.exe.21a0e67.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 16.2.yava_explore.exe.21a0e67.1.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 16.2.yava_explore.exe.21a0e67.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 0.2.documents-pdf.exe.850e67.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 0.2.documents-pdf.exe.850e67.1.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 0.2.documents-pdf.exe.850e67.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 16.3.yava_explore.exe.2220000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 16.3.yava_explore.exe.2220000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 16.3.yava_explore.exe.2220000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 31.3.yava_explore.exe.2290000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 31.3.yava_explore.exe.2290000.0.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 31.3.yava_explore.exe.2290000.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 0.2.documents-pdf.exe.850e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 0.2.documents-pdf.exe.850e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 0.2.documents-pdf.exe.850e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 0.3.documents-pdf.exe.22c0000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 0.3.documents-pdf.exe.22c0000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 0.3.documents-pdf.exe.22c0000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 0.3.documents-pdf.exe.22c0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 0.3.documents-pdf.exe.22c0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 0.3.documents-pdf.exe.22c0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 31.2.yava_explore.exe.2210e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 31.2.yava_explore.exe.2210e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 31.2.yava_explore.exe.2210e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 16.3.yava_explore.exe.2220000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 16.3.yava_explore.exe.2220000.0.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 16.3.yava_explore.exe.2220000.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 0.2.documents-pdf.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 0.2.documents-pdf.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 0.2.documents-pdf.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 0.2.documents-pdf.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 0.2.documents-pdf.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 0.2.documents-pdf.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 16.2.yava_explore.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 16.2.yava_explore.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 16.2.yava_explore.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 0000001F.00000002.2190431886.000000000067C000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000010.00000002.4507148871.00000000007D9000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000000.00000002.2128363256.000000000093D000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000000.00000003.2038922031.00000000022C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 00000000.00000003.2038922031.00000000022C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 00000000.00000003.2038922031.00000000022C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 0000001F.00000003.2174054334.0000000002290000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 0000001F.00000003.2174054334.0000000002290000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 0000001F.00000003.2174054334.0000000002290000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 00000000.00000002.2127973802.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 00000000.00000002.2127973802.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 00000000.00000002.2127973802.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 0000001F.00000002.2190120515.0000000000400000.00000040.00000001.01000000.00000006.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 0000001F.00000002.2190120515.0000000000400000.00000040.00000001.01000000.00000006.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 0000001F.00000002.2190120515.0000000000400000.00000040.00000001.01000000.00000006.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 0000001F.00000002.2190598574.0000000002210000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 0000001F.00000002.2190598574.0000000002210000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000010.00000003.2103257618.0000000002220000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 00000010.00000003.2103257618.0000000002220000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 00000010.00000003.2103257618.0000000002220000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 00000010.00000002.4507281694.00000000021A0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 00000010.00000002.4507281694.00000000021A0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000000.00000002.2128264560.0000000000850000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 00000000.00000002.2128264560.0000000000850000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000010.00000002.4506857118.0000000000400000.00000040.00000001.01000000.00000006.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 00000010.00000002.4506857118.0000000000400000.00000040.00000001.01000000.00000006.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 00000010.00000002.4506857118.0000000000400000.00000040.00000001.01000000.00000006.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: Process Memory Space: documents-pdf.exe PID: 4508, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: Process Memory Space: yava_explore.exe PID: 5080, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: Process Memory Space: yava_explore.exe PID: 5744, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23

Source: documents-pdf.exe	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: yava_explore.exe.0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winEXE@21/71@0/1

Source: C:\Users\user\Desktop\documents-pdf.exe	Code function: 0_2_0041798D GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,	0_2_0041798D
Source: C:\Users\user\Desktop\documents-pdf.exe	Code function: 0_2_00867BF4 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,	0_2_00867BF4
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 16_2_0041798D GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,	16_2_0041798D
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 16_2_021B7BF4 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,	16_2_021B7BF4
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 31_2_0041798D GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,	31_2_0041798D
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 31_2_02227BF4 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,	31_2_02227BF4

Source: C:\Users\user\Desktop\documents-pdf.exe

Code function: 0_2_0040F4AF GetModuleFileNameW,CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,CloseHandle,

0_2_0040F4AF

Source: C:\Users\user\Desktop\documents-pdf.exe

Code function: 0_2_0041B539 FindResourceA,LoadResource,LockResource,SizeofResource,

0_2_0041B539

Source: C:\Users\user\Desktop\documents-pdf.exe

Code function: 0_2_0041AADB OpenSCManagerW,OpenServiceW,CloseServiceHandle,StartServiceW,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,

0_2_0041AADB

Source: C:\Users\user\Desktop\documents-pdf.exe

File created: C:\Users\user\AppData\Roaming\yava_explore.exe

Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess5080
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Mutant created: \Sessions\1\BaseNamedObjects\Rmc-AYRCHN
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess4508
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess5744

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\c452eccd-ea36-4594-9bd5-2567d6421ff9

Source: C:\Users\user\Desktop\documents-pdf.exe	Command line argument: PG	0_2_0040EA00
Source: C:\Users\user\Desktop\documents-pdf.exe	Command line argument: PG	0_2_0040EA00
Source: C:\Users\user\Desktop\documents-pdf.exe	Command line argument: Software\	0_2_0040EA00
Source: C:\Users\user\Desktop\documents-pdf.exe	Command line argument: Rmc-AYRCHN	0_2_0040EA00
Source: C:\Users\user\Desktop\documents-pdf.exe	Command line argument: Exe	0_2_0040EA00
Source: C:\Users\user\Desktop\documents-pdf.exe	Command line argument: Exe	0_2_0040EA00
Source: C:\Users\user\Desktop\documents-pdf.exe	Command line argument: Rmc-AYRCHN	0_2_0040EA00
Source: C:\Users\user\Desktop\documents-pdf.exe	Command line argument: Inj	0_2_0040EA00
Source: C:\Users\user\Desktop\documents-pdf.exe	Command line argument: Inj	0_2_0040EA00
Source: C:\Users\user\Desktop\documents-pdf.exe	Command line argument: PG	0_2_0040EA00
Source: C:\Users\user\Desktop\documents-pdf.exe	Command line argument: PG	0_2_0040EA00
Source: C:\Users\user\Desktop\documents-pdf.exe	Command line argument: PG	0_2_0040EA00
Source: C:\Users\user\Desktop\documents-pdf.exe	Command line argument: 8SG	0_2_0040EA00
Source: C:\Users\user\Desktop\documents-pdf.exe	Command line argument: exepath	0_2_0040EA00
Source: C:\Users\user\Desktop\documents-pdf.exe	Command line argument: PG	0_2_0040EA00
Source: C:\Users\user\Desktop\documents-pdf.exe	Command line argument: 8SG	0_2_0040EA00
Source: C:\Users\user\Desktop\documents-pdf.exe	Command line argument: exepath	0_2_0040EA00
Source: C:\Users\user\Desktop\documents-pdf.exe	Command line argument: PG	0_2_0040EA00
Source: C:\Users\user\Desktop\documents-pdf.exe	Command line argument: licence	0_2_0040EA00
Source: C:\Users\user\Desktop\documents-pdf.exe	Command line argument: PG	0_2_0040EA00
Source: C:\Users\user\Desktop\documents-pdf.exe	Command line argument: PG	0_2_0040EA00
Source: C:\Users\user\Desktop\documents-pdf.exe	Command line argument: PG	0_2_0040EA00
Source: C:\Users\user\Desktop\documents-pdf.exe	Command line argument: PG	0_2_0040EA00
Source: C:\Users\user\Desktop\documents-pdf.exe	Command line argument: PG	0_2_0040EA00
Source: C:\Users\user\Desktop\documents-pdf.exe	Command line argument: PG	0_2_0040EA00
Source: C:\Users\user\Desktop\documents-pdf.exe	Command line argument: dMG	0_2_0040EA00
Source: C:\Users\user\Desktop\documents-pdf.exe	Command line argument: PG	0_2_0040EA00
Source: C:\Users\user\Desktop\documents-pdf.exe	Command line argument: PG	0_2_0040EA00
Source: C:\Users\user\Desktop\documents-pdf.exe	Command line argument: PSG	0_2_0040EA00
Source: C:\Users\user\Desktop\documents-pdf.exe	Command line argument: Administrator	0_2_0040EA00
Source: C:\Users\user\Desktop\documents-pdf.exe	Command line argument: User	0_2_0040EA00
Source: C:\Users\user\Desktop\documents-pdf.exe	Command line argument: del	0_2_0040EA00
Source: C:\Users\user\Desktop\documents-pdf.exe	Command line argument: del	0_2_0040EA00
Source: C:\Users\user\Desktop\documents-pdf.exe	Command line argument: del	0_2_0040EA00
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Command line argument: PG	16_2_0040EA00
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Command line argument: PG	16_2_0040EA00
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Command line argument: Software\	16_2_0040EA00
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Command line argument: Rmc-AYRCHN	16_2_0040EA00
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Command line argument: Exe	16_2_0040EA00
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Command line argument: Exe	16_2_0040EA00
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Command line argument: Rmc-AYRCHN	16_2_0040EA00
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Command line argument: Inj	16_2_0040EA00
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Command line argument: Inj	16_2_0040EA00
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Command line argument: PG	16_2_0040EA00
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Command line argument: PG	16_2_0040EA00
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Command line argument: PG	16_2_0040EA00
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Command line argument: 8SG	16_2_0040EA00
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Command line argument: exepath	16_2_0040EA00
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Command line argument: PG	16_2_0040EA00
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Command line argument: 8SG	16_2_0040EA00
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Command line argument: exepath	16_2_0040EA00
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Command line argument: PG	16_2_0040EA00
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Command line argument: licence	16_2_0040EA00
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Command line argument: PG	16_2_0040EA00
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Command line argument: PG	16_2_0040EA00
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Command line argument: PG	16_2_0040EA00
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Command line argument: PG	16_2_0040EA00
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Command line argument: PG	16_2_0040EA00
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Command line argument: PG	16_2_0040EA00
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Command line argument: dMG	16_2_0040EA00
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Command line argument: PG	16_2_0040EA00
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Command line argument: PG	16_2_0040EA00
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Command line argument: PSG	16_2_0040EA00
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Command line argument: Administrator	16_2_0040EA00
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Command line argument: User	16_2_0040EA00
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Command line argument: del	16_2_0040EA00
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Command line argument: del	16_2_0040EA00
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Command line argument: del	16_2_0040EA00
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Command line argument: PG	31_2_0040EA00
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Command line argument: PG	31_2_0040EA00
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Command line argument: Software\	31_2_0040EA00
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Command line argument: Exe	31_2_0040EA00
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Command line argument: Inj	31_2_0040EA00
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Command line argument: Inj	31_2_0040EA00
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Command line argument: PG	31_2_0040EA00
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Command line argument: PG	31_2_0040EA00
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Command line argument: PG	31_2_0040EA00
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Command line argument: 8SG	31_2_0040EA00
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Command line argument: exepath	31_2_0040EA00
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Command line argument: PG	31_2_0040EA00
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Command line argument: 8SG	31_2_0040EA00
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Command line argument: exepath	31_2_0040EA00
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Command line argument: PG	31_2_0040EA00
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Command line argument: licence	31_2_0040EA00
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Command line argument: PG	31_2_0040EA00
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Command line argument: PG	31_2_0040EA00
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Command line argument: PG	31_2_0040EA00
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Command line argument: PG	31_2_0040EA00
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Command line argument: PG	31_2_0040EA00
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Command line argument: PG	31_2_0040EA00
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Command line argument: dMG	31_2_0040EA00
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Command line argument: PG	31_2_0040EA00
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Command line argument: PG	31_2_0040EA00
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Command line argument: PSG	31_2_0040EA00
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Command line argument: Administrator	31_2_0040EA00
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Command line argument: User	31_2_0040EA00
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Command line argument: del	31_2_0040EA00
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Command line argument: del	31_2_0040EA00
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Command line argument: del	31_2_0040EA00

Source: documents-pdf.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\documents-pdf.exe

File read: C:\Users\user\Desktop\desktop.ini

Source: C:\Users\user\Desktop\documents-pdf.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: documents-pdf.exe

ReversingLabs: Detection: 76%

Source: C:\Users\user\Desktop\documents-pdf.exe

File read: C:\Users\user\Desktop\documents-pdf.exe

Source: unknown	Process created: C:\Users\user\Desktop\documents-pdf.exe "C:\Users\user\Desktop\documents-pdf.exe"
Source: C:\Users\user\Desktop\documents-pdf.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 4508 -s 956
Source: C:\Users\user\Desktop\documents-pdf.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 4508 -s 1128
Source: C:\Users\user\Desktop\documents-pdf.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 4508 -s 1136
Source: C:\Users\user\Desktop\documents-pdf.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 4508 -s 1164
Source: C:\Users\user\Desktop\documents-pdf.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 4508 -s 1156
Source: C:\Users\user\Desktop\documents-pdf.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 4508 -s 1212
Source: C:\Users\user\Desktop\documents-pdf.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 4508 -s 1252
Source: C:\Users\user\Desktop\documents-pdf.exe	Process created: C:\Users\user\AppData\Roaming\yava_explore.exe "C:\Users\user\AppData\Roaming\yava_explore.exe"
Source: C:\Users\user\Desktop\documents-pdf.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 4508 -s 1380
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5080 -s 684
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5080 -s 744
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5080 -s 776
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5080 -s 680
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5080 -s 684
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5080 -s 732
Source: unknown	Process created: C:\Users\user\AppData\Roaming\yava_explore.exe "C:\Users\user\AppData\Roaming\yava_explore.exe"
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5744 -s 580
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5080 -s 780
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5080 -s 716
Source: C:\Users\user\Desktop\documents-pdf.exe	Process created: C:\Users\user\AppData\Roaming\yava_explore.exe "C:\Users\user\AppData\Roaming\yava_explore.exe"	Jump to behavior

Source: C:\Users\user\Desktop\documents-pdf.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\documents-pdf.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\Desktop\documents-pdf.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\documents-pdf.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\documents-pdf.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\documents-pdf.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\documents-pdf.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\documents-pdf.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\documents-pdf.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Users\user\Desktop\documents-pdf.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\documents-pdf.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\documents-pdf.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\documents-pdf.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\documents-pdf.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\documents-pdf.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\documents-pdf.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\documents-pdf.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\documents-pdf.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\documents-pdf.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\documents-pdf.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\documents-pdf.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\documents-pdf.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\documents-pdf.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\documents-pdf.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\documents-pdf.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\documents-pdf.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\documents-pdf.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\documents-pdf.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\documents-pdf.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\documents-pdf.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\documents-pdf.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Section loaded: msimg32.dll
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Section loaded: msvcr100.dll
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Section loaded: msimg32.dll
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Section loaded: msvcr100.dll
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Section loaded: kernel.appcore.dll

Source: C:\Users\user\Desktop\documents-pdf.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\documents-pdf.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Detected unpacking (changes PE section rights)

Data Obfuscation

Source: C:\Users\user\Desktop\documents-pdf.exe	Unpacked PE file: 0.2.documents-pdf.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.tls:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.tls:W;.gfids:R;.rsrc:R;.reloc:R;
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Unpacked PE file: 16.2.yava_explore.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.tls:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.tls:W;.gfids:R;.rsrc:R;.reloc:R;
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Unpacked PE file: 31.2.yava_explore.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.tls:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.tls:W;.gfids:R;.rsrc:R;.reloc:R;

Source: C:\Users\user\Desktop\documents-pdf.exe

Code function: 0_2_0041CBE1 LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetModuleHandleA,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,

0_2_0041CBE1

Source: C:\Users\user\Desktop\documents-pdf.exe	Code function: 0_2_00457186 push ecx; ret	0_2_00457199
Source: C:\Users\user\Desktop\documents-pdf.exe	Code function: 0_2_0045E55D push esi; ret	0_2_0045E566
Source: C:\Users\user\Desktop\documents-pdf.exe	Code function: 0_2_00457AA8 push eax; ret	0_2_00457AC6
Source: C:\Users\user\Desktop\documents-pdf.exe	Code function: 0_2_00434EB6 push ecx; ret	0_2_00434EC9
Source: C:\Users\user\Desktop\documents-pdf.exe	Code function: 0_2_0088511D push ecx; ret	0_2_00885130
Source: C:\Users\user\Desktop\documents-pdf.exe	Code function: 0_2_008A73ED push ecx; ret	0_2_008A7400
Source: C:\Users\user\Desktop\documents-pdf.exe	Code function: 0_2_00874CA7 push esi; ret	0_2_00874CA9
Source: C:\Users\user\Desktop\documents-pdf.exe	Code function: 0_2_008A7D0F push eax; ret	0_2_008A7D2D
Source: C:\Users\user\Desktop\documents-pdf.exe	Code function: 0_2_009421DF push 016C66B2h; iretd	0_2_00942262
Source: C:\Users\user\Desktop\documents-pdf.exe	Code function: 0_2_0094210F push 016C66B2h; iretd	0_2_00942262
Source: C:\Users\user\Desktop\documents-pdf.exe	Code function: 0_2_00941425 push FFFFFFF6h; retf	0_2_00941427
Source: C:\Users\user\Desktop\documents-pdf.exe	Code function: 0_2_0093F8F2 push cs; ret	0_2_0093F8F5
Source: C:\Users\user\Desktop\documents-pdf.exe	Code function: 0_2_009409BE push eax; retf	0_2_009409C0
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 16_2_00457186 push ecx; ret	16_2_00457199
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 16_2_0045E55D push esi; ret	16_2_0045E566
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 16_2_00457AA8 push eax; ret	16_2_00457AC6
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 16_2_00434EB6 push ecx; ret	16_2_00434EC9
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 16_2_007DE3C7 push 016C66B2h; iretd	16_2_007DE51A
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 16_2_007DE497 push 016C66B2h; iretd	16_2_007DE51A
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 16_2_007DD6DD push FFFFFFF6h; retf	16_2_007DD6DF
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 16_2_007DBBAA push cs; ret	16_2_007DBBAD
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 16_2_007DCC76 push eax; retf	16_2_007DCC78
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 16_2_021F73ED push ecx; ret	16_2_021F7400
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 16_2_021D511D push ecx; ret	16_2_021D5130
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 16_2_021C4CA7 push esi; ret	16_2_021C4CA9
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 16_2_021F7D0F push eax; ret	16_2_021F7D2D
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 31_2_00457186 push ecx; ret	31_2_00457199
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 31_2_0045E55D push esi; ret	31_2_0045E566
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 31_2_00457AA8 push eax; ret	31_2_00457AC6
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 31_2_00434EB6 push ecx; ret	31_2_00434EC9
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 31_2_0068114F push 016C66B2h; iretd	31_2_006812A2

Source: documents-pdf.exe	Static PE information: section name: .text entropy: 7.927410473473771
Source: yava_explore.exe.0.dr	Static PE information: section name: .text entropy: 7.927410473473771

Source: C:\Users\user\Desktop\documents-pdf.exe

Code function: 0_2_00406EEB ShellExecuteW,URLDownloadToFileW,

0_2_00406EEB

Source: C:\Users\user\Desktop\documents-pdf.exe

File created: C:\Users\user\AppData\Roaming\yava_explore.exe

Jump to dropped file

Boot Survival

Creates autostart registry keys with suspicious names

Source: C:\Users\user\Desktop\documents-pdf.exe

Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Rmc-AYRCHN

Delayed program exit found

Source: C:\Users\user\Desktop\documents-pdf.exe

Code function: 0_2_0041AADB OpenSCManagerW,OpenServiceW,CloseServiceHandle,StartServiceW,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,

0_2_0041AADB

Source: C:\Users\user\Desktop\documents-pdf.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Rmc-AYRCHN			Jump to behavior
Source: C:\Users\user\Desktop\documents-pdf.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Rmc-AYRCHN			Jump to behavior

Source: C:\Users\user\Desktop\documents-pdf.exe

0_2_0041CBE1

Source: C:\Users\user\Desktop\documents-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\documents-pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX

Malware Analysis System Evasion

Source: C:\Users\user\Desktop\documents-pdf.exe	Code function: 0_2_0040F7E2 Sleep,ExitProcess,	0_2_0040F7E2
Source: C:\Users\user\Desktop\documents-pdf.exe	Code function: 0_2_0085FA49 Sleep,ExitProcess,	0_2_0085FA49
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 16_2_0040F7E2 Sleep,ExitProcess,	16_2_0040F7E2
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 16_2_021AFA49 Sleep,ExitProcess,	16_2_021AFA49
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 31_2_0040F7E2 Sleep,ExitProcess,	31_2_0040F7E2
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 31_2_0221FA49 Sleep,ExitProcess,	31_2_0221FA49

Source: C:\Users\user\Desktop\documents-pdf.exe	Code function: OpenSCManagerA,EnumServicesStatusW,GetLastError,EnumServicesStatusW,OpenServiceW,QueryServiceConfigW,GetLastError,QueryServiceConfigW,CloseServiceHandle,CloseServiceHandle,	0_2_0041A7D9
Source: C:\Users\user\Desktop\documents-pdf.exe	Code function: OpenSCManagerA,EnumServicesStatusW,GetLastError,EnumServicesStatusW,OpenServiceW,QueryServiceConfigW,GetLastError,QueryServiceConfigW,CloseServiceHandle,CloseServiceHandle,	0_2_0086AA40
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: OpenSCManagerA,EnumServicesStatusW,GetLastError,EnumServicesStatusW,OpenServiceW,QueryServiceConfigW,GetLastError,QueryServiceConfigW,CloseServiceHandle,CloseServiceHandle,	16_2_0041A7D9
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: OpenSCManagerA,EnumServicesStatusW,GetLastError,EnumServicesStatusW,OpenServiceW,QueryServiceConfigW,GetLastError,QueryServiceConfigW,CloseServiceHandle,CloseServiceHandle,	16_2_021BAA40
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: OpenSCManagerA,EnumServicesStatusW,GetLastError,EnumServicesStatusW,OpenServiceW,QueryServiceConfigW,GetLastError,QueryServiceConfigW,CloseServiceHandle,CloseServiceHandle,	31_2_0041A7D9
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: OpenSCManagerA,EnumServicesStatusW,GetLastError,EnumServicesStatusW,OpenServiceW,QueryServiceConfigW,GetLastError,QueryServiceConfigW,CloseServiceHandle,CloseServiceHandle,	31_2_0222AA40

Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Window / User API: threadDelayed 502
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Window / User API: threadDelayed 9433

Source: C:\Users\user\Desktop\documents-pdf.exe	Evaded block: after key decision			graph_0-88372
Source: C:\Users\user\Desktop\documents-pdf.exe	Evaded block: after key decision			graph_0-88344

Source: C:\Users\user\Desktop\documents-pdf.exe	API coverage: 4.1 %
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	API coverage: 5.9 %
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	API coverage: 3.9 %

Source: C:\Users\user\AppData\Roaming\yava_explore.exe TID: 5248	Thread sleep count: 502 > 30
Source: C:\Users\user\AppData\Roaming\yava_explore.exe TID: 5248	Thread sleep time: -1506000s >= -30000s
Source: C:\Users\user\AppData\Roaming\yava_explore.exe TID: 5248	Thread sleep count: 9433 > 30
Source: C:\Users\user\AppData\Roaming\yava_explore.exe TID: 5248	Thread sleep time: -28299000s >= -30000s

Source: C:\Users\user\Desktop\documents-pdf.exe	Code function: 0_2_0040928E __EH_prolog,__CxxThrowException@8,FindFirstFileW,FindNextFileW,FindClose,FindClose,	0_2_0040928E
Source: C:\Users\user\Desktop\documents-pdf.exe	Code function: 0_2_0041C322 FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,RemoveDirectoryW,FindClose,	0_2_0041C322
Source: C:\Users\user\Desktop\documents-pdf.exe	Code function: 0_2_0040C388 FindFirstFileW,PathFileExistsW,FindNextFileW,FindClose,FindClose,	0_2_0040C388
Source: C:\Users\user\Desktop\documents-pdf.exe	Code function: 0_2_004096A0 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,	0_2_004096A0
Source: C:\Users\user\Desktop\documents-pdf.exe	Code function: 0_2_00408847 __EH_prolog,FindFirstFileW,__CxxThrowException@8,FindNextFileW,FindClose,	0_2_00408847
Source: C:\Users\user\Desktop\documents-pdf.exe	Code function: 0_2_00407877 FindFirstFileW,FindNextFileW,	0_2_00407877
Source: C:\Users\user\Desktop\documents-pdf.exe	Code function: 0_2_0044E8F9 FindFirstFileExA,	0_2_0044E8F9
Source: C:\Users\user\Desktop\documents-pdf.exe	Code function: 0_2_0040BB6B FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,	0_2_0040BB6B
Source: C:\Users\user\Desktop\documents-pdf.exe	Code function: 0_2_00419B86 FindFirstFileW,FindNextFileW,FindNextFileW,	0_2_00419B86
Source: C:\Users\user\Desktop\documents-pdf.exe	Code function: 0_2_0040BD72 FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,	0_2_0040BD72
Source: C:\Users\user\Desktop\documents-pdf.exe	Code function: 0_2_0086C589 FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,RemoveDirectoryW,FindClose,	0_2_0086C589
Source: C:\Users\user\Desktop\documents-pdf.exe	Code function: 0_2_0085C5EF FindFirstFileW,PathFileExistsW,FindNextFileW,FindClose,FindClose,	0_2_0085C5EF
Source: C:\Users\user\Desktop\documents-pdf.exe	Code function: 0_2_00859907 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,	0_2_00859907
Source: C:\Users\user\Desktop\documents-pdf.exe	Code function: 0_2_00858AAE __EH_prolog,FindFirstFileW,__CxxThrowException@8,FindNextFileW,FindClose,	0_2_00858AAE
Source: C:\Users\user\Desktop\documents-pdf.exe	Code function: 0_2_00857ADE FindFirstFileW,FindNextFileW,	0_2_00857ADE
Source: C:\Users\user\Desktop\documents-pdf.exe	Code function: 0_2_0089EB60 FindFirstFileExA,	0_2_0089EB60
Source: C:\Users\user\Desktop\documents-pdf.exe	Code function: 0_2_0085BDD2 FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,	0_2_0085BDD2
Source: C:\Users\user\Desktop\documents-pdf.exe	Code function: 0_2_00869DED FindFirstFileW,	0_2_00869DED
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 16_2_0040928E __EH_prolog,__CxxThrowException@8,FindFirstFileW,FindNextFileW,FindClose,FindClose,	16_2_0040928E
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 16_2_0041C322 FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,RemoveDirectoryW,FindClose,	16_2_0041C322
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 16_2_0040C388 FindFirstFileW,PathFileExistsW,FindNextFileW,FindClose,FindClose,	16_2_0040C388
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 16_2_004096A0 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,	16_2_004096A0
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 16_2_00408847 __EH_prolog,FindFirstFileW,__CxxThrowException@8,FindNextFileW,FindClose,	16_2_00408847
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 16_2_00407877 FindFirstFileW,FindNextFileW,	16_2_00407877
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 16_2_0044E8F9 FindFirstFileExA,	16_2_0044E8F9
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 16_2_0040BB6B FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,	16_2_0040BB6B
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 16_2_00419B86 FindFirstFileW,FindNextFileW,FindNextFileW,	16_2_00419B86
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 16_2_0040BD72 FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,	16_2_0040BD72
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 16_2_021BC589 FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,RemoveDirectoryW,FindClose,	16_2_021BC589
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 16_2_021AC5EF FindFirstFileW,PathFileExistsW,FindNextFileW,FindClose,FindClose,	16_2_021AC5EF
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 16_2_021A8AAE __EH_prolog,FindFirstFileW,__CxxThrowException@8,FindNextFileW,FindClose,	16_2_021A8AAE
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 16_2_021A7ADE FindFirstFileW,FindNextFileW,	16_2_021A7ADE
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 16_2_021EEB60 FindFirstFileExA,	16_2_021EEB60
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 16_2_021A9907 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,	16_2_021A9907
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 16_2_021ABDD2 FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,	16_2_021ABDD2
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 16_2_021B9DED FindFirstFileW,	16_2_021B9DED
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 31_2_0040928E __EH_prolog,__CxxThrowException@8,FindFirstFileW,FindNextFileW,FindClose,FindClose,	31_2_0040928E
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 31_2_0041C322 FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,RemoveDirectoryW,FindClose,	31_2_0041C322
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 31_2_0040C388 FindFirstFileW,PathFileExistsW,FindNextFileW,FindClose,FindClose,	31_2_0040C388
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 31_2_004096A0 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,	31_2_004096A0
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 31_2_00408847 __EH_prolog,FindFirstFileW,__CxxThrowException@8,FindNextFileW,FindClose,	31_2_00408847
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 31_2_00407877 FindFirstFileW,FindNextFileW,	31_2_00407877
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 31_2_0044E8F9 FindFirstFileExA,	31_2_0044E8F9
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 31_2_0040BB6B FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,	31_2_0040BB6B
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 31_2_00419B86 FindFirstFileW,FindNextFileW,FindNextFileW,	31_2_00419B86
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 31_2_0040BD72 FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,	31_2_0040BD72
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 31_2_0222C589 FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,RemoveDirectoryW,FindClose,	31_2_0222C589
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 31_2_0221C5EF FindFirstFileW,PathFileExistsW,FindNextFileW,FindClose,FindClose,	31_2_0221C5EF
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 31_2_02218AAE __EH_prolog,FindFirstFileW,__CxxThrowException@8,FindNextFileW,FindClose,	31_2_02218AAE
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 31_2_02217ADE FindFirstFileW,FindNextFileW,	31_2_02217ADE
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 31_2_0225EB60 FindFirstFileExA,	31_2_0225EB60
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 31_2_02219907 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,	31_2_02219907
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 31_2_02229DED FindFirstFileW,	31_2_02229DED
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 31_2_0221BDD2 FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,	31_2_0221BDD2

Source: C:\Users\user\Desktop\documents-pdf.exe

Code function: 0_2_00407CD2 SetEvent,GetFileAttributesW,DeleteFileW,ShellExecuteW,GetLogicalDriveStringsA,SetFileAttributesW,DeleteFileA,Sleep,StrToIntA,CreateDirectoryW,

0_2_00407CD2

Source: Amcache.hve.3.dr	Binary or memory string: VMware
Source: Amcache.hve.3.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.3.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.3.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.3.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.3.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.3.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.3.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.3.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.3.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.3.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.3.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: yava_explore.exe, 00000010.00000002.4507176842.0000000000835000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: Amcache.hve.3.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.3.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.3.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.3.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.3.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.3.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.3.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.3.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.3.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.3.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.3.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.3.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.3.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.3.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.3.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.3.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.3.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Users\user\AppData\Roaming\yava_explore.exe

API call chain: ExitProcess graph end node

Source: C:\Users\user\Desktop\documents-pdf.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\documents-pdf.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Process queried: DebugPort

Source: C:\Users\user\Desktop\documents-pdf.exe

Code function: 0_2_00434A8A IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00434A8A

Source: C:\Users\user\Desktop\documents-pdf.exe

0_2_0041CBE1

Source: C:\Users\user\Desktop\documents-pdf.exe	Code function: 0_2_00443355 mov eax, dword ptr fs:[00000030h]	0_2_00443355
Source: C:\Users\user\Desktop\documents-pdf.exe	Code function: 0_2_008935BC mov eax, dword ptr fs:[00000030h]	0_2_008935BC
Source: C:\Users\user\Desktop\documents-pdf.exe	Code function: 0_2_0085092B mov eax, dword ptr fs:[00000030h]	0_2_0085092B
Source: C:\Users\user\Desktop\documents-pdf.exe	Code function: 0_2_00850D90 mov eax, dword ptr fs:[00000030h]	0_2_00850D90
Source: C:\Users\user\Desktop\documents-pdf.exe	Code function: 0_2_0093D7FB push dword ptr fs:[00000030h]	0_2_0093D7FB
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 16_2_00443355 mov eax, dword ptr fs:[00000030h]	16_2_00443355
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 16_2_007D9AB3 push dword ptr fs:[00000030h]	16_2_007D9AB3
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 16_2_021E35BC mov eax, dword ptr fs:[00000030h]	16_2_021E35BC
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 16_2_021A092B mov eax, dword ptr fs:[00000030h]	16_2_021A092B
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 16_2_021A0D90 mov eax, dword ptr fs:[00000030h]	16_2_021A0D90
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 31_2_00443355 mov eax, dword ptr fs:[00000030h]	31_2_00443355
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 31_2_0067C83B push dword ptr fs:[00000030h]	31_2_0067C83B
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 31_2_022535BC mov eax, dword ptr fs:[00000030h]	31_2_022535BC
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 31_2_0221092B mov eax, dword ptr fs:[00000030h]	31_2_0221092B
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 31_2_02210D90 mov eax, dword ptr fs:[00000030h]	31_2_02210D90

Source: C:\Users\user\Desktop\documents-pdf.exe

Code function: 0_2_004120B2 GetProcessHeap,HeapFree,

0_2_004120B2

Source: C:\Users\user\Desktop\documents-pdf.exe	Code function: 0_2_0043503C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_0043503C
Source: C:\Users\user\Desktop\documents-pdf.exe	Code function: 0_2_00434A8A IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00434A8A
Source: C:\Users\user\Desktop\documents-pdf.exe	Code function: 0_2_0043BB71 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_0043BB71
Source: C:\Users\user\Desktop\documents-pdf.exe	Code function: 0_2_00434BD8 SetUnhandledExceptionFilter,	0_2_00434BD8
Source: C:\Users\user\Desktop\documents-pdf.exe	Code function: 0_2_008852A3 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_008852A3
Source: C:\Users\user\Desktop\documents-pdf.exe	Code function: 0_2_00884CF1 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00884CF1
Source: C:\Users\user\Desktop\documents-pdf.exe	Code function: 0_2_0088BDD8 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_0088BDD8
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 16_2_0043503C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	16_2_0043503C
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 16_2_00434A8A IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	16_2_00434A8A
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 16_2_0043BB71 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	16_2_0043BB71
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 16_2_00434BD8 SetUnhandledExceptionFilter,	16_2_00434BD8
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 16_2_021D52A3 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	16_2_021D52A3
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 16_2_021D4CF1 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	16_2_021D4CF1
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 16_2_021DBDD8 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	16_2_021DBDD8
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 31_2_0043503C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	31_2_0043503C
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 31_2_00434A8A IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	31_2_00434A8A
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 31_2_0043BB71 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	31_2_0043BB71
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 31_2_00434BD8 SetUnhandledExceptionFilter,	31_2_00434BD8
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 31_2_022452A3 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	31_2_022452A3
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 31_2_02244CF1 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	31_2_02244CF1
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: 31_2_0224BDD8 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	31_2_0224BDD8

Source: C:\Users\user\Desktop\documents-pdf.exe	Code function: GetCurrentProcessId,OpenMutexA,CloseHandle,CreateThread,CloseHandle,Sleep,OpenProcess, svchost.exe	0_2_00412132
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: GetCurrentProcessId,OpenMutexA,CloseHandle,CreateThread,CloseHandle,Sleep,OpenProcess, svchost.exe	16_2_00412132
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: GetCurrentProcessId,OpenMutexA,CloseHandle,CreateThread,CloseHandle,Sleep,OpenProcess, svchost.exe	31_2_00412132

Source: C:\Users\user\Desktop\documents-pdf.exe

Code function: 0_2_00419662 mouse_event,

0_2_00419662

Source: C:\Users\user\Desktop\documents-pdf.exe

Process created: C:\Users\user\AppData\Roaming\yava_explore.exe "C:\Users\user\AppData\Roaming\yava_explore.exe"

Source: C:\Users\user\Desktop\documents-pdf.exe

Code function: 0_2_00434CB6 cpuid

0_2_00434CB6

Source: C:\Users\user\Desktop\documents-pdf.exe	Code function: EnumSystemLocalesW,	0_2_0045201B
Source: C:\Users\user\Desktop\documents-pdf.exe	Code function: EnumSystemLocalesW,	0_2_004520B6
Source: C:\Users\user\Desktop\documents-pdf.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	0_2_00452143
Source: C:\Users\user\Desktop\documents-pdf.exe	Code function: GetLocaleInfoW,	0_2_00452393
Source: C:\Users\user\Desktop\documents-pdf.exe	Code function: EnumSystemLocalesW,	0_2_00448484
Source: C:\Users\user\Desktop\documents-pdf.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_004524BC
Source: C:\Users\user\Desktop\documents-pdf.exe	Code function: GetLocaleInfoW,	0_2_004525C3
Source: C:\Users\user\Desktop\documents-pdf.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_00452690
Source: C:\Users\user\Desktop\documents-pdf.exe	Code function: GetLocaleInfoW,	0_2_0044896D
Source: C:\Users\user\Desktop\documents-pdf.exe	Code function: GetLocaleInfoA,	0_2_0040F90C
Source: C:\Users\user\Desktop\documents-pdf.exe	Code function: IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,	0_2_00451D58
Source: C:\Users\user\Desktop\documents-pdf.exe	Code function: EnumSystemLocalesW,	0_2_00451FD0
Source: C:\Users\user\Desktop\documents-pdf.exe	Code function: EnumSystemLocalesW,	0_2_008A2282
Source: C:\Users\user\Desktop\documents-pdf.exe	Code function: EnumSystemLocalesW,	0_2_008A2237
Source: C:\Users\user\Desktop\documents-pdf.exe	Code function: EnumSystemLocalesW,	0_2_008A231D
Source: C:\Users\user\Desktop\documents-pdf.exe	Code function: GetLocaleInfoW,	0_2_008A25FA
Source: C:\Users\user\Desktop\documents-pdf.exe	Code function: EnumSystemLocalesW,	0_2_008986EB
Source: C:\Users\user\Desktop\documents-pdf.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_008A2723
Source: C:\Users\user\Desktop\documents-pdf.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_008A28F7
Source: C:\Users\user\Desktop\documents-pdf.exe	Code function: GetLocaleInfoW,	0_2_008A282A
Source: C:\Users\user\Desktop\documents-pdf.exe	Code function: GetLocaleInfoW,	0_2_00898BD4
Source: C:\Users\user\Desktop\documents-pdf.exe	Code function: GetLocaleInfoA,	0_2_0085FB73
Source: C:\Users\user\Desktop\documents-pdf.exe	Code function: IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,	0_2_008A1FBF
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: EnumSystemLocalesW,	16_2_0045201B
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: EnumSystemLocalesW,	16_2_004520B6
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	16_2_00452143
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: GetLocaleInfoW,	16_2_00452393
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: EnumSystemLocalesW,	16_2_00448484
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	16_2_004524BC
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: GetLocaleInfoW,	16_2_004525C3
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	16_2_00452690
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: GetLocaleInfoW,	16_2_0044896D
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: GetLocaleInfoA,	16_2_0040F90C
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,	16_2_00451D58
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: EnumSystemLocalesW,	16_2_00451FD0
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: EnumSystemLocalesW,	16_2_021F2237
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: EnumSystemLocalesW,	16_2_021F2282
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: EnumSystemLocalesW,	16_2_021F231D
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: EnumSystemLocalesW,	16_2_021E86EB
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	16_2_021F2723
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: GetLocaleInfoW,	16_2_021F25FA
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: GetLocaleInfoA,	16_2_021AFB73
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: GetLocaleInfoW,	16_2_021E8BD4
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: GetLocaleInfoW,	16_2_021F282A
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	16_2_021F28F7
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,	16_2_021F1FBF
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: EnumSystemLocalesW,	31_2_0045201B
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: EnumSystemLocalesW,	31_2_004520B6
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	31_2_00452143
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: GetLocaleInfoW,	31_2_00452393
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: EnumSystemLocalesW,	31_2_00448484
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	31_2_004524BC
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: GetLocaleInfoW,	31_2_004525C3
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	31_2_00452690
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: GetLocaleInfoW,	31_2_0044896D
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: GetLocaleInfoA,	31_2_0040F90C
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,	31_2_00451D58
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: EnumSystemLocalesW,	31_2_00451FD0
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: EnumSystemLocalesW,	31_2_02262237
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: EnumSystemLocalesW,	31_2_02262282
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: EnumSystemLocalesW,	31_2_0226231D
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: EnumSystemLocalesW,	31_2_022586EB
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	31_2_02262723
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: GetLocaleInfoW,	31_2_022625FA
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: GetLocaleInfoA,	31_2_0221FB73
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: GetLocaleInfoW,	31_2_02258BD4
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: GetLocaleInfoW,	31_2_0226282A
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	31_2_022628F7
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,	31_2_02261FBF

Source: C:\Users\user\Desktop\documents-pdf.exe

Code function: 0_2_0041A045 __EH_prolog,73C35D90,CreateDirectoryW,Sleep,Sleep,GetLocalTime,Sleep,

0_2_0041A045

Source: C:\Users\user\Desktop\documents-pdf.exe

Code function: 0_2_0041B69E GetComputerNameExW,GetUserNameW,

0_2_0041B69E

Source: C:\Users\user\Desktop\documents-pdf.exe

Code function: 0_2_00449210 _free,_free,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,_free,

0_2_00449210

Source: C:\Users\user\AppData\Roaming\yava_explore.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Source: Amcache.hve.3.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.3.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.3.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.3.dr	Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information

Contains functionality to steal Chrome passwords or cookies

Source: Yara match	File source: 16.2.yava_explore.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.2.yava_explore.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.2.yava_explore.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.yava_explore.exe.21a0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.3.yava_explore.exe.2290000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.2.yava_explore.exe.2210e67.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.yava_explore.exe.21a0e67.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.documents-pdf.exe.850e67.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.3.yava_explore.exe.2220000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.3.yava_explore.exe.2290000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.documents-pdf.exe.850e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.documents-pdf.exe.22c0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.documents-pdf.exe.22c0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.2.yava_explore.exe.2210e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.3.yava_explore.exe.2220000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.documents-pdf.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.documents-pdf.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.yava_explore.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000010.00000002.4507176842.000000000081D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.4507176842.0000000000828000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2128430234.0000000000981000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000002.2190470825.00000000006C0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2038922031.00000000022C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000003.2174054334.0000000002290000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2127973802.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000002.2190120515.0000000000400000.00000040.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000002.2190598574.0000000002210000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000003.2103257618.0000000002220000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.4507281694.00000000021A0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2128264560.0000000000850000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.4506857118.0000000000400000.00000040.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: documents-pdf.exe PID: 4508, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: yava_explore.exe PID: 5080, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: yava_explore.exe PID: 5744, type: MEMORYSTR

Source: C:\Users\user\Desktop\documents-pdf.exe	Code function: \AppData\Local\Google\Chrome\User Data\Default\Login Data	0_2_0040BA4D
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: \AppData\Local\Google\Chrome\User Data\Default\Login Data	16_2_0040BA4D
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: \AppData\Local\Google\Chrome\User Data\Default\Login Data	31_2_0040BA4D

Contains functionality to steal Firefox passwords or cookies

Source: C:\Users\user\Desktop\documents-pdf.exe	Code function: \AppData\Roaming\Mozilla\Firefox\Profiles\	0_2_0040BB6B
Source: C:\Users\user\Desktop\documents-pdf.exe	Code function: \key3.db	0_2_0040BB6B
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: \AppData\Roaming\Mozilla\Firefox\Profiles\	16_2_0040BB6B
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: \key3.db	16_2_0040BB6B
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: \AppData\Roaming\Mozilla\Firefox\Profiles\	31_2_0040BB6B
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: \key3.db	31_2_0040BB6B

Remote Access Functionality

Detected Remcos RAT

Source: C:\Users\user\Desktop\documents-pdf.exe	Mutex created: \Sessions\1\BaseNamedObjects\Rmc-AYRCHN	Jump to behavior
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Mutex created: \Sessions\1\BaseNamedObjects\Rmc-AYRCHN
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Mutex created: \Sessions\1\BaseNamedObjects\Rmc-AYRCHN

Source: Yara match	File source: 16.2.yava_explore.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.2.yava_explore.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.2.yava_explore.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.yava_explore.exe.21a0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.3.yava_explore.exe.2290000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.2.yava_explore.exe.2210e67.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.yava_explore.exe.21a0e67.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.documents-pdf.exe.850e67.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.3.yava_explore.exe.2220000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.3.yava_explore.exe.2290000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.documents-pdf.exe.850e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.documents-pdf.exe.22c0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.documents-pdf.exe.22c0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.2.yava_explore.exe.2210e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.3.yava_explore.exe.2220000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.documents-pdf.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.documents-pdf.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.yava_explore.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000010.00000002.4507176842.000000000081D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.4507176842.0000000000828000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2128430234.0000000000981000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000002.2190470825.00000000006C0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2038922031.00000000022C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000003.2174054334.0000000002290000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2127973802.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000002.2190120515.0000000000400000.00000040.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000002.2190598574.0000000002210000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000003.2103257618.0000000002220000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.4507281694.00000000021A0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2128264560.0000000000850000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.4506857118.0000000000400000.00000040.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: documents-pdf.exe PID: 4508, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: yava_explore.exe PID: 5080, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: yava_explore.exe PID: 5744, type: MEMORYSTR

Source: C:\Users\user\Desktop\documents-pdf.exe	Code function: cmd.exe	0_2_0040569A
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: cmd.exe	16_2_0040569A
Source: C:\Users\user\AppData\Roaming\yava_explore.exe	Code function: cmd.exe	31_2_0040569A

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	1 OS Credential Dumping	2 System Time Discovery	Remote Services	11 Archive Collected Data	11 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	12 Command and Scripting Interpreter	1 Windows Service	1 Bypass User Account Control	3 Obfuscated Files or Information	111 Input Capture	1 Account Discovery	Remote Desktop Protocol	111 Input Capture	2 Encrypted Channel	Exfiltration Over Bluetooth	1 Defacement
Email Addresses	DNS Server	Domain Accounts	2 Service Execution	11 Registry Run Keys / Startup Folder	1 Access Token Manipulation	12 Software Packing	2 Credentials In Files	1 System Service Discovery	SMB/Windows Admin Shares	3 Clipboard Data	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 Windows Service	1 DLL Side-Loading	NTDS	3 File and Directory Discovery	Distributed Component Object Model	Input Capture	1 Remote Access Software	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	21 Process Injection	1 Bypass User Account Control	LSA Secrets	23 System Information Discovery	SSH	Keylogging	1 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	11 Registry Run Keys / Startup Folder	1 Masquerading	Cached Domain Credentials	141 Security Software Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	2 Virtualization/Sandbox Evasion	DCSync	2 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Access Token Manipulation	Proc Filesystem	1 Process Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	21 Process Injection	/etc/passwd and /etc/shadow	1 Application Window Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	Dynamic API Resolution	Network Sniffing	1 System Owner/User Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
documents-pdf.exe	76%	ReversingLabs	Win32.Backdoor.Remcos
documents-pdf.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\yava_explore.exe	76%	ReversingLabs	Win32.Backdoor.Remcos

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://upx.sf.net	0%	URL Reputation	safe
http://geoplugin.net/json.gp/C	0%	Avira URL Cloud	safe
198.23.227.212	0%	Avira URL Cloud	safe
http://geoplugin.net/json.gp	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

⊘No contacted domains info

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
198.23.227.212	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://geoplugin.net/json.gp	yava_explore.exe	false	Avira URL Cloud: safe	unknown
http://upx.sf.net	Amcache.hve.3.dr	false	URL Reputation: safe	unknown
http://geoplugin.net/json.gp/C	documents-pdf.exe, 00000000.00000002.2127973802.0000000000400000.00000040.00000001.01000000.00000003.sdmp, documents-pdf.exe, 00000000.00000003.2038922031.00000000022C0000.00000004.00001000.00020000.00000000.sdmp, documents-pdf.exe, 00000000.00000002.2128264560.0000000000850000.00000040.00001000.00020000.00000000.sdmp, yava_explore.exe, 00000010.00000002.4506857118.0000000000400000.00000040.00000001.01000000.00000006.sdmp, yava_explore.exe, 00000010.00000003.2103257618.0000000002220000.00000004.00001000.00020000.00000000.sdmp, yava_explore.exe, 00000010.00000002.4507281694.00000000021A0000.00000040.00001000.00020000.00000000.sdmp, yava_explore.exe, 0000001F.00000002.2190598574.0000000002210000.00000040.00001000.00020000.00000000.sdmp, yava_explore.exe, 0000001F.00000003.2174054334.0000000002290000.00000004.00001000.00020000.00000000.sdmp, yava_explore.exe, 0000001F.00000002.2190120515.0000000000400000.00000040.00000001.01000000.00000006.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
198.23.227.212	unknown	United States		36352	AS-COLOCROSSINGUS	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1513854
Start date and time:	2024-09-19 14:51:36 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 52s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	40
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	documents-pdf.exe
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winEXE@21/71@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 97% Number of executed functions: 16 Number of non-executed functions: 395
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WerFault.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 20.42.65.92, 20.42.73.29, 20.189.173.21
Excluded domains from analysis (whitelisted): onedsblobprdeus17.eastus.cloudapp.azure.com, ocsp.digicert.com, login.live.com, slscr.update.microsoft.com, blobcollector.events.data.trafficmanager.net, onedsblobprdeus15.eastus.cloudapp.azure.com, onedsblobprdwus16.westus.cloudapp.azure.com, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: documents-pdf.exe

Simulations

Behavior and APIs

Time	Type	Description
08:52:35	API Interceptor	2x Sleep call for process: WerFault.exe modified
08:53:11	API Interceptor	2987568x Sleep call for process: yava_explore.exe modified
14:52:30	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run Rmc-AYRCHN "C:\Users\user\AppData\Roaming\yava_explore.exe"
14:52:39	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run Rmc-AYRCHN "C:\Users\user\AppData\Roaming\yava_explore.exe"

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
198.23.227.212	1kZ9olJiaG.exe	Get hash	malicious	Remcos	Browse
198.23.227.212	ltlbVjClX9.exe	Get hash	malicious	Remcos	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AS-COLOCROSSINGUS	12hLshsAaV.elf	Get hash	malicious	Unknown	Browse	104.168.50.203
	file.exe	Get hash	malicious	Metasploit	Browse	23.95.197.200
	SecuriteInfo.com.Exploit.CVE-2017-11882.123.24943.32494.rtf	Get hash	malicious	Unknown	Browse	198.23.133.156
	17265825068238c1f4fae0310a1dd9b487dd8dd6291b4cd61b7c813cd66f4593f2833d6c21905.dat-decoded.exe	Get hash	malicious	Remcos	Browse	192.3.101.29
	RFQ PO-DF9087.vbs	Get hash	malicious	Remcos	Browse	192.3.101.29
	PO_NODF9087.vbs	Get hash	malicious	Remcos, PureLog Stealer	Browse	198.23.133.156
	PO_NODF9087.xla.xlsx	Get hash	malicious	Remcos, PureLog Stealer	Browse	198.23.133.156
	RFQ#TLPO15-13.xla.xlsx	Get hash	malicious	Remcos, PureLog Stealer	Browse	192.210.214.9
	https://97169.top/	Get hash	malicious	Unknown	Browse	107.173.70.90
	PO#4502968189 Packinglist for confirmation.exe	Get hash	malicious	RedLine	Browse	198.12.90.244

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_documents-pdf.ex_132c3f90c2427e70c3b414f4ab5d681b4335ce7d_7df187e0_632309ac-9270-43d4-b5ff-a44cd2199b4b\Report.wer

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.030596394938332
Encrypted:	false
SSDEEP:	192:gAvvg5sFu/Dn0GQzujueZrBBRdzuiFpZ24IO8z:FFFu/D0GQzujnzuiFpY4IO8z
MD5:	7751F17CAAE67576CC464442B3BC1B7B
SHA1:	3D71852D4E4E4C123636E4A3007EE89C66909503
SHA-256:	5663BD9294065102A13457A53A6A46FAB5FC3049790EB10B12DB5385D5B4A83E
SHA-512:	029A4D51E5561CEDEA0416A074D60D95CE719C8F22AAF2BF54F169514FF3C652442121FA9D5B3DF316488A8DDC2F76FB0E61E28A75E13EF9600629C521616B25
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.1.2.2.3.9.5.2.8.9.4.4.0.4.4.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.1.2.2.3.9.5.3.3.1.6.2.9.5.1.....R.e.p.o.r.t.S.t.a.t.u.s.=.6.5.5.4.5.6.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.6.3.2.3.0.9.a.c.-.9.2.7.0.-.4.3.d.4.-.b.5.f.f.-.a.4.4.c.d.2.1.9.9.b.4.b.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.d.7.e.5.4.1.7.7.-.7.6.9.f.-.4.a.9.b.-.9.9.2.5.-.c.5.a.8.8.e.c.c.e.f.3.4.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.d.o.c.u.m.e.n.t.s.-.p.d.f...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.1.9.c.-.0.0.0.1.-.0.0.1.4.-.4.7.6.8.-.4.5.c.7.9.2.0.a.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.c.5.7.2.9.0.b.0.c.3.1.9.4.6.3.6.2.2.4.6.d.c.f.f.1.f.7.c.9.b.7.c.0.0.0.0.f.f.f.f.!.0.0.0.0.4.6.1.0.f.e.6.9.4.c.6.c.7.9.6.e.d.9.a.b.5.c.c.7.2.9.5.1.9.f.e.3.c.1.f.a.7.6.2.9.!.d.o.c.u.m.e.n.t.s.-.p.d.f...e.x.e.....T.a.r.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_documents-pdf.ex_cfc80c997f25668d2898d056462f899fb8aa28_7df187e0_32e697fb-0b74-4f85-8b05-6875d218da58\Report.wer

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9505307192633504
Encrypted:	false
SSDEEP:	192:wY4H5sRu/b/g056rwjueZrB4zuiFpZ24IO8z:wY4yRu/b/756rwjyzuiFpY4IO8z
MD5:	E96D6746A6590D74BC8BA5D4D35E1142
SHA1:	A46AF1B48A25E5B682A3AB6563935C04D3B3F31B
SHA-256:	5ABBBAF10AEAEE143826A822B3A799CB2997A38B176E9CE9A1771BC3DC6EE2D7
SHA-512:	E81AADA86ED3AB8C86E2B587267B297D03421106F9DBF412ACA7E9C56A94E6CD4E0CC138F4473BC9E97464540C7D126B3C9CC0F2FC5BDFDECE128766655450B3
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.1.2.2.3.9.4.8.0.9.7.7.3.2.0.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.3.2.e.6.9.7.f.b.-.0.b.7.4.-.4.f.8.5.-.8.b.0.5.-.6.8.7.5.d.2.1.8.d.a.5.8.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.7.5.b.f.b.1.b.6.-.b.b.7.f.-.4.e.8.c.-.b.6.4.6.-.8.0.b.9.8.f.8.0.5.5.3.8.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.d.o.c.u.m.e.n.t.s.-.p.d.f...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.1.9.c.-.0.0.0.1.-.0.0.1.4.-.4.7.6.8.-.4.5.c.7.9.2.0.a.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.c.5.7.2.9.0.b.0.c.3.1.9.4.6.3.6.2.2.4.6.d.c.f.f.1.f.7.c.9.b.7.c.0.0.0.0.f.f.f.f.!.0.0.0.0.4.6.1.0.f.e.6.9.4.c.6.c.7.9.6.e.d.9.a.b.5.c.c.7.2.9.5.1.9.f.e.3.c.1.f.a.7.6.2.9.!.d.o.c.u.m.e.n.t.s.-.p.d.f...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.0.9././.0.3.:.1.4.:.3.2.:.0.3.!.0.!.d.o.c.u.m.e.n.t.s.-.p.d.f...e.x.e...

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_documents-pdf.ex_cfc80c997f25668d2898d056462f899fb8aa28_7df187e0_3b632368-c7d3-462f-82e8-be7604c5b2ed\Report.wer

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9501496910680404
Encrypted:	false
SSDEEP:	192:R5sGu/b/g056rwjueZrB4zuiFpZ24IO8z:EGu/b/756rwjyzuiFpY4IO8z
MD5:	60C147624B84971E75AA3D284834B6F4
SHA1:	C6FF387CEC53E3EFCBA8481F99998A072213797C
SHA-256:	04705D264F6CAE2E3AF7F564E762F5C4FF77E6DC7CD0CA0A208282EB20FD761D
SHA-512:	0CDDA98C5582F6B95DAF31D03E6D82655D34D40DD8C28ADFC69EB4EC94483DC96798DEC68D46FB6ACBBF010FD4E9813BAB84AA87D48B2F918275870191B992D4
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.1.2.2.3.9.5.1.6.7.1.6.0.4.2.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.3.b.6.3.2.3.6.8.-.c.7.d.3.-.4.6.2.f.-.8.2.e.8.-.b.e.7.6.0.4.c.5.b.2.e.d.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.1.b.0.6.e.e.f.b.-.0.5.e.3.-.4.c.7.c.-.a.e.9.0.-.5.c.1.4.4.3.0.8.8.c.9.7.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.d.o.c.u.m.e.n.t.s.-.p.d.f...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.1.9.c.-.0.0.0.1.-.0.0.1.4.-.4.7.6.8.-.4.5.c.7.9.2.0.a.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.c.5.7.2.9.0.b.0.c.3.1.9.4.6.3.6.2.2.4.6.d.c.f.f.1.f.7.c.9.b.7.c.0.0.0.0.f.f.f.f.!.0.0.0.0.4.6.1.0.f.e.6.9.4.c.6.c.7.9.6.e.d.9.a.b.5.c.c.7.2.9.5.1.9.f.e.3.c.1.f.a.7.6.2.9.!.d.o.c.u.m.e.n.t.s.-.p.d.f...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.0.9././.0.3.:.1.4.:.3.2.:.0.3.!.0.!.d.o.c.u.m.e.n.t.s.-.p.d.f...e.x.e...

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_documents-pdf.ex_cfc80c997f25668d2898d056462f899fb8aa28_7df187e0_6f80c5e1-745a-4e67-a7e5-2d55bf65bea9\Report.wer

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9367508089403652
Encrypted:	false
SSDEEP:	192:Vdb5snu/b/g056rwjueZrBxzuiFpZ24IO8z:Vd+nu/b/756rwjbzuiFpY4IO8z
MD5:	04DEADA1C670CA3780BB155C49B4D4F3
SHA1:	0547135936C529CBB28CABB12B6B3C8F7D87D7D8
SHA-256:	3FA7B9A30EE2628B256CB643EA4EC206730468970D6081662B8700347F28DC8F
SHA-512:	28EF1E367D39D499EB2BBA6F4168ACA2B3202DB76E5EC1BE571BAB281B00A7AC19D91A884DC4B76756278DF58EF10EA52DE0DCEB25273A88BD5A25EF20121CBE
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.1.2.2.3.9.4.7.0.5.6.8.3.5.4.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.6.f.8.0.c.5.e.1.-.7.4.5.a.-.4.e.6.7.-.a.7.e.5.-.2.d.5.5.b.f.6.5.b.e.a.9.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.7.d.5.7.1.4.7.d.-.8.4.8.8.-.4.4.2.d.-.b.3.8.9.-.b.3.6.d.0.3.5.3.2.c.c.9.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.d.o.c.u.m.e.n.t.s.-.p.d.f...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.1.9.c.-.0.0.0.1.-.0.0.1.4.-.4.7.6.8.-.4.5.c.7.9.2.0.a.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.c.5.7.2.9.0.b.0.c.3.1.9.4.6.3.6.2.2.4.6.d.c.f.f.1.f.7.c.9.b.7.c.0.0.0.0.f.f.f.f.!.0.0.0.0.4.6.1.0.f.e.6.9.4.c.6.c.7.9.6.e.d.9.a.b.5.c.c.7.2.9.5.1.9.f.e.3.c.1.f.a.7.6.2.9.!.d.o.c.u.m.e.n.t.s.-.p.d.f...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.0.9././.0.3.:.1.4.:.3.2.:.0.3.!.0.!.d.o.c.u.m.e.n.t.s.-.p.d.f...e.x.e...

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_documents-pdf.ex_cfc80c997f25668d2898d056462f899fb8aa28_7df187e0_8e65b51d-8cf7-49c7-800e-1c2970e61967\Report.wer

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9504441605903092
Encrypted:	false
SSDEEP:	192:YY5sIu/b/g056rwjueZrB4zuiFpZ24IO8z:QIu/b/756rwjyzuiFpY4IO8z
MD5:	3BE85DC98B012C7EE4AE5D71364EFF8F
SHA1:	721B0C73578E57C38280C9D9062A74E6A7295C7A
SHA-256:	87836A674DD9DD24351EE48100B6AF6581D65935E9306E01FCD7515E3E2766AC
SHA-512:	E09309B073675538128F56F5F27CB35295B8099F0BF5C8EDAFB791023317F02A0E9AE96B5209E183F91815E63D3EF6833DCB700B25F0CC8684139D24A653A2DF
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.1.2.2.3.9.5.2.2.4.4.9.4.2.5.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.8.e.6.5.b.5.1.d.-.8.c.f.7.-.4.9.c.7.-.8.0.0.e.-.1.c.2.9.7.0.e.6.1.9.6.7.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.9.3.d.c.2.c.2.2.-.a.1.5.6.-.4.5.2.b.-.8.6.6.1.-.5.6.9.1.0.b.3.4.f.1.1.7.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.d.o.c.u.m.e.n.t.s.-.p.d.f...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.1.9.c.-.0.0.0.1.-.0.0.1.4.-.4.7.6.8.-.4.5.c.7.9.2.0.a.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.c.5.7.2.9.0.b.0.c.3.1.9.4.6.3.6.2.2.4.6.d.c.f.f.1.f.7.c.9.b.7.c.0.0.0.0.f.f.f.f.!.0.0.0.0.4.6.1.0.f.e.6.9.4.c.6.c.7.9.6.e.d.9.a.b.5.c.c.7.2.9.5.1.9.f.e.3.c.1.f.a.7.6.2.9.!.d.o.c.u.m.e.n.t.s.-.p.d.f...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.0.9././.0.3.:.1.4.:.3.2.:.0.3.!.0.!.d.o.c.u.m.e.n.t.s.-.p.d.f...e.x.e...

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_documents-pdf.ex_cfc80c997f25668d2898d056462f899fb8aa28_7df187e0_b85bd28c-fc1d-4f9b-b7a4-3c5ec333f682\Report.wer

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9500659452611556
Encrypted:	false
SSDEEP:	192:/15siu/b/g056rwjueZrB4zuiFpZ24IO8z:Yiu/b/756rwjyzuiFpY4IO8z
MD5:	FDF17C5E3722879A85BF231C1FDCAB0F
SHA1:	74A80A56A75C355E04AE872CCD084C439F58280B
SHA-256:	21A994E9E63DAB729607366E1BCCCA5A12965BB2BA2CF42D8A32B2B8E066479A
SHA-512:	22011C67ACA77D474B9FA3D37DDD4B51EE61527BE3132115AB46CCFC503811B3F35F1F33A0C23120430C9BCB9B1D7F3B8D21991E8BF2A4056E0D7FE61EE81962
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.1.2.2.3.9.4.9.7.9.0.4.7.7.9.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.b.8.5.b.d.2.8.c.-.f.c.1.d.-.4.f.9.b.-.b.7.a.4.-.3.c.5.e.c.3.3.3.f.6.8.2.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.6.0.2.7.5.d.c.8.-.4.a.4.0.-.4.8.4.2.-.8.3.d.d.-.8.f.a.0.5.f.d.e.0.f.9.7.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.d.o.c.u.m.e.n.t.s.-.p.d.f...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.1.9.c.-.0.0.0.1.-.0.0.1.4.-.4.7.6.8.-.4.5.c.7.9.2.0.a.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.c.5.7.2.9.0.b.0.c.3.1.9.4.6.3.6.2.2.4.6.d.c.f.f.1.f.7.c.9.b.7.c.0.0.0.0.f.f.f.f.!.0.0.0.0.4.6.1.0.f.e.6.9.4.c.6.c.7.9.6.e.d.9.a.b.5.c.c.7.2.9.5.1.9.f.e.3.c.1.f.a.7.6.2.9.!.d.o.c.u.m.e.n.t.s.-.p.d.f...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.0.9././.0.3.:.1.4.:.3.2.:.0.3.!.0.!.d.o.c.u.m.e.n.t.s.-.p.d.f...e.x.e...

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_documents-pdf.ex_cfc80c997f25668d2898d056462f899fb8aa28_7df187e0_bcf8e420-8032-401a-a331-87184cff83cf\Report.wer

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9504062272490045
Encrypted:	false
SSDEEP:	192:TK5s7u/b/g056rwjueZrB4zuiFpZ24IO8z:L7u/b/756rwjyzuiFpY4IO8z
MD5:	76DAFC83A8B9AEDEF6E792CB3FB0C5D1
SHA1:	BA29068127D13373E30F2B46453BBEEA2DE6E159
SHA-256:	C2D7B688F409AFDDADEB2A21F269A1630251229495435759271A4A0035A2AC7A
SHA-512:	5D85569531BE21241AF8C0F060592C0E749E5088EC58BB2D607C1A8905C8CA0373BF476C2374BA2F61741ACF15C70B5BB9B9D582AEE4BB62B50350889DE12B50
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.1.2.2.3.9.5.0.3.9.0.8.5.7.3.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.b.c.f.8.e.4.2.0.-.8.0.3.2.-.4.0.1.a.-.a.3.3.1.-.8.7.1.8.4.c.f.f.8.3.c.f.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.4.1.c.6.3.3.3.0.-.b.1.4.e.-.4.b.2.7.-.b.6.4.8.-.8.d.f.2.6.d.1.4.9.4.c.9.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.d.o.c.u.m.e.n.t.s.-.p.d.f...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.1.9.c.-.0.0.0.1.-.0.0.1.4.-.4.7.6.8.-.4.5.c.7.9.2.0.a.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.c.5.7.2.9.0.b.0.c.3.1.9.4.6.3.6.2.2.4.6.d.c.f.f.1.f.7.c.9.b.7.c.0.0.0.0.f.f.f.f.!.0.0.0.0.4.6.1.0.f.e.6.9.4.c.6.c.7.9.6.e.d.9.a.b.5.c.c.7.2.9.5.1.9.f.e.3.c.1.f.a.7.6.2.9.!.d.o.c.u.m.e.n.t.s.-.p.d.f...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.0.9././.0.3.:.1.4.:.3.2.:.0.3.!.0.!.d.o.c.u.m.e.n.t.s.-.p.d.f...e.x.e...

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_documents-pdf.ex_cfc80c997f25668d2898d056462f899fb8aa28_7df187e0_ea881abb-e09c-4ac1-a496-7fb64dca8163\Report.wer

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	modified
Size (bytes):	65536
Entropy (8bit):	0.950416810148443
Encrypted:	false
SSDEEP:	192:r8y5s3u/b/g056rwjueZrB4zuiFpZ24IO8z:YX3u/b/756rwjyzuiFpY4IO8z
MD5:	6618E8059643DBF95FD683E1A46C38EC
SHA1:	74A89E24F5BC62BF2363CF458DFAEF85BFF394EF
SHA-256:	7A61310E95DD2FC58E5683D658E16D9A56EF776438B5DDA846CFE35733C6F39B
SHA-512:	57955C6E5CBFD00907612F3F0AF9C2790414A2E34BFB1856CD8448F4F38ED355A207998F8C2D9F7564EC3E041E754B2C4F1D3F2E564F389C7729D821FBA1DF8D
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.1.2.2.3.9.4.9.1.9.8.9.6.5.8.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.e.a.8.8.1.a.b.b.-.e.0.9.c.-.4.a.c.1.-.a.4.9.6.-.7.f.b.6.4.d.c.a.8.1.6.3.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.e.4.a.5.7.4.4.b.-.1.5.1.9.-.4.6.0.1.-.b.5.2.d.-.5.d.6.2.e.7.1.5.c.2.d.1.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.d.o.c.u.m.e.n.t.s.-.p.d.f...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.1.9.c.-.0.0.0.1.-.0.0.1.4.-.4.7.6.8.-.4.5.c.7.9.2.0.a.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.c.5.7.2.9.0.b.0.c.3.1.9.4.6.3.6.2.2.4.6.d.c.f.f.1.f.7.c.9.b.7.c.0.0.0.0.f.f.f.f.!.0.0.0.0.4.6.1.0.f.e.6.9.4.c.6.c.7.9.6.e.d.9.a.b.5.c.c.7.2.9.5.1.9.f.e.3.c.1.f.a.7.6.2.9.!.d.o.c.u.m.e.n.t.s.-.p.d.f...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.0.9././.0.3.:.1.4.:.3.2.:.0.3.!.0.!.d.o.c.u.m.e.n.t.s.-.p.d.f...e.x.e...

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_yava_explore.exe_63b09e81eb74d74ed64ff798a792a6b387e13_21dfad5a_05b7cfa4-2c95-4af2-a3df-8e61b0d16ac2\Report.wer

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9179198987342558
Encrypted:	false
SSDEEP:	192:n5bu5I/p/g0JsAnbcA/jueZr3uzuiFpZ24IO8N:U5I/p/7JsAnbcA/jyzuiFpY4IO8N
MD5:	44A19BFAD682153E792BAAAA118FFEEC
SHA1:	2A92F1FD9F7F56851656ECAF04652C2EDE3C8DA7
SHA-256:	6A2DBECC757B86941EBDCACE0A2C5B9B068C0ED187C29B509CBF04D7C5365075
SHA-512:	6CD85CE763FDEEAA5AA7F7A9A8313A79AFC6A001B90BA5DD9957983339663CBA888DD988CB1BA4EDCEEE7EB2ED939FDAF4ACC02E781F4DD2254A8D00B93E468A
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.1.2.2.3.9.6.0.5.9.5.8.3.5.8.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.0.5.b.7.c.f.a.4.-.2.c.9.5.-.4.a.f.2.-.a.3.d.f.-.8.e.6.1.b.0.d.1.6.a.c.2.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.f.4.6.0.f.1.7.e.-.a.7.7.8.-.4.5.1.0.-.9.9.3.f.-.3.c.d.3.3.0.a.a.1.6.d.8.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.y.a.v.a._.e.x.p.l.o.r.e...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.3.d.8.-.0.0.0.1.-.0.0.1.4.-.8.4.c.d.-.1.b.c.b.9.2.0.a.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.f.d.f.7.b.f.c.9.3.d.7.9.1.e.9.a.0.e.a.7.3.4.b.f.9.c.5.6.e.8.3.7.0.0.0.0.f.f.f.f.!.0.0.0.0.4.6.1.0.f.e.6.9.4.c.6.c.7.9.6.e.d.9.a.b.5.c.c.7.2.9.5.1.9.f.e.3.c.1.f.a.7.6.2.9.!.y.a.v.a._.e.x.p.l.o.r.e...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.0.9././.0.3.:.1.4.:.3.2.:.0.3.!.0.!.y.a.v.a._.e.x.p.l.o.r.e...e.x.e.....B.o.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_yava_explore.exe_63b09e81eb74d74ed64ff798a792a6b387e13_21dfad5a_106c26f9-3440-48b4-9afb-29c0121e8f8f\Report.wer

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9179600375158241
Encrypted:	false
SSDEEP:	192:ubuvI/p/g0JsAnbcA/jueZr3uzuiFpZ24IO8N:zvI/p/7JsAnbcA/jyzuiFpY4IO8N
MD5:	C694A173B05AF6D1A5097EE0F839ED7A
SHA1:	AB01305CD1D783AE8C3086282D7ED472A779B225
SHA-256:	647C174AFEC944F155FD2DB3E3E8331363DF64687B36A03FBFA4C16364B2ADE6
SHA-512:	BC8FC35D93CC6B3D98595BE84A5DA052539E861A9A0A045D703D32F832E6E5C89152F7935A42A90C87EDD0D27049CE4BD132C9909251869E900E977A5AA96C2A
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.1.2.2.3.9.5.5.3.9.6.2.1.9.5.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.1.0.6.c.2.6.f.9.-.3.4.4.0.-.4.8.b.4.-.9.a.f.b.-.2.9.c.0.1.2.1.e.8.f.8.f.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.7.1.3.9.2.9.8.4.-.5.d.0.0.-.4.1.8.e.-.a.b.8.6.-.1.5.8.a.a.8.3.d.7.9.9.6.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.y.a.v.a._.e.x.p.l.o.r.e...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.3.d.8.-.0.0.0.1.-.0.0.1.4.-.8.4.c.d.-.1.b.c.b.9.2.0.a.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.f.d.f.7.b.f.c.9.3.d.7.9.1.e.9.a.0.e.a.7.3.4.b.f.9.c.5.6.e.8.3.7.0.0.0.0.f.f.f.f.!.0.0.0.0.4.6.1.0.f.e.6.9.4.c.6.c.7.9.6.e.d.9.a.b.5.c.c.7.2.9.5.1.9.f.e.3.c.1.f.a.7.6.2.9.!.y.a.v.a._.e.x.p.l.o.r.e...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.0.9././.0.3.:.1.4.:.3.2.:.0.3.!.0.!.y.a.v.a._.e.x.p.l.o.r.e...e.x.e.....B.o.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_yava_explore.exe_63b09e81eb74d74ed64ff798a792a6b387e13_21dfad5a_49e135d9-074a-4553-bbaa-0a20f494e2fd\Report.wer

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.917920369082621
Encrypted:	false
SSDEEP:	192:pbuPI/p/g056rQjueZr3uzuiFpZ24IO8N:EPI/p/756rQjyzuiFpY4IO8N
MD5:	FD3FDE65436CE407FBAA32D5FB3C23B0
SHA1:	B2B0B05C7D17695A8E2E000B79F501A367A433A0
SHA-256:	D54BADC0EC5C8C748B92166F3DA91E9495403413D75C66DB263617C44F1B06DD
SHA-512:	4D1826ECEA386149ED2B1F5D5939AC91004383D148E299684D17E13BB1DDD902432542583EC7F9071DD1F6328C78D6EE8E2A78904F07DA50A607403EEECBD47A
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.1.2.2.3.9.5.8.9.7.0.1.9.8.2.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.4.9.e.1.3.5.d.9.-.0.7.4.a.-.4.5.5.3.-.b.b.a.a.-.0.a.2.0.f.4.9.4.e.2.f.d.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.6.4.9.5.c.8.c.c.-.3.6.4.a.-.4.d.9.1.-.8.8.b.5.-.2.5.6.5.e.f.8.1.a.6.e.5.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.y.a.v.a._.e.x.p.l.o.r.e...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.3.d.8.-.0.0.0.1.-.0.0.1.4.-.8.4.c.d.-.1.b.c.b.9.2.0.a.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.f.d.f.7.b.f.c.9.3.d.7.9.1.e.9.a.0.e.a.7.3.4.b.f.9.c.5.6.e.8.3.7.0.0.0.0.f.f.f.f.!.0.0.0.0.4.6.1.0.f.e.6.9.4.c.6.c.7.9.6.e.d.9.a.b.5.c.c.7.2.9.5.1.9.f.e.3.c.1.f.a.7.6.2.9.!.y.a.v.a._.e.x.p.l.o.r.e...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.0.9././.0.3.:.1.4.:.3.2.:.0.3.!.0.!.y.a.v.a._.e.x.p.l.o.r.e...e.x.e.....B.o.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_yava_explore.exe_63b09e81eb74d74ed64ff798a792a6b387e13_21dfad5a_711d9ba3-8531-4e71-a576-3e2559c71c3c\Report.wer

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9181771530888408
Encrypted:	false
SSDEEP:	192:K2buUI/p/g056rQjueZr3uzuiFpZ24IO8N:KrUI/p/756rQjyzuiFpY4IO8N
MD5:	72D8E3ED8ACADC1EE5390557DB5AD2B2
SHA1:	05695487DDBF721622FC0145CA7F166D1E73843F
SHA-256:	63DE9997D7D5026061113E68DE3968821372792C59D2DE2904A5504EDAAA3CB2
SHA-512:	D0E05EC9057A0E5C4F6A95299A81D56F163A7C677946A1B7110434582540682C17C976F40CA54EF0C73F8299E1CAEAC63E7A686E04BCBD06CC761DD1736F5EAE
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.1.2.2.3.9.5.6.6.2.6.6.5.5.9.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.7.1.1.d.9.b.a.3.-.8.5.3.1.-.4.e.7.1.-.a.5.7.6.-.3.e.2.5.5.9.c.7.1.c.3.c.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.d.c.4.f.8.3.5.d.-.0.b.f.4.-.4.4.1.7.-.b.3.e.e.-.d.6.d.8.1.2.a.6.9.7.1.a.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.y.a.v.a._.e.x.p.l.o.r.e...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.3.d.8.-.0.0.0.1.-.0.0.1.4.-.8.4.c.d.-.1.b.c.b.9.2.0.a.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.f.d.f.7.b.f.c.9.3.d.7.9.1.e.9.a.0.e.a.7.3.4.b.f.9.c.5.6.e.8.3.7.0.0.0.0.f.f.f.f.!.0.0.0.0.4.6.1.0.f.e.6.9.4.c.6.c.7.9.6.e.d.9.a.b.5.c.c.7.2.9.5.1.9.f.e.3.c.1.f.a.7.6.2.9.!.y.a.v.a._.e.x.p.l.o.r.e...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.0.9././.0.3.:.1.4.:.3.2.:.0.3.!.0.!.y.a.v.a._.e.x.p.l.o.r.e...e.x.e.....B.o.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_yava_explore.exe_63b09e81eb74d74ed64ff798a792a6b387e13_21dfad5a_845a3808-697b-400b-8eb7-31619b8c9119\Report.wer

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9182417620519555
Encrypted:	false
SSDEEP:	192:cp/bugI/p/g0JsAnbcA/jueZr3uzuiFpZ24IO8N:dgI/p/7JsAnbcA/jyzuiFpY4IO8N
MD5:	2FCB527C3583919A5793375E58FBD8EA
SHA1:	41570BAE7B2648E5108299BAF447CE552635E1C9
SHA-256:	634C1318E5CD8E033D33E5B344F498A5C25732C2A397B2AF6497C4477C63E6B2
SHA-512:	FFCB471E31945765857141F06AC9B40C5F7482575ABFF4313564BAAF68DE1C88E2E5EA15F118FE707D0550FE63526602449A968D71FDA1937A4D985448B12261
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.1.2.2.3.9.5.7.9.3.8.4.3.6.4.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.8.4.5.a.3.8.0.8.-.6.9.7.b.-.4.0.0.b.-.8.e.b.7.-.3.1.6.1.9.b.8.c.9.1.1.9.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.d.3.9.6.3.2.d.5.-.5.9.2.5.-.4.5.1.3.-.9.7.2.9.-.9.8.e.7.6.b.3.2.7.f.e.e.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.y.a.v.a._.e.x.p.l.o.r.e...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.3.d.8.-.0.0.0.1.-.0.0.1.4.-.8.4.c.d.-.1.b.c.b.9.2.0.a.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.f.d.f.7.b.f.c.9.3.d.7.9.1.e.9.a.0.e.a.7.3.4.b.f.9.c.5.6.e.8.3.7.0.0.0.0.f.f.f.f.!.0.0.0.0.4.6.1.0.f.e.6.9.4.c.6.c.7.9.6.e.d.9.a.b.5.c.c.7.2.9.5.1.9.f.e.3.c.1.f.a.7.6.2.9.!.y.a.v.a._.e.x.p.l.o.r.e...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.0.9././.0.3.:.1.4.:.3.2.:.0.3.!.0.!.y.a.v.a._.e.x.p.l.o.r.e...e.x.e.....B.o.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_yava_explore.exe_63b09e81eb74d74ed64ff798a792a6b387e13_21dfad5a_98b554c4-b8cc-476e-90be-4d631e40c114\Report.wer

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9181067266165446
Encrypted:	false
SSDEEP:	192:szbujI/p/g056rQjueZr3uzuiFpZ24IO8N:s+jI/p/756rQjyzuiFpY4IO8N
MD5:	5AC386E8E54634F131495DA1D1B12A1C
SHA1:	3A08382587E59887C1EE0B86B486C15F717525EC
SHA-256:	869DF41EE74D52B4E446172ABD0617791E1B2B6455DF5F1B7F2CFFFF78182F70
SHA-512:	E581AB8993EC506E657FE5DCD9B92B9B08938CF9497BC75223BE6E71AF6AB1D0BCBB2F83B0E1AC328F0826FFFCD80CA4DE984F9017DC48F4F0D4A63A18189168
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.1.2.2.3.9.6.1.6.5.9.1.3.3.1.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.9.8.b.5.5.4.c.4.-.b.8.c.c.-.4.7.6.e.-.9.0.b.e.-.4.d.6.3.1.e.4.0.c.1.1.4.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.a.d.2.7.1.0.7.5.-.9.9.5.9.-.4.e.0.5.-.b.d.d.3.-.8.7.f.a.7.0.5.d.3.b.c.2.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.y.a.v.a._.e.x.p.l.o.r.e...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.3.d.8.-.0.0.0.1.-.0.0.1.4.-.8.4.c.d.-.1.b.c.b.9.2.0.a.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.f.d.f.7.b.f.c.9.3.d.7.9.1.e.9.a.0.e.a.7.3.4.b.f.9.c.5.6.e.8.3.7.0.0.0.0.f.f.f.f.!.0.0.0.0.4.6.1.0.f.e.6.9.4.c.6.c.7.9.6.e.d.9.a.b.5.c.c.7.2.9.5.1.9.f.e.3.c.1.f.a.7.6.2.9.!.y.a.v.a._.e.x.p.l.o.r.e...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.0.9././.0.3.:.1.4.:.3.2.:.0.3.!.0.!.y.a.v.a._.e.x.p.l.o.r.e...e.x.e.....B.o.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_yava_explore.exe_63b09e81eb74d74ed64ff798a792a6b387e13_21dfad5a_a916d8a0-42e4-4bb2-9748-805229360f91\Report.wer

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8904022923273399
Encrypted:	false
SSDEEP:	192:7buLI/p/g056rQjueZr3OzuiFpZ24IO8N:2LI/p/756rQjCzuiFpY4IO8N
MD5:	5903975DF471A3307889EEB86A5AC736
SHA1:	8BFEF6D14F65763AB19611D5C1BAB52ABCD69DD1
SHA-256:	1B3C9B6B460C12F03BE754CA30CE878198869F94A4958A776AE9DDBAEA340F92
SHA-512:	0419D358EE0C417238A2A6C37CF432D6536418DEBDEC218E11A470DA888108A577193C7F81EBDC2D1EED07CBE6AB57CAE07FE8FE561AE2E636D15F170DBF768C
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.1.2.2.3.9.5.3.3.2.8.6.6.8.7.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.a.9.1.6.d.8.a.0.-.4.2.e.4.-.4.b.b.2.-.9.7.4.8.-.8.0.5.2.2.9.3.6.0.f.9.1.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.b.b.e.3.1.7.7.f.-.a.b.9.4.-.4.b.2.9.-.a.5.d.3.-.4.4.2.d.e.e.d.7.2.c.9.4.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.y.a.v.a._.e.x.p.l.o.r.e...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.3.d.8.-.0.0.0.1.-.0.0.1.4.-.8.4.c.d.-.1.b.c.b.9.2.0.a.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.f.d.f.7.b.f.c.9.3.d.7.9.1.e.9.a.0.e.a.7.3.4.b.f.9.c.5.6.e.8.3.7.0.0.0.0.f.f.f.f.!.0.0.0.0.4.6.1.0.f.e.6.9.4.c.6.c.7.9.6.e.d.9.a.b.5.c.c.7.2.9.5.1.9.f.e.3.c.1.f.a.7.6.2.9.!.y.a.v.a._.e.x.p.l.o.r.e...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.0.9././.0.3.:.1.4.:.3.2.:.0.3.!.0.!.y.a.v.a._.e.x.p.l.o.r.e...e.x.e.....B.o.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_yava_explore.exe_63b09e81eb74d74ed64ff798a792a6b387e13_21dfad5a_ccedc346-0e65-4115-8ab0-4a1ebe5f1002\Report.wer

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8973575592448084
Encrypted:	false
SSDEEP:	192:6nbuhI/p/g056rQjueZr3CzuiFpZ24IO8N:6qhI/p/756rQjOzuiFpY4IO8N
MD5:	99ECEF7CAC132488FA0C62A008DCBB74
SHA1:	27D5689945ADE4B25F92E749E2050295846B697D
SHA-256:	2288E07E86A81FC3BF48A120A1E87052F59AD6DD2FC1F34C2F2B62680FA98904
SHA-512:	FF0121FCFAF9A7E044C5EC2D4BADD7E79F14F8F0C70A8648C38D02B3DAEEE462FB43AFA11BC019F3DE30F42728BDC7FE9C24572317EEC65076BB95E61277DC93
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.1.2.2.3.9.5.4.1.2.3.2.3.9.2.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.c.c.e.d.c.3.4.6.-.0.e.6.5.-.4.1.1.5.-.8.a.b.0.-.4.a.1.e.b.e.5.f.1.0.0.2.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.0.a.5.f.8.3.9.e.-.c.4.b.f.-.4.9.2.7.-.8.3.c.a.-.4.7.5.5.7.e.8.e.5.8.7.2.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.y.a.v.a._.e.x.p.l.o.r.e...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.3.d.8.-.0.0.0.1.-.0.0.1.4.-.8.4.c.d.-.1.b.c.b.9.2.0.a.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.f.d.f.7.b.f.c.9.3.d.7.9.1.e.9.a.0.e.a.7.3.4.b.f.9.c.5.6.e.8.3.7.0.0.0.0.f.f.f.f.!.0.0.0.0.4.6.1.0.f.e.6.9.4.c.6.c.7.9.6.e.d.9.a.b.5.c.c.7.2.9.5.1.9.f.e.3.c.1.f.a.7.6.2.9.!.y.a.v.a._.e.x.p.l.o.r.e...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.0.9././.0.3.:.1.4.:.3.2.:.0.3.!.0.!.y.a.v.a._.e.x.p.l.o.r.e...e.x.e.....B.o.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_yava_explore.exe_9316b72f17848c2e62d56ac51fe1771df4b791a_21dfad5a_0b63ba24-067c-45ac-ad62-6d77750be7b7\Report.wer

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	modified
Size (bytes):	65536
Entropy (8bit):	0.8855119432642029
Encrypted:	false
SSDEEP:	192:OJbuiI/Dn0brHDjjzkZrQzuiFpZ24IO8N:riI/D0brHDjj3zuiFpY4IO8N
MD5:	8C42BA718C6A3690152E709E81170A88
SHA1:	2DC8A587C3419F2227454DF97D015424DE351892
SHA-256:	90011A4B1A25A172BE77391054C7EB303BE3698A1527A860CDF608764708FD63
SHA-512:	E353BAC2E6238BE1B83DBD7BBDC111EACD99AD2212938F31F9B4E8C3B74EDB46A1F8D8D733C66A29FC63215FF038CC4C94CE795EE1FF34C2D9CD18BD247948CB
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.1.2.2.3.9.6.0.2.9.3.8.2.2.9.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.1.2.2.3.9.6.0.5.7.5.0.6.9.7.....R.e.p.o.r.t.S.t.a.t.u.s.=.6.5.5.4.5.6.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.0.b.6.3.b.a.2.4.-.0.6.7.c.-.4.5.a.c.-.a.d.6.2.-.6.d.7.7.7.5.0.b.e.7.b.7.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.6.5.3.1.6.c.0.5.-.6.6.1.7.-.4.6.8.f.-.8.4.1.e.-.e.b.d.0.0.1.8.8.e.3.2.1.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.y.a.v.a._.e.x.p.l.o.r.e...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.6.7.0.-.0.0.0.1.-.0.0.1.4.-.d.1.8.2.-.3.8.c.f.9.2.0.a.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.f.d.f.7.b.f.c.9.3.d.7.9.1.e.9.a.0.e.a.7.3.4.b.f.9.c.5.6.e.8.3.7.0.0.0.0.f.f.f.f.!.0.0.0.0.4.6.1.0.f.e.6.9.4.c.6.c.7.9.6.e.d.9.a.b.5.c.c.7.2.9.5.1.9.f.e.3.c.1.f.a.7.6.2.9.!.y.a.v.a._.e.x.p.l.o.r.e...e.x.e.....T.a.r.g.e.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERAD67.tmp.dmp

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Thu Sep 19 12:52:27 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	56556
Entropy (8bit):	2.252585712377842
Encrypted:	false
SSDEEP:	384:8BNLCgfEfrD5bzx30glUjcmop/oe7ZtIVa:8XLCgfEfrp6g2jcDpnFp
MD5:	8D43AE175218B8625CFF71097E3B873D
SHA1:	23C7517252928F4AB0582C2B98A8E618A0B7D9D7
SHA-256:	83149C7275021F3374DD880CDAC062162BB009A5E8A11A22E3A6B095A0889F0E
SHA-512:	16E3EC183E38B7DCC76B8F7B6C8C27D9F881845A6E4260BC9DE403D77035F4072D9781630B5923F26378AFA3A748D62710269B498C532BD8AF61753E6DD158DF
Malicious:	false
Preview:	MDMP..a..... ..........f........................D...........T....2..........T.......8...........T........... '.........................................................................................................eJ..............GenuineIntel............T..............f.............................0..2...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERAE14.tmp.WERInternalMetadata.xml

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8324
Entropy (8bit):	3.694813695815723
Encrypted:	false
SSDEEP:	192:R6l7wVeJTjg6rK6YEIqSU9M3M4gmfwzo1pBr89b22sfGxSm:R6lXJfg6rK6YElSU96M4gmfwzoW2VfGF
MD5:	BCC58FDDFF166E0718FE1EFA1ACDDBC7
SHA1:	8B7B4FD536B74314D0D8B652EED46EA39BAB68BF
SHA-256:	DB69D681B239C6AEE079A1B562C6CE56C878EFD4FEB4783657279C9B6A6C946D
SHA-512:	B8D6FB8FBB6FDEEF8A39DDABCD6C997113B4DB72A94EB680B44C71444B6EF5271914EE15A15E7F02860C89AA548FA8AECBE315B4DBB03AB52BFA8A9FB2E85F20
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.4.5.0.8.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERAE43.tmp.xml

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4600
Entropy (8bit):	4.4578623556107155
Encrypted:	false
SSDEEP:	48:cvIwWl8zstJg77aI9diWpW8VYjwYm8M4J73qFJ+q8o3Gf3i3d:uIjfHI7zj7VIJ7ClGfy3d
MD5:	E4BB6A59E9D773E019A5BD740658B56C
SHA1:	35BEB30BDA90C64194D620EFB144CF5C5225CE96
SHA-256:	1730B9AAEE656793B951F10C0A0C8678F36A67224FEF2836855A26F5271B2085
SHA-512:	34DCABD1C1166A194700CD975644D89ED74E76D7CA75E9E8ECFCE55CEB9BAF8BD13B4FBABEB082F24016A1569392B0D73DAFD0AFEC63F19F07C0B50A12E677A4
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="507115" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERB2C6.tmp.dmp

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Thu Sep 19 12:52:28 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	84428
Entropy (8bit):	2.319474526445109
Encrypted:	false
SSDEEP:	384:RtkZPVtsToEfa882rIQZLo3HCsOgTnRPo9MB8+o5zQ4cmop/FSYQWpttUWT/B:RtkZ9ts8Efa8h5xoBHLBBoBVcDpxpcy
MD5:	17C3D3A3BE62B3D11351B4C65A211A2E
SHA1:	29996AB6AFA62D8279B4390B0F37F6143628250F
SHA-256:	FC89557BF83FB5EDBC3C123B23D168DBBDFD2DD990F2D7787C6039E93E53D3CD
SHA-512:	376E082B9D82979FD721FD798C099F2F4BB0AFEAD5775EBD39A0B7689A5B7181C0F15862BB6117E176D5A00C7861196B347002D313DFB60636F791A429971941
Malicious:	false
Preview:	MDMP..a..... ..........f............T...............\.......T....<..........T.......8...........T...........p,..\...........x...........d...............................................................................eJ..............GenuineIntel............T..............f.............................0..2...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERB3FF.tmp.WERInternalMetadata.xml

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8324
Entropy (8bit):	3.6945116992204903
Encrypted:	false
SSDEEP:	192:R6l7wVeJTO6d6YEIvSU9KMagmfwzo1pBa89bh2sfemLm:R6lXJ66d6YEQSU9KMagmfwzo5hVfe7
MD5:	47CCB953ADC51C69EE3703B1A7713A43
SHA1:	4C46DD8593602FAF1379924429A2B43D6644BCD8
SHA-256:	9863D51A138B5C4B1F83E2EA27912F35C7A92B3306987D9CFE049B6F6DE26E05
SHA-512:	973794BD1C257F3E7E2A636D6CE1020D96BC6B675146D37EDB1480E8CB2EF8FFD593DDD8CA1500D70B169991C55AD58EE691A53D5FA86385AFF323CE6DD524C6
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.4.5.0.8.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERB42F.tmp.xml

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4600
Entropy (8bit):	4.457482271635071
Encrypted:	false
SSDEEP:	48:cvIwWl8zstJg77aI9diWpW8VYjDYm8M4J73qF1+q8o3Gf3i3d:uIjfHI7zj7VLJ7alGfy3d
MD5:	3D1613535F1CA86E4EFDCD8F9BB1409E
SHA1:	D20E86BE5752B852FC439BE757C4271DFB68BAFF
SHA-256:	614DBE95B963D0AEC03F4F94BA36FAB7AA735AAD6D109EF366E921FEE04D8E04
SHA-512:	5E0A0C80DD31868F9EC8E8D4E0A1B89C11748D452B7DBB279C0564B335AA0C4DECA45E276EC235F6FC2235B3B6991C98C9311A40637823A3BC334FCEC46F120B
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="507115" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERB5C3.tmp.dmp

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Thu Sep 19 12:52:29 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	88660
Entropy (8bit):	2.221941395699545
Encrypted:	false
SSDEEP:	384:YQv9pf/5cjEfmv80QzbAo3Hnw8MB8+o5zQ4cmop/Y/YqFyaGT5gJPmb:YQv9FRcjEfmvQXAoSBBoBVcDpgyaQ0g
MD5:	498EC966591990989FA905940515E911
SHA1:	0800CB5DCA2D966DB40FA820F0314DA85329597D
SHA-256:	353A2FCD05E196329C903804A71B30801BADA7D62EB88C58220D543AA40B214C
SHA-512:	33AE3C01F3E26E5BA723D03AFC8B82C0B32CC77BFF2861D3EFFD78586AF566CF343BDB7D452123B3789B471A44BA2CB2A4676855D89B9E1B0E79AB49D5E54F55
Malicious:	false
Preview:	MDMP..a..... ..........f....................................d....?..........T.......8...........T........... ,..4.......................................................................................................eJ......, ......GenuineIntel............T..............f.............................0..2...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERB651.tmp.WERInternalMetadata.xml

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8324
Entropy (8bit):	3.6948365848877085
Encrypted:	false
SSDEEP:	192:R6l7wVeJTr6XB6YEImSU9gMxgmfwzo1pB089bY2sfsIm:R6lXJf6R6YEpSU9gMxgmfwzorYVfi
MD5:	A8C13FB0084815F35B1CDACCB251FC3D
SHA1:	15C249544326FFA4B67841B21F737C5EA2FC7169
SHA-256:	72A4D1749C774BC938BC5F05E8390582AEB2212AB0E96996109A9D3F0D76028F
SHA-512:	5F6FF01767FFDBD7C6010470C1BDD0CD4424B3110EA0207E6DE6F5077628D4E294D5ADE36AFAD9F34DB0F9184A782CFB10BB537E5E31EDCCA8F1A3B58F9BF639
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.4.5.0.8.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERB6A0.tmp.xml

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4600
Entropy (8bit):	4.4546150542495795
Encrypted:	false
SSDEEP:	48:cvIwWl8zstJg77aI9diWpW8VYjHPYm8M4J73qFSV+q8o3Gf3i3d:uIjfHI7zj7VPJ7HVlGfy3d
MD5:	1CE98C05D8D59334D6B1993278D570BB
SHA1:	5151734737E5EC58E2C80ECDE451909F917B5497
SHA-256:	C1E338457FD2D9AC044194B02D58417A3810AA02FDA10B7EC0F971FEC77988A8
SHA-512:	41AB542654A93EE58FA408AA6D294A5C50BE3DCC0038458939E1C6AF4EAF90E890B68CFAAFBE09F6A6CBD0F7F738443B7F616787902FA071E75FD5441F79960D
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="507115" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERB815.tmp.dmp

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Thu Sep 19 12:52:29 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	88804
Entropy (8bit):	2.2561827003270922
Encrypted:	false
SSDEEP:	384:6N9pf/5iEfyw0QzWEo3Hnw49MBw+o5zQ4cmop/dJ01eizgebyRH:6N9FRiEfy86EoLiB1oBVcDpriNbiH
MD5:	D51E363B74C84AE8AA03BAB3747D5A0D
SHA1:	CC04E8F00C14BDC2F22DA1DDD5336A1BCF0E9C9C
SHA-256:	57267A6F495688B3839343DD870248C381551A36661004F91DF6F7A6065E97AB
SHA-512:	AF2C60E2306BE00ACA0EA0E114146CAC692BB1A3BE780AAC15E3AE5382FABE5C183CD67F88A6B6BD91C814B191A9228D6FAB2C9D5D80B6D951B87563DAC78E0E
Malicious:	false
Preview:	MDMP..a..... ..........f....................................d....?..........T.......8...........T............,..L.......................................................................................................eJ......, ......GenuineIntel............T..............f.............................0..2...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERB8A3.tmp.WERInternalMetadata.xml

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8324
Entropy (8bit):	3.6967748947550376
Encrypted:	false
SSDEEP:	192:R6l7wVeJTp666YEIWSU9gMxgmfwzo1pBa89bY2sfkDIm:R6lXJd666YE5SU9gMxgmfwzo5YVfI
MD5:	A0931F2D5376796C81EF82852873A8F2
SHA1:	E41EB3325FADF38FA713C38334F5F6873B7456BA
SHA-256:	7DE6B418D2B85A6B9B5B42C4C8212FC2D55A4F444FAA169CB26AF4399937E172
SHA-512:	59B0D3DD6192A57B4BBD4C0DE3EC661177D391E01FFBCBCE119F4C2A328DB514B228CC196D965817AA3040F1E8639F875AE0692853383F81B638E093E0386746
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.4.5.0.8.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERB8D3.tmp.xml

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4600
Entropy (8bit):	4.453789305825648
Encrypted:	false
SSDEEP:	48:cvIwWl8zstJg77aI9diWpW8VYj4oYm8M4J73qFv+q8o3Gf3i3d:uIjfHI7zj7VfFJ78lGfy3d
MD5:	5E406900ED9169535385635E57B94DEA
SHA1:	E2DB49C3F69CF28525CA093C79462BEC039F9DDE
SHA-256:	22FA9012763621CA8154842CA87999575A34DFD610EB4D15D1DE39178BF6066F
SHA-512:	E328A2DF052603E0ABABAA521D1287F43AB0A23E3124869A1DC6A9C2D88FF16B9301ACDF099EF5E6BE651F0C498282CD0EF3A53CABDDD09C6CAB836732BB1BC5
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="507115" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERBA67.tmp.dmp

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Thu Sep 19 12:52:30 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	95522
Entropy (8bit):	2.003182361624047
Encrypted:	false
SSDEEP:	384:xHs2q6dEfPFNqzwznS4iHpC+4cmop/ERYyLdqUq46MqwakKI5EpUBRaNi:xHs2q6dEfPLawdiHAcDp2PdEUqN
MD5:	098F53146FB482C974D1B3D4ECB78F7F
SHA1:	DF572A35A5B5895D4574247C7006EEC9D3668B90
SHA-256:	D3ACBBF3F92EF8B936ED9801A558EAE3E49D8FF2CD2EF6A0525C37A82ACFB8F4
SHA-512:	607805388E0874FC07AB8F87C9D50E114E7D5187F6388C816F8FC708443AC13A42C5BD07320D2A5BE2AD7E76A3E4A19DEBAD0E2091B94CBAB82ED812C94E6FBD
Malicious:	false
Preview:	MDMP..a..... ..........f.........................................D..........T.......8...........T............-...G......................................................................................................eJ....... ......GenuineIntel............T..............f.............................0..2...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERBB04.tmp.WERInternalMetadata.xml

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8324
Entropy (8bit):	3.6950744697835036
Encrypted:	false
SSDEEP:	192:R6l7wVeJTU656YEIKSU9gMxgmfwzo1pB089b42sfNom:R6lXJA656YEVSU9gMxgmfwzor4VfH
MD5:	A4F0B2872B16F82996A9CE283E2CF69D
SHA1:	6EA67C1D2B3B6F0AF464B80488CBAC35796A91F5
SHA-256:	02E72850A263BEC2C1DCEDA9599F5AD7CF6579299B821D0CB6651C3B2A4A0344
SHA-512:	55017BE222F5879624237E7268E9F30FABA85C3722CAAFDADB4988FD9A1AC6AA832E615F39D440FE6A8ECE048527ADD6479D8A3E1AD4ABF3D78C2318329BBF49
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.4.5.0.8.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERBB24.tmp.xml

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4600
Entropy (8bit):	4.45606509516686
Encrypted:	false
SSDEEP:	48:cvIwWl8zstJg77aI9diWpW8VYjgYm8M4J73qFfYM+q8o3Gf3i3d:uIjfHI7zj7VcJ7/MlGfy3d
MD5:	1609182527EACF27362C150F5207F6F8
SHA1:	1544D2314E6FFCDF8B7F303A15C4D23C6653B6BA
SHA-256:	58E38F56D3664B86A17F95D9C908A0CA571169F690D13780BF9894A4C242C7F7
SHA-512:	6003E7BFD3C6C609F446A22C1CEC916B10249A1ACF9BAA31A044BA67AD7ADC9296796F0FB732522F0BE8EF293B890CAE474E862DD193B4A2E1C3618FD44FE1A7
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="507115" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERBF68.tmp.dmp

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Thu Sep 19 12:52:31 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	95098
Entropy (8bit):	2.0175809792375676
Encrypted:	false
SSDEEP:	384:x3BC2q6NEfTby4lhqWQgzUISRpC+4cmop/Be8qpWh93Bg9aJYo1NDcdfdxQpVBY5:zC2q6NEfTpogATAcDpO4938e
MD5:	C69D15E5CBF4BAD278B091B573BD183E
SHA1:	31874D17E5F3E02CDCA46C4C73C67F873BD5F9BD
SHA-256:	0425A7793DD00553B6E0B0B18A99BE7083924FCE21400155ECF58F4A93F0F616
SHA-512:	501957D94F99896A5AF0ADD062F019BF0332DFA5A720576FDAD58960CBB0C1328F2AB8EC9C6AFBE3CC48372A2614E51DB95436C0A067B42E16FE806E8DEE3C0D
Malicious:	false
Preview:	MDMP..a..... ..........f.........................................D..........T.......8...........T............-...E......................................................................................................eJ....... ......GenuineIntel............T..............f.............................0..2...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERC005.tmp.WERInternalMetadata.xml

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	modified
Size (bytes):	8324
Entropy (8bit):	3.6949219040170322
Encrypted:	false
SSDEEP:	192:R6l7wVeJT16AF6YEIiSU9o8Mvtgmfwzo1pBu89bB2sfHrm:R6lXJh6S6YE9SU9RMFgmfwzoNBVfi
MD5:	457738FF6C4E5569DDBA35B4EE10A693
SHA1:	5E9780BA270341F3E8205B9B0B42E511993CE4B0
SHA-256:	401B34855911456134DEB956E34EE3F1FDCA2ECC8FCFACC464252E1EE0E3A2A8
SHA-512:	36CF44EEB8953D2C2DF4CE9DC5D4F352603E1BC23458A1F60B735DB7DFD3368D56F82BD8FB6A3E2CD5DADDF6C7D7A4504947E2D1636D235DF5FFED11C4D3A905
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.4.5.0.8.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERC035.tmp.xml

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4600
Entropy (8bit):	4.4539504209748335
Encrypted:	false
SSDEEP:	48:cvIwWl8zstJg77aI9diWpW8VYjWYm8M4J73qFc+q8o3Gf3i3d:uIjfHI7zj7VmJ7LlGfy3d
MD5:	E42436EA864E505466ECDCF0DA934FE3
SHA1:	76277971FF689C6BC175971BA288F49B577EC68A
SHA-256:	C056D7341C5F2EB1E4D3F90F89B80ACB4C0224376DEF11D13E8E106DA8F8FE4D
SHA-512:	A8800A87FAF30F0CE8430033AE29B50619AEBAF2210F0372F8DEA9547E67C8D1978A29D106E699E90875FFECFA6FF7BD5A1D10984EF8A6CD54A1C793D2FB6DF0
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="507115" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERC1AA.tmp.dmp

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Thu Sep 19 12:52:32 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	94674
Entropy (8bit):	2.0247230080039245
Encrypted:	false
SSDEEP:	384:uG2q6XGHEf2tty5lqdgzHSJpC+4cmop/UjC8hKzunPdsdFt19lNFtKEt1NlNFtFu:uG2q62HEf26nog+AcDpcjszup
MD5:	386CE51A9148E80535766FE35772FAE7
SHA1:	F45A5652F86C00BEC485D57D5F42F287503D09C8
SHA-256:	4BBA79C10F9AF033C89FFA2FC174911CDAF76CD16E9C89B7C95DDECF7E0C667A
SHA-512:	4EF797CCCB29BD9815BB7200EE3B20F614C1CD03BCE4C748D18D6C6695A0B8A738DDA8D2AFE6A2D942D2F4B3CFA4A8E05B5D28FA5134C88448AD941A5C82BF9D
Malicious:	false
Preview:	MDMP..a..... ..........f.........................................D..........T.......8...........T............-..JD......................................................................................................eJ....... ......GenuineIntel............T..............f.............................0..2...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERC247.tmp.WERInternalMetadata.xml

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8324
Entropy (8bit):	3.6943608854467143
Encrypted:	false
SSDEEP:	192:R6l7wVeJTT60p6YEIiSU9o8Mvtgmfwzo1pBa89bq2sf9Om:R6lXJH6C6YE9SU9RMFgmfwzo5qVfN
MD5:	10E1803BD6E0AB4324E2802461AE699E
SHA1:	3B12AEE06D2B2DF87792D4146C64918FC0E4608B
SHA-256:	13AA20667B57118615D9CDA9936DD5715CC5D4AFA3A3D957651B58BA2D382BA1
SHA-512:	85EF847B8A0A8C4999D983126027757F34F46F6CBC212B70AEB5738D3E74DBE534D746673E8CCF493EBFFD431C95584CC92C713F4A8A593F9AC89B9C003CF98D
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.4.5.0.8.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERC268.tmp.xml

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4600
Entropy (8bit):	4.455340300676665
Encrypted:	false
SSDEEP:	48:cvIwWl8zstJg77aI9diWpW8VYjGYm8M4J73qFL+q8o3Gf3i3d:uIjfHI7zj7VyJ7slGfy3d
MD5:	913F645D671154828891D7B781778AAB
SHA1:	C91CFC5731E1A67E6780BBCFF43B968DCFB858AE
SHA-256:	29C34B58600ECEFE0EBDE4D2F9459A0D54B89C720C2B823C09097B31B413789C
SHA-512:	641E0FAC93DA61097CC42129D98FF7ECD274E4C5CD82A41CC834BF4AD7D77F450179FA54BA7C120D0D07E7A8D20A5F0F8683942151207890E33F5072E01D6BED
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="507115" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERC43A.tmp.dmp

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Thu Sep 19 12:52:33 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	39288
Entropy (8bit):	2.5647630531416845
Encrypted:	false
SSDEEP:	192:nIqXiyXZtU3zX884iEmOzwFfoeXDxilLQWpDU+uw21o0FMiUe4vgbmgACCObFA:btUo8oxEfflilLQWpDu1YX4Bd
MD5:	84F7189FFBA3D6F4983BF7491A283A89
SHA1:	56096C5A721671DB6A0CFD6EA3CA32054B5D1792
SHA-256:	E764B88F7A68E4AC4E237212B5EEDA31EE788424B5C3CA22F7B97D771BB240C3
SHA-512:	9FCDEE8213A4AC39C32AC73BC8D450CB4C6DC812142D668616FD6B5ACF2D354EC3621967F656E3EFC8DF7DDD3144BA03990A1780A11FC0E37161157F39CDCAE4
Malicious:	false
Preview:	MDMP..a..... ..........f............4...........T...<.......d..../..........T.......8...........T...........(3..Pf........... ..........\|"..............................................................................eJ.......#......GenuineIntel............T..............f.............................0..2...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERC507.tmp.WERInternalMetadata.xml

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8346
Entropy (8bit):	3.6981299784100234
Encrypted:	false
SSDEEP:	192:R6l7wVeJT36IXG6YEIaSU9X5MvAgmfwR44CpD489bz2sfLFRm:R6lXJj6IXG6YEFSU9pMIgmfwR44azVf2
MD5:	435FC6935C82912A48EC28D3EC431494
SHA1:	2231E439D7EB37B980A2EB7C3F1E37FE19127E78
SHA-256:	DB364F272A3A816C0DF2AD8397167F0DE12B15C926BA7F94887692CAD09EBCCE
SHA-512:	29EE46EA504253F8C856CE1F2FE52437B2A22E66D31063EA77C8BA6FECBA747181843BB4BC28613DAFD129BC68BEB1CA236FF607C3526CF02CCB3467D0E8E7DF
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.4.5.0.8.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERC565.tmp.xml

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4610
Entropy (8bit):	4.478720402021752
Encrypted:	false
SSDEEP:	48:cvIwWl8zstJg77aI9diWpW8VYjYYm8M4J73/FU+q82KGf3i3d:uIjfHI7zj7V8J7GMGfy3d
MD5:	7DC35C5CA8156B2AFE96C4CAB2777EBE
SHA1:	BD8BBD2456ECC5115DFD9083C97B112F3787B9C1
SHA-256:	C1210BB3DA2AC07C673B66F2B6714A1A45D5C9237F6F9E27D5E939661B536F85
SHA-512:	ECC7C3C9DB33BBCFD7151618460A31FCB9908E45A37200D2741064567D591ACC6232BD55C050BD62EB994F9BBFA647B30160DB6247A29047D42389EB99E88467
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="507115" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERC5E0.tmp.dmp

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Thu Sep 19 12:52:33 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	53166
Entropy (8bit):	2.167538766597923
Encrypted:	false
SSDEEP:	192:nqqTLX6Xr6CsegOzXw5D159z3ASQ2Rllj2xOtNMLb6DpcITv+wcGvMta2z3cL:qqu6Ch3U5DJzvXljRpce+wzvMgWcL
MD5:	58FBDF225B5D01827CDA15525D403665
SHA1:	70528C16AF4EA0809FE4C89DF13058DBBFD39905
SHA-256:	7584BA3CC3E8B3D2ACACF5458DF28C88BEC411DF1E8E475C63AFF1C6AC21955B
SHA-512:	6F0FC0D9C13CBACB0F537F305700EC5ACD6C742CFCA4D1343012A1F98425A4D278E31BDE0E762A8267E9A9213110B60C0F59BE2949A883BC516548D80ACFC153
Malicious:	false
Preview:	MDMP..a..... ..........f........................P...........................T.......8...........T.......................................................................................................................eJ..............GenuineIntel............T..............f.............................0..2...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERC63F.tmp.WERInternalMetadata.xml

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8302
Entropy (8bit):	3.6940695874102474
Encrypted:	false
SSDEEP:	192:R6l7wVeJd96frr6YTCT6AfegmfiZo1pBt89bzhsf0MRm:R6lXJH6v6Ya6AfegmfiZogzafa
MD5:	E605F6005ED9E5FDC859FC2E9655F60B
SHA1:	8900F33D1A9C153ABDA32914BCE4892CF687730D
SHA-256:	AC8122A60D885EE09E0D8114376666C50C01BFC9976C79B81DF22E293648B4B8
SHA-512:	54D04FD711F21B4F04A81BEAA0E90876803E0B6326E7B091056AC9FFF959867D7E69AAEF03C69985157B2E1A42CBE499680498255F25008F29DE39F70B4C2994
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.5.0.8.0.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERC66F.tmp.xml

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4593
Entropy (8bit):	4.44810506128543
Encrypted:	false
SSDEEP:	48:cvIwWl8zstJg77aI9diWpW8VYjd5Ym8M4J5yF7+q8oUU33QUd:uIjfHI7zj7V+oJel3AUd
MD5:	084D9C06F6814F9DBA44AFD0B4175ED1
SHA1:	84ABEAF8E26AA54F117866AE561DF66F92E93B7A
SHA-256:	394BF7B51A84B44FB2F590C9EB440A587FADA7DE96897FA1BFBDAD0136A11F49
SHA-512:	176F67BCF8BBA9EA96C602CA59AF9132ADEBFC6D4A80081C70AEB6B8EDABC8AEE6F75327E1529C6A0CEFB0364E75E923D8FF1148DC62D338E131E73B506C45FC
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="507115" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERC90D.tmp.dmp

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Thu Sep 19 12:52:34 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	59154
Entropy (8bit):	2.170302166966198
Encrypted:	false
SSDEEP:	192:80eE2yeX2XSM5sgOzXw5QFck3ASQlR1lduy+bgmNNSLb6DpcITssM1bOm3xlkqX/:uE2JM5s3U5QakEHldujZpcFsM1amcI/
MD5:	9C05B82966AA890C94FDEA5CC80D8DFE
SHA1:	EDE1276471ADAA8191F333E46D5EA95B8F35753E
SHA-256:	9A7B317B454FE7B066E43810FCA0B06E02B393E9853AC16A71B4B91D48749D7D
SHA-512:	1D7F3760110847403958B5B376A7756D62E667D2B231A1535354866DA6FE84EF1B66D4FC04A83B68BA9EDA3358CFCB3D5B5FB9173C35D56D45D79DC84E9AF2E3
Malicious:	false
Preview:	MDMP..a..... ..........f.........................................1..........T.......8...........T.......................................................................................................................eJ......<.......GenuineIntel............T..............f.............................0..2...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERC9D9.tmp.WERInternalMetadata.xml

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8304
Entropy (8bit):	3.6914983580116796
Encrypted:	false
SSDEEP:	192:R6l7wVeJdL6oW6YTW6AfegmfiZo1pB089bchsfQ0m:R6lXJx6B6YC6AfegmfiZorcafi
MD5:	49963FD91F1911649BB9CE5C6F3E1123
SHA1:	4B8EA6ACD6906DCE282AE9A8311EDC2CC5AD3592
SHA-256:	BCEE3A0AE5FA544B851F504BB8C638D1A44CBFFCBA0114131B05C9FBA054A023
SHA-512:	20DD5EC5C5E8EB156DAD0A06F6E21998E2C2FF05A0228E7A562B3CB6F229A19188852906488FC4DA04029B118CC08CF659E8C01DBEFD3BAFFD3F951D33B60BB5
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.5.0.8.0.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERC9F9.tmp.xml

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4593
Entropy (8bit):	4.45056198943864
Encrypted:	false
SSDEEP:	48:cvIwWl8zstJg77aI9diWpW8VYjWYm8M4J5yF8+q8oUU33QUd:uIjfHI7zj7VGJdl3AUd
MD5:	4E7997860AE238761EC64B313915AFC8
SHA1:	66C7D647B44ED8CC87AF13408C0A43C1D3311FFC
SHA-256:	6C5BB0C3989197314C80CBE005744E57784EC415DFDA2A09E0FCAC1D22181C34
SHA-512:	C70FACEA73062F5A004F3EC44DA183C357CDBC3222D5E38782CE854C47C0E4B2FDB7A28F9578C993A28FD1C228D6C72FD27AE226F60DA05FDFDB644F69288514
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="507115" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERCDFE.tmp.dmp

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Thu Sep 19 12:52:35 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	56984
Entropy (8bit):	2.1214796468993633
Encrypted:	false
SSDEEP:	192:ZsmXkXtdAPxTZagOzXw5Z8yr73AwQlRGfaiXhwalAeOSLb6DpcITcsDMBPPPMc:sdAP903U5L/SAfayhwalgpc5sO3Mc
MD5:	8B7F4D8BC5212E5BFAB39EA4AB4D3CFE
SHA1:	2B177DA575ED7D88AFEC04D6007032A8E3971D25
SHA-256:	7D0E0FC70FA550ADFFDDE6AC627EBC1554341AF345A6B77D46E7DFAEC7D6EF7B
SHA-512:	146A9AD20D84EB5ECD2F626D18B34466D9DB72D024303D06DC45B703435C659091DDF8D20E506B3BAD37F4D1091CD94E0624A0C03E26232F8BEFCE437B0FC69A
Malicious:	false
Preview:	MDMP..a..... ..........f........................................L3..........T.......8...........T...........X...@.......................................................................................................eJ..............GenuineIntel............T..............f.............................0..2...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERCE6D.tmp.WERInternalMetadata.xml

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6296
Entropy (8bit):	3.718395363659016
Encrypted:	false
SSDEEP:	192:R6l7wVeJdx6tYiZoaAjAapB089blhsfcv3m:R6lXJ76tYiZoaAjAslafcu
MD5:	568E2C7F135FF50B5E6C8A6F369802C3
SHA1:	F2A03CBCD4028F0E1E9D98A79EA1644FFA686CB1
SHA-256:	A79C90B805389EBACDB4A4341B65CF29799ABD933951065F808169C9CDCA9358
SHA-512:	75669016348F1AEEA1519F89C5B7D40E486A9008D1E7B88ECAF03269952B98D113E5CC26C4205EC8A56CC0A572CD98B6C619A27EF27DE1413FDAF681182797C1
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.5.0.8.0.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERCE9D.tmp.xml

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4593
Entropy (8bit):	4.448633372327134
Encrypted:	false
SSDEEP:	48:cvIwWl8zstJg77aI9diWpW8VYjEYm8M4J5yF0+q8oUU33QUd:uIjfHI7zj7VsJVl3AUd
MD5:	8A73B9AFCFF646A8791149CC5EA9BA8A
SHA1:	C4438F9E0CB60897303B8E87463380F78F4711AD
SHA-256:	F4E6EA35FFC24E85CED4F851D00C49ED30229390556BA5405EE851A5B68B13EC
SHA-512:	0F304924548CEE33690DEA83C2E5A1499760264C7500895ADEB96D1F45FF714103D1B6E6C1B0EEF414D921E6DB8226FF4B6BBD4469FC71F6FD3D7B22740578FE
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="507115" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD3DA.tmp.dmp

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Thu Sep 19 12:52:37 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	58420
Entropy (8bit):	2.1312924824122486
Encrypted:	false
SSDEEP:	192:LvmXkXtdAP+FjgOzXw5Ellack3AlVQiRrl3OPC+JmOMLb6DpcITpSVf0lC4qh:PdAP+V3U5UkkfBl3OJDpcJVIa
MD5:	0F5FF0D1B8C60F88E1DD7AF8E9C8156C
SHA1:	A940E731EACD5F5AD99B141D32E63965CFDA103C
SHA-256:	F461B3F2A42B8B21145753EA51BBA4E66BE1B51726A93AD753EB3EA9AA595EEA
SHA-512:	B501818A16EFF686CBA21C9F24B4A0B9E2BEF630BB738767F34912FC0D7B553456A7AFC2626A8AB205E6E119A55A26F30ABF77C47CA2894E7430A0C088DF9C9C
Malicious:	false
Preview:	MDMP..a..... ..........f........................................L3..........T.......8...........T...............<.......................................................................................................eJ..............GenuineIntel............T..............f.............................0..2...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD487.tmp.WERInternalMetadata.xml

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6296
Entropy (8bit):	3.7199577613898525
Encrypted:	false
SSDEEP:	96:RSIU6o7wVetbTJP61YVQ60oFXT3t5aMOUM89bXhsfJaKdm:R6l7wVeJdP61YiZo1pBM89bXhsf/dm
MD5:	E0F3CDAC114914DD240D90E01E2618AC
SHA1:	C448D6A65BA9C36A9D88D7EAC4F99E49D4ED8977
SHA-256:	AB9289502A205E768DF8A3A919F06F618A76796332E14912A7C58804B481F857
SHA-512:	FEDD2F43CB1028E0C2E750B9A107FDFFD24C9E8D14497F3D09DF33513FF24559833AD51E3F21381FF589997618704B94D5C253A6158778A40C0ABBB6B3B71D1B
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.5.0.8.0.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD4A8.tmp.xml

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4593
Entropy (8bit):	4.4473029435609766
Encrypted:	false
SSDEEP:	48:cvIwWl8zstJg77aI9diWpW8VYjHYm8M4J5yFko5+q8oUU33QUd:uIjfHI7zj7VLJVGl3AUd
MD5:	323DBEF61BA669618D96D3E456C5BF8C
SHA1:	DAA1E184C18CD7BB8C84D97F159D6D4261162A71
SHA-256:	6F3FB74DEB31F35EB1D104E6E159CE5381D4B79CDB721B5400737E0239D3A809
SHA-512:	0CBEB72DE26746B825FAF75BD52ECA8D271A72986726A45A7EADAA9D38D9A83BC93B508D69205A51EFCF9EB6EFB515F4C077601C147E82C597DC80402C1459AE
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="507115" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD7E2.tmp.dmp

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Thu Sep 19 12:52:38 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	57062
Entropy (8bit):	2.121345456350793
Encrypted:	false
SSDEEP:	192:gjemXkXtdAPB8DgOzXw5wES73AwQlRGfsOXGO4hWOMLb6DpcITRhSi0UgcHw:08dAPm3U5wEcSAfsOGO49pccg4w
MD5:	57F95FEC1BB8960B7B50FF8FB257F1CB
SHA1:	27E05CACEAA08FA644F6BFB344F091386CABCE23
SHA-256:	19CFB8E15285C70616EB9AA7F074AF8C441155E49656E7DB5B88BF4C139A6018
SHA-512:	A70FFB43DB3B5CA5A8A494A42AE69A9471ADA42B989C8CB1B07DB4BBAD79C792D13EDD191ABD3F25EB5ACC92261E108B5174B277332904262B9EDD615764D800
Malicious:	false
Preview:	MDMP..a..... ..........f........................................L3..........T.......8...........T...............f.......................................................................................................eJ..............GenuineIntel............T..............f.............................0..2...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD850.tmp.WERInternalMetadata.xml

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6296
Entropy (8bit):	3.719704687785499
Encrypted:	false
SSDEEP:	192:R6l7wVeJd+6HYiZoaAjAapBRC89bAhsfUGAm:R6lXJU6HYiZoaAjAq7AafL
MD5:	C7C216E0FFA0AD8C0C55763DA76E60C5
SHA1:	8CFF57E2BB547F8DF98AAB0340A4C6FC0E72CEC5
SHA-256:	E7A2FACC6C9460B4D902EDE262D4BDB2420305D1DC268422B4D11575E6855DBC
SHA-512:	8A51A6397E6B8A59279C5AC2E066C7B9A57FD60C68E25D151E0EA66446CF7B51CF04FD14228F718445D105062732D5E91D1FCD7876B38FA11E52993E21F981B0
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.5.0.8.0.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD870.tmp.xml

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4593
Entropy (8bit):	4.450273849385192
Encrypted:	false
SSDEEP:	48:cvIwWl8zstJg77aI9diWpW8VYjDYm8M4J5yFD+q8oUU33QUd:uIjfHI7zj7VrJGl3AUd
MD5:	6AC4C5FCF67AC27D14F58D10D8F90193
SHA1:	7B3B7C9F8BC291EB4FD7F0D92294538F331F9DF5
SHA-256:	B666006C8F6C6CA948B8256ABA6B6A467A97106143A44BE244CC11C0807FC416
SHA-512:	B24DE547B1041F58C62C2645DA8B8BCE9340FCF2E0CCF80BC3A7B052A392C01485BE948C7C38BE25DE02ACF0F4BF93B97073335D6D6517F54D7C44C2AD8F5EEE
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="507115" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERDBF9.tmp.dmp

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Thu Sep 19 12:52:39 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	58518
Entropy (8bit):	2.132310894813967
Encrypted:	false
SSDEEP:	192:9WmXkXtdAPy1/gOzXw5EllKck3AlVQiRrlLOfS+XmOMLb6DpcITsyZXv4ck:GdAPy1/3U5EkkfBlLO3Dpc9yih
MD5:	9DB61CC68588C0481F2CB7685FE9DACD
SHA1:	33B8857573A14CC513AEED4E3ECD993F62CDAE65
SHA-256:	6FE6015CB5F7F0E04E3EA4DAAC1A9CA0877BC546890A9C46F82776D68384F736
SHA-512:	13AA040179998632A808446C16CD08AAD7C52698A535B1E2BCE155A005DD0F5A46EC24D7C39A56571711FCD4B7B6D264B27802ED4C6177D0A2FEB436234A9F53
Malicious:	false
Preview:	MDMP..a..... ..........f........................................L3..........T.......8...........T........... ...v.......................................................................................................eJ..............GenuineIntel............T..............f.............................0..2...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERDE3C.tmp.WERInternalMetadata.xml

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6296
Entropy (8bit):	3.717957249230621
Encrypted:	false
SSDEEP:	96:RSIU6o7wVetbTJ76sYVQ60oFXT3t5aMOUw89b/RhsfVv9Bm:R6l7wVeJd76sYiZo1pBw89b/Rhsf99Bm
MD5:	C98ED536813864BD956D19A7ACEBF186
SHA1:	F421885A74FA9FCA8F0DE70D99B9A9DC80C6A439
SHA-256:	34288B8B69AB9DF833FF9A86986DE4A73835B4C9C492806635DE1A287C56684D
SHA-512:	D312F4B8764F8160C47E7AB6A8D0CED81D7E041A87E3098382EAC7FE3453987D7FE0A4569B747FDB633BF7C604F78EE437835A69B5EBBA1FFA110CF343A5BA0E
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.5.0.8.0.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERDE8B.tmp.xml

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4593
Entropy (8bit):	4.449099298460015
Encrypted:	false
SSDEEP:	48:cvIwWl8zstJg77aI9diWpW8VYjBYm8M4J5yFK+q8oUU33QUd:uIjfHI7zj7VlJrl3AUd
MD5:	210C4CBAF6051C4AA6F450718028E255
SHA1:	3A2A956316D2BD27745438B189B9051482FAB672
SHA-256:	986C37882E51590AABF5CDBF5E15BB124CDF84A76A00101BCA13EE6260323BD1
SHA-512:	1656843178F329CF62EBFC65CA13DDB32C79EAEA333977C5DE226D61B37BF901460FF21E10CC7DC46F44DE51036EAF5640CCAB3C078B0166F13D8577E63B6510
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="507115" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE129.tmp.dmp

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Thu Sep 19 12:52:40 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	25230
Entropy (8bit):	2.4769450147722947
Encrypted:	false
SSDEEP:	96:5n8LH03vq4neYdXSV25V1CS7X4fQ2JA8+BStJui74QnXa2cWw7Bp/fBcPATK039t:6LVYdX/B7X4op8gO3XwnVHJ3NGIdOkF
MD5:	64F13E48663F4A7A7325F798BA7B71A9
SHA1:	396471C4217D63F88ABC14411DDF4B1F598912B2
SHA-256:	A12F437EEE2C27DA192247AF615EFC508891F6D2E16108F9B8FF14688401B272
SHA-512:	D9A063CEE98A7968B481C931BD6DA02762C3EA253BE0B8057CF045B037A492A772E2EA1D05170A53DEE9976A0CD33FF948108416AC38E9C58FEDA87B65C85F5E
Malicious:	false
Preview:	MDMP..a..... ..........f............4...........x...<...........&$..........T.......8...........T................K......................................................................................................eJ......8.......GenuineIntel............T.......p......f............................. ..2...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE187.tmp.WERInternalMetadata.xml

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8336
Entropy (8bit):	3.7010734899489606
Encrypted:	false
SSDEEP:	192:R6l7wVeJK66GA76YEIRSU9k6ZFgmfiR44jTpDA89bPesfilm:R6lXJf6GA76YE+SU9k6FgmfiR44jrPdh
MD5:	D6FA4334AA7C0B0EB0FFDCAC9E679622
SHA1:	89CD3EFB4BEA4236366AE97AE8205FB63F9478D0
SHA-256:	9CF7CBDE3D24338FBEB37494C266DC3269B50A3296AA920A739AEE0E0F1F1563
SHA-512:	5C5F062E8F737CF27AA077DED064F017804E121CDBC23A21175E86A2A8C30E6661A9D55CFE725DBD3019458AC2664C0B36FA03FFC114A2AEEA35159A4B186D43
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.5.7.4.4.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE1D7.tmp.xml

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4605
Entropy (8bit):	4.4740760489644815
Encrypted:	false
SSDEEP:	48:cvIwWl8zstJg77aI9diWpW8VYjJYm8M4J5/Fm0+q8GJi33Q4d:uIjfHI7zj7VtJm0Y3A4d
MD5:	D49D485C024E9F549BEB2BDBAFEE5A01
SHA1:	58CD657AEC9DA07E5BC022079162C1450B30DB49
SHA-256:	D38CCFE1F3A8A03C31F0079E3DB5322337C8CA87743901256A2DD4CC162FC722
SHA-512:	D44A59BCE9CA9852C4B3F31E6ABCF182323A6AAA4F59725F879B76D3A541EA9823A45F75142C33BFC3364446FE5EC7B6D0D3DCA31455B5BAEAF86E35D657F3B7
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="507115" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE252.tmp.dmp

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Thu Sep 19 12:52:40 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	57160
Entropy (8bit):	2.1222701173873264
Encrypted:	false
SSDEEP:	192:67AmXkXtdAPogugOzXw5wqi73AwQlRGfVuXJktwoOMLb6DpcITBVLL/5xFZHl:aedAPo/3U5wqMSAfVuJkt8pcYVH/5Vl
MD5:	D34F35BF81CE0877F682E8221894A969
SHA1:	DF082E36E5006EF8E21AD09C58435807C724DC0C
SHA-256:	AED07DF901F6BDB4DED5B58A5791755FAC0A15C69D752D0649DE0C8A570E921D
SHA-512:	FD5DD49D249D7C9A713645B3A7CAE9857DA7C449E73B0CD54F1FB6CCACC846C6031C85070EC50AF92C8AD52973C77BD0CBA2DE62855C6C87D329B5C8C08A3B63
Malicious:	false
Preview:	MDMP..a..... ..........f........................................L3..........T.......8...........T.......................................................................................................................eJ..............GenuineIntel............T..............f.............................0..2...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE2DF.tmp.WERInternalMetadata.xml

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6296
Entropy (8bit):	3.7171616899361357
Encrypted:	false
SSDEEP:	192:R6l7wVeJdk6TYiZoaAjAapBT89bPhsf7ulm:R6lXJu6TYiZoaAjA5PafR
MD5:	F5ADDEC23F52BC4D4D54720ED8F8C181
SHA1:	1D5321489B17BEE0DB1674F09AC98F8D5FFC81E1
SHA-256:	5606F851A960398C6815ABC9E2D248E21A6558E60662438F4176A5C6CCD894AC
SHA-512:	DC9192C0C8CC5E3D7D4943C98A5CF97E26C840FAD24ED117FCD95EE340C3E8EB82212B27BDA9C1A0EEB76B16DC83A27C3862E1E158F874F82C8389E67E5E8E21
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.5.0.8.0.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE2FF.tmp.xml

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4593
Entropy (8bit):	4.4480989576758265
Encrypted:	false
SSDEEP:	48:cvIwWl8zstJg77aI9diWpW8VYjOPYm8M4J5yF3+q8oUU33QUd:uIjfHI7zj7VHSJel3AUd
MD5:	9858836F27B7132C58687AF0E2D46B1C
SHA1:	5E6C0969863E0CBE246518BF0C5E8D01474C4B27
SHA-256:	3E77C396C437D222C63CB3B6726D26E8A54B4F32212F7D579A0469CAF24799BF
SHA-512:	4264FEF2F48F68329096B5ED1DA531CD8743B814361513CF4C643362823A65E8EE261312385087D06D83B479B456500983266999C4CFD3583FD5E8640EFCB2F0
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="507115" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE668.tmp.dmp

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Thu Sep 19 12:52:42 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	58616
Entropy (8bit):	2.134871709546429
Encrypted:	false
SSDEEP:	192:0RmXkXtdAP4gOzXw5Ell5ck3AlVQiRrl5q01+tmOMLb6DpcITly2L54W:cdAP43U5FkkfBl5qzDpcQyJW
MD5:	712A1712424536C2C3438C58DA664448
SHA1:	21DF8305FB13240933787A57E4197C1F8B3685B2
SHA-256:	DE7D0B74F6F6E139C4E6D016E75BCBFA5F186614EDC8C702BB60AE55E5D4016E
SHA-512:	CDE93E89892F25E044D98489E9B408CABB63F51F426E24E986AC739BE0A8FA77DE53686237E92D61C026930B79AFD011A32A27DB6A86A5CCF552DE953EA77E4E
Malicious:	false
Preview:	MDMP..a..... ..........f........................................L3..........T.......8...........T...........H...........................................................................................................eJ..............GenuineIntel............T..............f.............................0..2...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE919.tmp.WERInternalMetadata.xml

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6296
Entropy (8bit):	3.7186085391367976
Encrypted:	false
SSDEEP:	96:RSIU6o7wVetbTJS62YVQ60oFXT3t5aMOUH89bdhsfMC/m:R6l7wVeJdS62YiZo1pBH89bdhsfMC/m
MD5:	493C5EB4D3429A536FCE7C1E117742CB
SHA1:	6EE94A44DD81ABB8ED9263654124899B6715692A
SHA-256:	774C5E2A0FD1F41B2E1271853719F29DAEF60A43E7A7F21F20B51666432ED99E
SHA-512:	18BADF1AEFFFB994F34DC7C8F17BA11D63C635907AE87D0F0CEC8D4C73E1FD2A0F54AEE775F3A6ED51037CF39DA72433B462AA0C8DC1020EB7DD83EA7BCD9AC4
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.5.0.8.0.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE949.tmp.xml

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4593
Entropy (8bit):	4.4480631381008955
Encrypted:	false
SSDEEP:	48:cvIwWl8zstJg77aI9diWpW8VYjSrYm8M4J5yFek+q8oUU33QUd:uIjfHI7zj7VQJkl3AUd
MD5:	A27679A499CD4406D0DAF4B104F2B750
SHA1:	F74CC4250949A95B0F5B32D261CCFB1113156CAA
SHA-256:	BE03A174E10FF2186BA566C72B4D734D92DD2324ED16D777E3C3E02925DC8049
SHA-512:	0B19D8CFCFA9DE839A9D0905A4437A043BF6D5E18A2B0940DC60D18444A831BA8716E8D7E2601A1B4B0C7D0C0BF338C6AA11A767C71C58AD149CC3F7204976F8
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="507115" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Users\user\AppData\Roaming\yava_explore.exe

Process:	C:\Users\user\Desktop\documents-pdf.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	456704
Entropy (8bit):	7.492074991574124
Encrypted:	false
SSDEEP:	6144:12LmXK3chajunEb8/kMb3nB74AogKjLMQx4kxY09AYx+wZzMgI11A1WMCc:126pFnEYRb3nBkAgCkxbAYXb
MD5:	12D7E4DBCB67711B60C8F626D81C7438
SHA1:	4610FE694C6C796ED9AB5CC729519FE3C1FA7629
SHA-256:	3F0143CB0FDD7F85C55841A713BF4934DF3C7F17D1133103B323A5332535852B
SHA-512:	DED570F6814AEB37D2AF53362063AECC11D5A3DFC27FB5B26D082768768D810004B908C3AD27DB6D05A347D8497EA950DC8A5FB216A544C353B5566F287F0F58
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 76%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1...u.~.u.~.u.~...t.~.k...n.~.k..e.~.k...).~.R+..p.~.u.....~.k...t.~.k..t.~.k..t.~.Richu.~.........................PE..L...~..e............................p.............@.............................................................................<...........................................................h....... ...@............................................text............................... ..`.rdata.. ".......$..................@..@.data...............................@....tls................................@....rsrc...............................@..@................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\yava_explore.exe:Zone.Identifier

Process:	C:\Users\user\Desktop\documents-pdf.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Windows\appcompat\Programs\Amcache.hve

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.424187915738338
Encrypted:	false
SSDEEP:	6144:XSvfpi6ceLP/9skLmb0OT+WSPHaJG8nAgeMZMMhA2fX4WABlEnNM0uhiTw:CvloT+W+EZMM6DFyW03w
MD5:	45583CA90233723A8B9572E40C81BFC1
SHA1:	08E5D1282F08EF3BB553A4F8FAE0E2FA91236697
SHA-256:	4671D2E62F2458D984EFD21B6F9E035A79D74C024D5ADFBB9DBC97F6AB90B240
SHA-512:	F29CB4DC85722D210614161C896C3BCF64B570932FB8E57FF63A84165698F2B5EC4BDE6A101DB8BFBC79AB060D07408A6A473A95F2BFB6A7D03A55B4CE52C947
Malicious:	false
Preview:	regfJ...J....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm.<.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.492074991574124
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	documents-pdf.exe
File size:	456'704 bytes
MD5:	12d7e4dbcb67711b60c8f626d81c7438
SHA1:	4610fe694c6c796ed9ab5cc729519fe3c1fa7629
SHA256:	3f0143cb0fdd7f85c55841a713bf4934df3c7f17d1133103b323a5332535852b
SHA512:	ded570f6814aeb37d2af53362063aecc11d5a3dfc27fb5b26d082768768d810004b908c3ad27db6d05a347d8497ea950dc8a5fb216a544c353b5566f287f0f58
SSDEEP:	6144:12LmXK3chajunEb8/kMb3nB74AogKjLMQx4kxY09AYx+wZzMgI11A1WMCc:126pFnEYRb3nBkAgCkxbAYXb
TLSH:	0EA4D0D0A6E04169F7F74AB0D932DE650A3FBCEB6931548E2144261A2DF22C24937F5F
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1...u.~.u.~.u.~.....t.~.k...n.~.k...e.~.k...).~.R+..p.~.u.....~.k...t.~.k...t.~.k...t.~.Richu.~.........................PE..L..

File Icon


Icon Hash:	0d59230d490dd149

Static PE Info

General

Entrypoint:	0x401c70
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x6585197E [Fri Dec 22 05:07:10 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	e65a8357ca24d261f7849f444ec396fa

Entrypoint Preview

Instruction
call 00007FA6B9797B0Bh
jmp 00007FA6B97940DEh
mov edi, edi
push ebp
mov ebp, esp
sub esp, 00000328h
mov dword ptr [00452810h], eax
mov dword ptr [0045280Ch], ecx
mov dword ptr [00452808h], edx
mov dword ptr [00452804h], ebx
mov dword ptr [00452800h], esi
mov dword ptr [004527FCh], edi
mov word ptr [00452828h], ss
mov word ptr [0045281Ch], cs
mov word ptr [004527F8h], ds
mov word ptr [004527F4h], es
mov word ptr [004527F0h], fs
mov word ptr [004527ECh], gs
pushfd
pop dword ptr [00452820h]
mov eax, dword ptr [ebp+00h]
mov dword ptr [00452814h], eax
mov eax, dword ptr [ebp+04h]
mov dword ptr [00452818h], eax
lea eax, dword ptr [ebp+08h]
mov dword ptr [00452824h], eax
mov eax, dword ptr [ebp-00000320h]
mov dword ptr [00452760h], 00010001h
mov eax, dword ptr [00452818h]
mov dword ptr [00452714h], eax
mov dword ptr [00452708h], C0000409h
mov dword ptr [0045270Ch], 00000001h
mov eax, dword ptr [00451008h]
mov dword ptr [ebp-00000328h], eax
mov eax, dword ptr [0045100Ch]
mov dword ptr [ebp-00000324h], eax
call dword ptr [000000F4h]

Rich Headers

Programming Language:

[C++] VS2008 build 21022
[ASM] VS2008 build 21022
[ C ] VS2008 build 21022
[IMP] VS2005 build 50727
[RES] VS2008 build 21022
[LNK] VS2008 build 21022

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x4f81c	0x3c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x14b000	0x1e7e8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x4f468	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x4f420	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x4e000	0x1b8	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x4c9bf	0x4ca00	35a76d5031b3d759a9e9c8dfe6e8984d	False	0.9445287010603589	data	7.927410473473771	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x4e000	0x2220	0x2400	7a8998297e066fdb0a857708575873ff	False	0.3517795138888889	data	5.399651524631684	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x51000	0xf8f9c	0x1800	6f1a21b8c1714b37a4ad6b80b9a12ec9	False	0.146484375	data	1.6051456374636914	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0x14a000	0x51d	0x600	d00a0884dfc2593613905d91d2ea3f37	False	0.015625	data	0.007830200398677895	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x14b000	0x1e7e8	0x1e800	ea425ef548de7a4f4752de9cf71d7b2c	False	0.5855532786885246	data	6.036670613620316	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
AFX_DIALOG_LAYOUT	0x164620	0x2	data			5.0
HAZATOWAHAYAWOYEWA	0x164220	0x3fa	ASCII text, with very long lines (1018), with no line terminators	Turkish	Turkey	0.6257367387033399
TALIHIPUJUBUDUDECOKOSOZIVIP	0x163628	0xbf7	ASCII text, with very long lines (3063), with no line terminators	Turkish	Turkey	0.6007182500816193
RT_ICON	0x14bb00	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	Turkish	Turkey	0.5812899786780383
RT_ICON	0x14c9a8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	Turkish	Turkey	0.6529783393501805
RT_ICON	0x14d250	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	Turkish	Turkey	0.711405529953917
RT_ICON	0x14d918	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	Turkish	Turkey	0.7608381502890174
RT_ICON	0x14de80	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216	Turkish	Turkey	0.5363070539419087
RT_ICON	0x150428	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096	Turkish	Turkey	0.6454033771106942
RT_ICON	0x1514d0	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2304	Turkish	Turkey	0.660655737704918
RT_ICON	0x151e58	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024	Turkish	Turkey	0.7907801418439716
RT_ICON	0x152338	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	Turkish	Turkey	0.7020255863539445
RT_ICON	0x1531e0	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	Turkish	Turkey	0.6796028880866426
RT_ICON	0x153a88	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	Turkish	Turkey	0.6284562211981567
RT_ICON	0x154150	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	Turkish	Turkey	0.744942196531792
RT_ICON	0x1546b8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216	Turkish	Turkey	0.6370331950207468
RT_ICON	0x156c60	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096	Turkish	Turkey	0.6592401500938087
RT_ICON	0x157d08	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2304	Turkish	Turkey	0.6741803278688525
RT_ICON	0x158690	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024	Turkish	Turkey	0.6790780141843972
RT_ICON	0x158b70	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Turkish	Turkey	0.40085287846481876
RT_ICON	0x159a18	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Turkish	Turkey	0.5640794223826715
RT_ICON	0x15a2c0	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	Turkish	Turkey	0.6273041474654378
RT_ICON	0x15a988	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Turkish	Turkey	0.6372832369942196
RT_ICON	0x15aef0	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Turkish	Turkey	0.46106941838649157
RT_ICON	0x15bf98	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	Turkish	Turkey	0.44549180327868854
RT_ICON	0x15c920	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Turkish	Turkey	0.49379432624113473
RT_ICON	0x15cdf0	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	Turkish	Turkey	0.7020255863539445
RT_ICON	0x15dc98	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	Turkish	Turkey	0.6796028880866426
RT_ICON	0x15e540	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	Turkish	Turkey	0.6284562211981567
RT_ICON	0x15ec08	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	Turkish	Turkey	0.744942196531792
RT_ICON	0x15f170	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216	Turkish	Turkey	0.6370331950207468
RT_ICON	0x161718	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096	Turkish	Turkey	0.6592401500938087
RT_ICON	0x1627c0	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2304	Turkish	Turkey	0.6741803278688525
RT_ICON	0x163148	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024	Turkish	Turkey	0.6790780141843972
RT_STRING	0x1647d8	0x33a	data			0.4612590799031477
RT_STRING	0x164b18	0x73a	data			0.4205405405405405
RT_STRING	0x165258	0x658	data			0.43842364532019706
RT_STRING	0x1658b0	0x79c	data			0.4224845995893224
RT_STRING	0x166050	0x6fe	data			0.42849162011173186
RT_STRING	0x166750	0x83a	data			0.4188034188034188
RT_STRING	0x166f90	0x5f8	data			0.43848167539267013
RT_STRING	0x167588	0x6de	data			0.44084186575654155
RT_STRING	0x167c68	0x836	data			0.4196003805899144
RT_STRING	0x1684a0	0x706	data			0.42769744160177975
RT_STRING	0x168ba8	0x7ba	data			0.4251769464105157
RT_STRING	0x169368	0x39a	data			0.4718004338394794
RT_STRING	0x169708	0xdc	data			0.55
RT_GROUP_ICON	0x158af8	0x76	data	Turkish	Turkey	0.6694915254237288
RT_GROUP_ICON	0x1635b0	0x76	data	Turkish	Turkey	0.6694915254237288
RT_GROUP_ICON	0x1522c0	0x76	data	Turkish	Turkey	0.6610169491525424
RT_GROUP_ICON	0x15cd88	0x68	data	Turkish	Turkey	0.7211538461538461
RT_VERSION	0x164628	0x1ac	data			0.6004672897196262

Imports

DLL

Import

KERNEL32.dll

DebugActiveProcess, FillConsoleOutputCharacterA, SearchPathW, SetPriorityClass, GetConsoleAliasesLengthW, CopyFileExW, GetNumaProcessorNode, GetDefaultCommConfigW, InterlockedIncrement, QueryDosDeviceA, GetEnvironmentStringsW, CreateDirectoryW, GetUserDefaultLCID, GetComputerNameW, SetCommBreak, ConnectNamedPipe, CallNamedPipeW, FreeEnvironmentStringsA, GetModuleHandleW, GetTickCount, GetConsoleAliasesA, GetCommandLineA, LoadLibraryW, GetConsoleMode, Sleep, GetConsoleAliasExesLengthW, WriteConsoleOutputA, HeapDestroy, GetFileAttributesW, GetBinaryTypeA, GetModuleFileNameW, GetStartupInfoW, SetConsoleTitleA, InterlockedExchange, GetLastError, GetProcAddress, SetStdHandle, SearchPathA, BuildCommDCBW, OpenWaitableTimerW, LocalAlloc, BeginUpdateResourceA, FoldStringW, WaitForMultipleObjects, GetModuleHandleA, GetShortPathNameW, SetCalendarInfoA, FindAtomW, GlobalReAlloc, GetVolumeInformationW, CreateFileA, SetFilePointer, WriteConsoleW, HeapAlloc, MultiByteToWideChar, HeapReAlloc, ExitProcess, TerminateProcess, GetCurrentProcess, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, DeleteCriticalSection, LeaveCriticalSection, EnterCriticalSection, HeapFree, VirtualFree, VirtualAlloc, HeapCreate, WriteFile, GetStdHandle, GetModuleFileNameA, TlsGetValue, TlsAlloc, TlsSetValue, TlsFree, SetLastError, GetCurrentThreadId, InterlockedDecrement, HeapSize, GetCPInfo, GetACP, GetOEMCP, IsValidCodePage, LoadLibraryA, InitializeCriticalSectionAndSpinCount, FreeEnvironmentStringsW, GetCommandLineW, SetHandleCount, GetFileType, GetStartupInfoA, QueryPerformanceCounter, GetCurrentProcessId, GetSystemTimeAsFileTime, RtlUnwind, LCMapStringA, WideCharToMultiByte, LCMapStringW, GetStringTypeA, GetStringTypeW, GetLocaleInfoA, GetConsoleCP, FlushFileBuffers, WriteConsoleA, GetConsoleOutputCP, CloseHandle

USER32.dll

SetFocus, GetUserObjectInformationA

Possible Origin

Language of compilation system	Country where language is spoken	Map
Turkish	Turkey

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-09-19T14:52:35.576605+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.5	49720	198.23.227.212	32583	TCP
2024-09-19T14:52:38.134974+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.5	49722	198.23.227.212	32583	TCP
2024-09-19T14:52:40.698176+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.5	49723	198.23.227.212	32583	TCP
2024-09-19T14:52:43.260126+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.5	49725	198.23.227.212	32583	TCP
2024-09-19T14:52:45.880626+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.5	49730	198.23.227.212	32583	TCP
2024-09-19T14:52:48.466159+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.5	49731	198.23.227.212	32583	TCP
2024-09-19T14:52:51.061897+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.5	49733	198.23.227.212	32583	TCP
2024-09-19T14:52:53.710624+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.5	49734	198.23.227.212	32583	TCP
2024-09-19T14:52:56.432314+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.5	49735	198.23.227.212	32583	TCP
2024-09-19T14:52:59.016129+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.5	49736	198.23.227.212	32583	TCP
2024-09-19T14:53:01.607406+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.5	49737	198.23.227.212	32583	TCP
2024-09-19T14:53:04.312880+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.5	49738	198.23.227.212	32583	TCP
2024-09-19T14:53:06.951779+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.5	49739	198.23.227.212	32583	TCP
2024-09-19T14:53:09.548833+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.5	49740	198.23.227.212	32583	TCP
2024-09-19T14:53:12.136126+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.5	49741	198.23.227.212	32583	TCP
2024-09-19T14:53:14.713699+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.5	49742	198.23.227.212	32583	TCP
2024-09-19T14:53:18.355118+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.5	49743	198.23.227.212	32583	TCP
2024-09-19T14:53:20.917327+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.5	49744	198.23.227.212	32583	TCP
2024-09-19T14:53:23.513235+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.5	49746	198.23.227.212	32583	TCP
2024-09-19T14:53:26.151716+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.5	49748	198.23.227.212	32583	TCP
2024-09-19T14:53:28.751224+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.5	49749	198.23.227.212	32583	TCP
2024-09-19T14:53:31.934813+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.5	49750	198.23.227.212	32583	TCP
2024-09-19T14:53:34.550284+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.5	49751	198.23.227.212	32583	TCP
2024-09-19T14:53:37.159503+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.5	49752	198.23.227.212	32583	TCP
2024-09-19T14:53:39.762402+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.5	49753	198.23.227.212	32583	TCP
2024-09-19T14:53:42.358721+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.5	49754	198.23.227.212	32583	TCP
2024-09-19T14:53:45.058650+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.5	49755	198.23.227.212	32583	TCP
2024-09-19T14:53:47.659026+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.5	49756	198.23.227.212	32583	TCP
2024-09-19T14:53:50.976382+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.5	49757	198.23.227.212	32583	TCP
2024-09-19T14:53:53.528548+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.5	49758	198.23.227.212	32583	TCP
2024-09-19T14:53:56.112794+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.5	49759	198.23.227.212	32583	TCP
2024-09-19T14:53:58.687765+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.5	49760	198.23.227.212	32583	TCP
2024-09-19T14:54:01.308899+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.5	49761	198.23.227.212	32583	TCP
2024-09-19T14:54:03.900262+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.5	49762	198.23.227.212	32583	TCP
2024-09-19T14:54:06.520574+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.5	49763	198.23.227.212	32583	TCP
2024-09-19T14:54:09.028558+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.5	49764	198.23.227.212	32583	TCP
2024-09-19T14:54:11.600523+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.5	49765	198.23.227.212	32583	TCP
2024-09-19T14:54:14.137294+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.5	49766	198.23.227.212	32583	TCP
2024-09-19T14:54:16.547704+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.5	49767	198.23.227.212	32583	TCP
2024-09-19T14:54:18.921513+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.5	49768	198.23.227.212	32583	TCP
2024-09-19T14:54:21.281640+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.5	49769	198.23.227.212	32583	TCP
2024-09-19T14:54:23.627004+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.5	49770	198.23.227.212	32583	TCP
2024-09-19T14:54:25.942626+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.5	49771	198.23.227.212	32583	TCP
2024-09-19T14:54:28.244479+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.5	49772	198.23.227.212	32583	TCP
2024-09-19T14:54:30.534465+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.5	49773	198.23.227.212	32583	TCP
2024-09-19T14:54:32.766687+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.5	49774	198.23.227.212	32583	TCP
2024-09-19T14:54:34.983943+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.5	49775	198.23.227.212	32583	TCP
2024-09-19T14:54:37.153992+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.5	49776	198.23.227.212	32583	TCP
2024-09-19T14:54:39.345124+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.5	49777	198.23.227.212	32583	TCP
2024-09-19T14:54:41.692626+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.5	49778	198.23.227.212	32583	TCP
2024-09-19T14:54:43.826007+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.5	49779	198.23.227.212	32583	TCP
2024-09-19T14:54:46.032560+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.5	49780	198.23.227.212	32583	TCP
2024-09-19T14:54:48.090252+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.5	49781	198.23.227.212	32583	TCP
2024-09-19T14:54:50.180012+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.5	49782	198.23.227.212	32583	TCP
2024-09-19T14:54:52.217806+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.5	49783	198.23.227.212	32583	TCP
2024-09-19T14:54:54.642709+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.5	49784	198.23.227.212	32583	TCP
2024-09-19T14:54:56.677325+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.5	49785	198.23.227.212	32583	TCP
2024-09-19T14:54:58.685180+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.5	49786	198.23.227.212	32583	TCP
2024-09-19T14:55:00.688737+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.5	49787	198.23.227.212	32583	TCP
2024-09-19T14:55:02.965459+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.5	49788	198.23.227.212	32583	TCP
2024-09-19T14:55:05.015293+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.5	49789	198.23.227.212	32583	TCP
2024-09-19T14:55:06.981471+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.5	49790	198.23.227.212	32583	TCP
2024-09-19T14:55:08.922870+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.5	49791	198.23.227.212	32583	TCP
2024-09-19T14:55:11.208960+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.5	49792	198.23.227.212	32583	TCP
2024-09-19T14:55:13.271815+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.5	49793	198.23.227.212	32583	TCP
2024-09-19T14:55:15.266891+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.5	49794	198.23.227.212	32583	TCP
2024-09-19T14:55:17.185810+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.5	49795	198.23.227.212	32583	TCP
2024-09-19T14:55:19.204292+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.5	49796	198.23.227.212	32583	TCP
2024-09-19T14:55:21.534203+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.5	49797	198.23.227.212	32583	TCP
2024-09-19T14:55:23.610667+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.5	49798	198.23.227.212	32583	TCP
2024-09-19T14:55:25.500716+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.5	49799	198.23.227.212	32583	TCP
2024-09-19T14:55:27.392054+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.5	49800	198.23.227.212	32583	TCP
2024-09-19T14:55:29.359496+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.5	49801	198.23.227.212	32583	TCP
2024-09-19T14:55:31.312314+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.5	49802	198.23.227.212	32583	TCP
2024-09-19T14:55:33.140228+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.5	49803	198.23.227.212	32583	TCP
2024-09-19T14:55:34.986705+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.5	49804	198.23.227.212	32583	TCP
2024-09-19T14:55:36.880675+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.5	49805	198.23.227.212	32583	TCP
2024-09-19T14:55:38.812703+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.5	49806	198.23.227.212	32583	TCP
2024-09-19T14:55:40.763845+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.5	49807	198.23.227.212	32583	TCP
2024-09-19T14:55:42.832646+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.5	49808	198.23.227.212	32583	TCP
2024-09-19T14:55:44.707654+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.5	49809	198.23.227.212	32583	TCP
2024-09-19T14:55:46.547911+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.5	49810	198.23.227.212	32583	TCP
2024-09-19T14:55:48.670309+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.5	49811	198.23.227.212	32583	TCP
2024-09-19T14:55:50.560438+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.5	49812	198.23.227.212	32583	TCP
2024-09-19T14:55:52.500913+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.5	49813	198.23.227.212	32583	TCP
2024-09-19T14:55:54.453269+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.5	49814	198.23.227.212	32583	TCP
2024-09-19T14:55:56.361527+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.5	49815	198.23.227.212	32583	TCP
2024-09-19T14:55:58.308418+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.5	49816	198.23.227.212	32583	TCP
2024-09-19T14:56:00.143402+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.5	49817	198.23.227.212	32583	TCP
2024-09-19T14:56:01.983339+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.5	49818	198.23.227.212	32583	TCP
2024-09-19T14:56:03.884617+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.5	49819	198.23.227.212	32583	TCP
2024-09-19T14:56:05.724651+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.5	49820	198.23.227.212	32583	TCP
2024-09-19T14:56:08.068766+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.5	49821	198.23.227.212	32583	TCP
2024-09-19T14:56:09.967988+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.5	49822	198.23.227.212	32583	TCP
2024-09-19T14:56:11.849951+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.5	49823	198.23.227.212	32583	TCP
2024-09-19T14:56:13.701731+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.5	49824	198.23.227.212	32583	TCP
2024-09-19T14:56:15.568650+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.5	49825	198.23.227.212	32583	TCP
2024-09-19T14:56:17.405510+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.5	49826	198.23.227.212	32583	TCP
2024-09-19T14:56:19.265195+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.5	49827	198.23.227.212	32583	TCP
2024-09-19T14:56:21.143403+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.5	49828	198.23.227.212	32583	TCP
2024-09-19T14:56:23.019231+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.5	49829	198.23.227.212	32583	TCP
2024-09-19T14:56:24.688731+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.5	49830	198.23.227.212	32583	TCP
2024-09-19T14:56:26.547301+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.5	49831	198.23.227.212	32583	TCP
2024-09-19T14:56:29.389220+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.5	49832	198.23.227.212	32583	TCP
2024-09-19T14:56:31.369951+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.5	49833	198.23.227.212	32583	TCP
2024-09-19T14:56:33.235479+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.5	49834	198.23.227.212	32583	TCP
2024-09-19T14:56:35.047492+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.5	49835	198.23.227.212	32583	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 19, 2024 14:52:33.994533062 CEST	49720	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:52:33.999543905 CEST	32583	49720	198.23.227.212	192.168.2.5
Sep 19, 2024 14:52:34.000477076 CEST	49720	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:52:34.872534990 CEST	49720	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:52:34.877479076 CEST	32583	49720	198.23.227.212	192.168.2.5
Sep 19, 2024 14:52:35.573569059 CEST	32583	49720	198.23.227.212	192.168.2.5
Sep 19, 2024 14:52:35.576605082 CEST	49720	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:52:35.576605082 CEST	49720	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:52:35.581485033 CEST	32583	49720	198.23.227.212	192.168.2.5
Sep 19, 2024 14:52:36.589978933 CEST	49722	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:52:36.594901085 CEST	32583	49722	198.23.227.212	192.168.2.5
Sep 19, 2024 14:52:36.594999075 CEST	49722	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:52:36.598562002 CEST	49722	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:52:36.606153011 CEST	32583	49722	198.23.227.212	192.168.2.5
Sep 19, 2024 14:52:38.134902000 CEST	32583	49722	198.23.227.212	192.168.2.5
Sep 19, 2024 14:52:38.134974003 CEST	49722	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:52:38.135109901 CEST	49722	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:52:38.139898062 CEST	32583	49722	198.23.227.212	192.168.2.5
Sep 19, 2024 14:52:39.150685072 CEST	49723	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:52:39.155627966 CEST	32583	49723	198.23.227.212	192.168.2.5
Sep 19, 2024 14:52:39.155706882 CEST	49723	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:52:39.160003901 CEST	49723	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:52:39.164895058 CEST	32583	49723	198.23.227.212	192.168.2.5
Sep 19, 2024 14:52:40.698064089 CEST	32583	49723	198.23.227.212	192.168.2.5
Sep 19, 2024 14:52:40.698175907 CEST	49723	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:52:40.698350906 CEST	49723	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:52:40.703140020 CEST	32583	49723	198.23.227.212	192.168.2.5
Sep 19, 2024 14:52:41.712990046 CEST	49725	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:52:41.718230963 CEST	32583	49725	198.23.227.212	192.168.2.5
Sep 19, 2024 14:52:41.718322992 CEST	49725	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:52:41.722076893 CEST	49725	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:52:41.726926088 CEST	32583	49725	198.23.227.212	192.168.2.5
Sep 19, 2024 14:52:43.260061026 CEST	32583	49725	198.23.227.212	192.168.2.5
Sep 19, 2024 14:52:43.260126114 CEST	49725	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:52:43.262140036 CEST	49725	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:52:43.266930103 CEST	32583	49725	198.23.227.212	192.168.2.5
Sep 19, 2024 14:52:44.275664091 CEST	49730	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:52:44.280524969 CEST	32583	49730	198.23.227.212	192.168.2.5
Sep 19, 2024 14:52:44.280608892 CEST	49730	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:52:44.284547091 CEST	49730	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:52:44.289376974 CEST	32583	49730	198.23.227.212	192.168.2.5
Sep 19, 2024 14:52:45.880458117 CEST	32583	49730	198.23.227.212	192.168.2.5
Sep 19, 2024 14:52:45.880625963 CEST	49730	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:52:45.880788088 CEST	49730	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:52:45.885768890 CEST	32583	49730	198.23.227.212	192.168.2.5
Sep 19, 2024 14:52:46.885149002 CEST	49731	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:52:46.890106916 CEST	32583	49731	198.23.227.212	192.168.2.5
Sep 19, 2024 14:52:46.890181065 CEST	49731	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:52:46.894021988 CEST	49731	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:52:46.901379108 CEST	32583	49731	198.23.227.212	192.168.2.5
Sep 19, 2024 14:52:48.466099024 CEST	32583	49731	198.23.227.212	192.168.2.5
Sep 19, 2024 14:52:48.466159105 CEST	49731	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:52:48.466341972 CEST	49731	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:52:48.471066952 CEST	32583	49731	198.23.227.212	192.168.2.5
Sep 19, 2024 14:52:49.496469975 CEST	49733	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:52:49.502342939 CEST	32583	49733	198.23.227.212	192.168.2.5
Sep 19, 2024 14:52:49.502448082 CEST	49733	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:52:49.506246090 CEST	49733	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:52:49.511432886 CEST	32583	49733	198.23.227.212	192.168.2.5
Sep 19, 2024 14:52:51.061687946 CEST	32583	49733	198.23.227.212	192.168.2.5
Sep 19, 2024 14:52:51.061897039 CEST	49733	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:52:51.061948061 CEST	49733	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:52:51.066757917 CEST	32583	49733	198.23.227.212	192.168.2.5
Sep 19, 2024 14:52:52.072721004 CEST	49734	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:52:52.077641010 CEST	32583	49734	198.23.227.212	192.168.2.5
Sep 19, 2024 14:52:52.078908920 CEST	49734	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:52:52.083868980 CEST	49734	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:52:52.088709116 CEST	32583	49734	198.23.227.212	192.168.2.5
Sep 19, 2024 14:52:53.710557938 CEST	32583	49734	198.23.227.212	192.168.2.5
Sep 19, 2024 14:52:53.710623980 CEST	49734	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:52:53.710808039 CEST	49734	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:52:53.954739094 CEST	32583	49734	198.23.227.212	192.168.2.5
Sep 19, 2024 14:52:53.954855919 CEST	49734	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:52:53.960201979 CEST	32583	49734	198.23.227.212	192.168.2.5
Sep 19, 2024 14:52:54.713047981 CEST	49735	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:52:54.867147923 CEST	32583	49735	198.23.227.212	192.168.2.5
Sep 19, 2024 14:52:54.867324114 CEST	49735	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:52:55.002087116 CEST	49735	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:52:55.081916094 CEST	32583	49735	198.23.227.212	192.168.2.5
Sep 19, 2024 14:52:56.432255983 CEST	32583	49735	198.23.227.212	192.168.2.5
Sep 19, 2024 14:52:56.432313919 CEST	49735	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:52:56.432403088 CEST	49735	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:52:56.437194109 CEST	32583	49735	198.23.227.212	192.168.2.5
Sep 19, 2024 14:52:57.447370052 CEST	49736	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:52:57.452219963 CEST	32583	49736	198.23.227.212	192.168.2.5
Sep 19, 2024 14:52:57.452336073 CEST	49736	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:52:57.456409931 CEST	49736	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:52:57.461313009 CEST	32583	49736	198.23.227.212	192.168.2.5
Sep 19, 2024 14:52:59.016006947 CEST	32583	49736	198.23.227.212	192.168.2.5
Sep 19, 2024 14:52:59.016129017 CEST	49736	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:52:59.016292095 CEST	49736	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:52:59.021017075 CEST	32583	49736	198.23.227.212	192.168.2.5
Sep 19, 2024 14:53:00.025544882 CEST	49737	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:53:00.030374050 CEST	32583	49737	198.23.227.212	192.168.2.5
Sep 19, 2024 14:53:00.030494928 CEST	49737	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:53:00.033873081 CEST	49737	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:53:00.038696051 CEST	32583	49737	198.23.227.212	192.168.2.5
Sep 19, 2024 14:53:01.607285023 CEST	32583	49737	198.23.227.212	192.168.2.5
Sep 19, 2024 14:53:01.607405901 CEST	49737	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:53:01.607597113 CEST	49737	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:53:01.612271070 CEST	32583	49737	198.23.227.212	192.168.2.5
Sep 19, 2024 14:53:02.740283012 CEST	49738	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:53:02.745400906 CEST	32583	49738	198.23.227.212	192.168.2.5
Sep 19, 2024 14:53:02.745486021 CEST	49738	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:53:02.749298096 CEST	49738	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:53:02.754194975 CEST	32583	49738	198.23.227.212	192.168.2.5
Sep 19, 2024 14:53:04.312758923 CEST	32583	49738	198.23.227.212	192.168.2.5
Sep 19, 2024 14:53:04.312880039 CEST	49738	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:53:04.313060045 CEST	49738	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:53:04.317874908 CEST	32583	49738	198.23.227.212	192.168.2.5
Sep 19, 2024 14:53:05.322509050 CEST	49739	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:53:05.327491999 CEST	32583	49739	198.23.227.212	192.168.2.5
Sep 19, 2024 14:53:05.327589035 CEST	49739	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:53:05.335896015 CEST	49739	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:53:05.340745926 CEST	32583	49739	198.23.227.212	192.168.2.5
Sep 19, 2024 14:53:06.951649904 CEST	32583	49739	198.23.227.212	192.168.2.5
Sep 19, 2024 14:53:06.951778889 CEST	49739	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:53:06.951983929 CEST	49739	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:53:06.956728935 CEST	32583	49739	198.23.227.212	192.168.2.5
Sep 19, 2024 14:53:07.963051081 CEST	49740	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:53:07.968136072 CEST	32583	49740	198.23.227.212	192.168.2.5
Sep 19, 2024 14:53:07.968209028 CEST	49740	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:53:07.971487045 CEST	49740	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:53:07.976284027 CEST	32583	49740	198.23.227.212	192.168.2.5
Sep 19, 2024 14:53:09.548722029 CEST	32583	49740	198.23.227.212	192.168.2.5
Sep 19, 2024 14:53:09.548832893 CEST	49740	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:53:09.548991919 CEST	49740	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:53:09.553759098 CEST	32583	49740	198.23.227.212	192.168.2.5
Sep 19, 2024 14:53:10.556854963 CEST	49741	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:53:10.562136889 CEST	32583	49741	198.23.227.212	192.168.2.5
Sep 19, 2024 14:53:10.562213898 CEST	49741	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:53:10.565608978 CEST	49741	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:53:10.570650101 CEST	32583	49741	198.23.227.212	192.168.2.5
Sep 19, 2024 14:53:12.136049032 CEST	32583	49741	198.23.227.212	192.168.2.5
Sep 19, 2024 14:53:12.136126041 CEST	49741	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:53:12.136315107 CEST	49741	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:53:12.143212080 CEST	32583	49741	198.23.227.212	192.168.2.5
Sep 19, 2024 14:53:13.150602102 CEST	49742	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:53:13.155577898 CEST	32583	49742	198.23.227.212	192.168.2.5
Sep 19, 2024 14:53:13.156483889 CEST	49742	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:53:13.159903049 CEST	49742	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:53:13.164968967 CEST	32583	49742	198.23.227.212	192.168.2.5
Sep 19, 2024 14:53:14.713562012 CEST	32583	49742	198.23.227.212	192.168.2.5
Sep 19, 2024 14:53:14.713699102 CEST	49742	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:53:14.713844061 CEST	49742	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:53:14.718635082 CEST	32583	49742	198.23.227.212	192.168.2.5
Sep 19, 2024 14:53:15.728777885 CEST	49743	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:53:16.743717909 CEST	49743	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:53:16.797522068 CEST	32583	49743	198.23.227.212	192.168.2.5
Sep 19, 2024 14:53:16.797687054 CEST	49743	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:53:16.801321030 CEST	49743	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:53:16.802057028 CEST	32583	49743	198.23.227.212	192.168.2.5
Sep 19, 2024 14:53:16.802119017 CEST	49743	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:53:16.806114912 CEST	32583	49743	198.23.227.212	192.168.2.5
Sep 19, 2024 14:53:18.354993105 CEST	32583	49743	198.23.227.212	192.168.2.5
Sep 19, 2024 14:53:18.355118036 CEST	49743	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:53:18.355274916 CEST	49743	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:53:18.359998941 CEST	32583	49743	198.23.227.212	192.168.2.5
Sep 19, 2024 14:53:19.369501114 CEST	49744	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:53:19.374500990 CEST	32583	49744	198.23.227.212	192.168.2.5
Sep 19, 2024 14:53:19.374592066 CEST	49744	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:53:19.379476070 CEST	49744	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:53:19.384360075 CEST	32583	49744	198.23.227.212	192.168.2.5
Sep 19, 2024 14:53:20.917206049 CEST	32583	49744	198.23.227.212	192.168.2.5
Sep 19, 2024 14:53:20.917326927 CEST	49744	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:53:20.917511940 CEST	49744	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:53:20.922333002 CEST	32583	49744	198.23.227.212	192.168.2.5
Sep 19, 2024 14:53:21.931740999 CEST	49746	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:53:21.936784983 CEST	32583	49746	198.23.227.212	192.168.2.5
Sep 19, 2024 14:53:21.937306881 CEST	49746	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:53:21.941800117 CEST	49746	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:53:21.946713924 CEST	32583	49746	198.23.227.212	192.168.2.5
Sep 19, 2024 14:53:23.513030052 CEST	32583	49746	198.23.227.212	192.168.2.5
Sep 19, 2024 14:53:23.513235092 CEST	49746	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:53:23.513372898 CEST	49746	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:53:23.518208981 CEST	32583	49746	198.23.227.212	192.168.2.5
Sep 19, 2024 14:53:24.528507948 CEST	49748	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:53:24.533392906 CEST	32583	49748	198.23.227.212	192.168.2.5
Sep 19, 2024 14:53:24.533473969 CEST	49748	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:53:24.539318085 CEST	49748	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:53:24.551264048 CEST	32583	49748	198.23.227.212	192.168.2.5
Sep 19, 2024 14:53:26.151535034 CEST	32583	49748	198.23.227.212	192.168.2.5
Sep 19, 2024 14:53:26.151715994 CEST	49748	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:53:26.151832104 CEST	49748	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:53:26.156697989 CEST	32583	49748	198.23.227.212	192.168.2.5
Sep 19, 2024 14:53:27.166193962 CEST	49749	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:53:27.181257963 CEST	32583	49749	198.23.227.212	192.168.2.5
Sep 19, 2024 14:53:27.181523085 CEST	49749	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:53:27.201807022 CEST	49749	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:53:27.206763029 CEST	32583	49749	198.23.227.212	192.168.2.5
Sep 19, 2024 14:53:28.747468948 CEST	32583	49749	198.23.227.212	192.168.2.5
Sep 19, 2024 14:53:28.751224041 CEST	49749	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:53:28.751396894 CEST	49749	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:53:28.756218910 CEST	32583	49749	198.23.227.212	192.168.2.5
Sep 19, 2024 14:53:29.768021107 CEST	49750	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:53:30.341738939 CEST	32583	49750	198.23.227.212	192.168.2.5
Sep 19, 2024 14:53:30.341840982 CEST	49750	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:53:30.345297098 CEST	49750	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:53:30.352437019 CEST	32583	49750	198.23.227.212	192.168.2.5
Sep 19, 2024 14:53:31.934734106 CEST	32583	49750	198.23.227.212	192.168.2.5
Sep 19, 2024 14:53:31.934813023 CEST	49750	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:53:31.934880972 CEST	49750	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:53:31.940794945 CEST	32583	49750	198.23.227.212	192.168.2.5
Sep 19, 2024 14:53:32.947474957 CEST	49751	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:53:32.952367067 CEST	32583	49751	198.23.227.212	192.168.2.5
Sep 19, 2024 14:53:32.952505112 CEST	49751	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:53:32.955842972 CEST	49751	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:53:32.960709095 CEST	32583	49751	198.23.227.212	192.168.2.5
Sep 19, 2024 14:53:34.550148010 CEST	32583	49751	198.23.227.212	192.168.2.5
Sep 19, 2024 14:53:34.550283909 CEST	49751	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:53:34.550425053 CEST	49751	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:53:34.555371046 CEST	32583	49751	198.23.227.212	192.168.2.5
Sep 19, 2024 14:53:35.565145969 CEST	49752	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:53:35.570261002 CEST	32583	49752	198.23.227.212	192.168.2.5
Sep 19, 2024 14:53:35.570374012 CEST	49752	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:53:35.632159948 CEST	49752	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:53:35.636996031 CEST	32583	49752	198.23.227.212	192.168.2.5
Sep 19, 2024 14:53:37.159321070 CEST	32583	49752	198.23.227.212	192.168.2.5
Sep 19, 2024 14:53:37.159502983 CEST	49752	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:53:37.159636974 CEST	49752	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:53:37.167473078 CEST	32583	49752	198.23.227.212	192.168.2.5
Sep 19, 2024 14:53:38.166440010 CEST	49753	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:53:38.171760082 CEST	32583	49753	198.23.227.212	192.168.2.5
Sep 19, 2024 14:53:38.171873093 CEST	49753	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:53:38.175456047 CEST	49753	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:53:38.180330038 CEST	32583	49753	198.23.227.212	192.168.2.5
Sep 19, 2024 14:53:39.762298107 CEST	32583	49753	198.23.227.212	192.168.2.5
Sep 19, 2024 14:53:39.762402058 CEST	49753	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:53:39.762552023 CEST	49753	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:53:39.768085003 CEST	32583	49753	198.23.227.212	192.168.2.5
Sep 19, 2024 14:53:40.775804996 CEST	49754	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:53:40.780925989 CEST	32583	49754	198.23.227.212	192.168.2.5
Sep 19, 2024 14:53:40.781002998 CEST	49754	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:53:40.784720898 CEST	49754	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:53:40.789525986 CEST	32583	49754	198.23.227.212	192.168.2.5
Sep 19, 2024 14:53:42.358622074 CEST	32583	49754	198.23.227.212	192.168.2.5
Sep 19, 2024 14:53:42.358721018 CEST	49754	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:53:42.358947992 CEST	49754	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:53:42.365087986 CEST	32583	49754	198.23.227.212	192.168.2.5
Sep 19, 2024 14:53:43.369270086 CEST	49755	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:53:43.374275923 CEST	32583	49755	198.23.227.212	192.168.2.5
Sep 19, 2024 14:53:43.374372959 CEST	49755	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:53:43.377715111 CEST	49755	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:53:43.382570982 CEST	32583	49755	198.23.227.212	192.168.2.5
Sep 19, 2024 14:53:45.055145979 CEST	32583	49755	198.23.227.212	192.168.2.5
Sep 19, 2024 14:53:45.058650017 CEST	49755	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:53:45.058850050 CEST	49755	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:53:45.063605070 CEST	32583	49755	198.23.227.212	192.168.2.5
Sep 19, 2024 14:53:46.072633028 CEST	49756	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:53:46.077759027 CEST	32583	49756	198.23.227.212	192.168.2.5
Sep 19, 2024 14:53:46.077866077 CEST	49756	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:53:46.081187010 CEST	49756	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:53:46.086237907 CEST	32583	49756	198.23.227.212	192.168.2.5
Sep 19, 2024 14:53:47.655781984 CEST	32583	49756	198.23.227.212	192.168.2.5
Sep 19, 2024 14:53:47.659025908 CEST	49756	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:53:47.659209967 CEST	49756	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:53:47.664102077 CEST	32583	49756	198.23.227.212	192.168.2.5
Sep 19, 2024 14:53:48.679610014 CEST	49757	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:53:48.684705973 CEST	32583	49757	198.23.227.212	192.168.2.5
Sep 19, 2024 14:53:48.684779882 CEST	49757	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:53:48.689882994 CEST	49757	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:53:48.694672108 CEST	32583	49757	198.23.227.212	192.168.2.5
Sep 19, 2024 14:53:50.976135969 CEST	32583	49757	198.23.227.212	192.168.2.5
Sep 19, 2024 14:53:50.976216078 CEST	32583	49757	198.23.227.212	192.168.2.5
Sep 19, 2024 14:53:50.976382017 CEST	49757	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:53:50.976382017 CEST	49757	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:53:50.976387024 CEST	32583	49757	198.23.227.212	192.168.2.5
Sep 19, 2024 14:53:50.976428032 CEST	49757	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:53:50.976480007 CEST	49757	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:53:50.982228994 CEST	32583	49757	198.23.227.212	192.168.2.5
Sep 19, 2024 14:53:51.978769064 CEST	49758	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:53:51.983762026 CEST	32583	49758	198.23.227.212	192.168.2.5
Sep 19, 2024 14:53:51.983901978 CEST	49758	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:53:51.987509012 CEST	49758	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:53:51.992415905 CEST	32583	49758	198.23.227.212	192.168.2.5
Sep 19, 2024 14:53:53.527559996 CEST	32583	49758	198.23.227.212	192.168.2.5
Sep 19, 2024 14:53:53.528548002 CEST	49758	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:53:53.528745890 CEST	49758	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:53:53.533556938 CEST	32583	49758	198.23.227.212	192.168.2.5
Sep 19, 2024 14:53:54.541134119 CEST	49759	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:53:54.546360016 CEST	32583	49759	198.23.227.212	192.168.2.5
Sep 19, 2024 14:53:54.546474934 CEST	49759	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:53:54.549283028 CEST	49759	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:53:54.554323912 CEST	32583	49759	198.23.227.212	192.168.2.5
Sep 19, 2024 14:53:56.111242056 CEST	32583	49759	198.23.227.212	192.168.2.5
Sep 19, 2024 14:53:56.112793922 CEST	49759	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:53:56.112793922 CEST	49759	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:53:56.117789984 CEST	32583	49759	198.23.227.212	192.168.2.5
Sep 19, 2024 14:53:57.119178057 CEST	49760	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:53:57.124155998 CEST	32583	49760	198.23.227.212	192.168.2.5
Sep 19, 2024 14:53:57.124526024 CEST	49760	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:53:57.127760887 CEST	49760	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:53:57.132828951 CEST	32583	49760	198.23.227.212	192.168.2.5
Sep 19, 2024 14:53:58.687359095 CEST	32583	49760	198.23.227.212	192.168.2.5
Sep 19, 2024 14:53:58.687764883 CEST	49760	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:53:58.687973022 CEST	49760	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:53:58.692842007 CEST	32583	49760	198.23.227.212	192.168.2.5
Sep 19, 2024 14:53:59.742592096 CEST	49761	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:53:59.747581959 CEST	32583	49761	198.23.227.212	192.168.2.5
Sep 19, 2024 14:53:59.747664928 CEST	49761	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:53:59.754394054 CEST	49761	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:53:59.759623051 CEST	32583	49761	198.23.227.212	192.168.2.5
Sep 19, 2024 14:54:01.308805943 CEST	32583	49761	198.23.227.212	192.168.2.5
Sep 19, 2024 14:54:01.308898926 CEST	49761	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:54:01.309037924 CEST	49761	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:54:01.313817024 CEST	32583	49761	198.23.227.212	192.168.2.5
Sep 19, 2024 14:54:02.309520960 CEST	49762	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:54:02.314806938 CEST	32583	49762	198.23.227.212	192.168.2.5
Sep 19, 2024 14:54:02.314928055 CEST	49762	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:54:02.318291903 CEST	49762	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:54:02.541008949 CEST	32583	49762	198.23.227.212	192.168.2.5
Sep 19, 2024 14:54:03.898729086 CEST	32583	49762	198.23.227.212	192.168.2.5
Sep 19, 2024 14:54:03.900262117 CEST	49762	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:54:03.900396109 CEST	49762	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:54:03.905235052 CEST	32583	49762	198.23.227.212	192.168.2.5
Sep 19, 2024 14:54:04.838084936 CEST	49763	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:54:04.844188929 CEST	32583	49763	198.23.227.212	192.168.2.5
Sep 19, 2024 14:54:04.844311953 CEST	49763	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:54:04.849019051 CEST	49763	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:54:04.853864908 CEST	32583	49763	198.23.227.212	192.168.2.5
Sep 19, 2024 14:54:06.518373013 CEST	32583	49763	198.23.227.212	192.168.2.5
Sep 19, 2024 14:54:06.520574093 CEST	49763	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:54:06.520829916 CEST	49763	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:54:06.525609970 CEST	32583	49763	198.23.227.212	192.168.2.5
Sep 19, 2024 14:54:07.431869030 CEST	49764	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:54:07.436950922 CEST	32583	49764	198.23.227.212	192.168.2.5
Sep 19, 2024 14:54:07.437083006 CEST	49764	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:54:07.440496922 CEST	49764	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:54:07.448437929 CEST	32583	49764	198.23.227.212	192.168.2.5
Sep 19, 2024 14:54:09.026490927 CEST	32583	49764	198.23.227.212	192.168.2.5
Sep 19, 2024 14:54:09.028558016 CEST	49764	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:54:09.029717922 CEST	49764	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:54:09.039092064 CEST	32583	49764	198.23.227.212	192.168.2.5
Sep 19, 2024 14:54:09.916023016 CEST	49765	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:54:09.921008110 CEST	32583	49765	198.23.227.212	192.168.2.5
Sep 19, 2024 14:54:09.921091080 CEST	49765	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:54:09.924428940 CEST	49765	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:54:09.929328918 CEST	32583	49765	198.23.227.212	192.168.2.5
Sep 19, 2024 14:54:11.599678993 CEST	32583	49765	198.23.227.212	192.168.2.5
Sep 19, 2024 14:54:11.600522995 CEST	49765	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:54:11.600665092 CEST	49765	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:54:11.605608940 CEST	32583	49765	198.23.227.212	192.168.2.5
Sep 19, 2024 14:54:12.447355032 CEST	49766	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:54:12.580149889 CEST	32583	49766	198.23.227.212	192.168.2.5
Sep 19, 2024 14:54:12.580248117 CEST	49766	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:54:12.740673065 CEST	49766	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:54:12.894577026 CEST	32583	49766	198.23.227.212	192.168.2.5
Sep 19, 2024 14:54:14.137198925 CEST	32583	49766	198.23.227.212	192.168.2.5
Sep 19, 2024 14:54:14.137294054 CEST	49766	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:54:14.137399912 CEST	49766	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:54:14.142261028 CEST	32583	49766	198.23.227.212	192.168.2.5
Sep 19, 2024 14:54:14.963244915 CEST	49767	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:54:14.968122005 CEST	32583	49767	198.23.227.212	192.168.2.5
Sep 19, 2024 14:54:14.968244076 CEST	49767	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:54:14.972963095 CEST	49767	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:54:14.977684975 CEST	32583	49767	198.23.227.212	192.168.2.5
Sep 19, 2024 14:54:16.547554016 CEST	32583	49767	198.23.227.212	192.168.2.5
Sep 19, 2024 14:54:16.547703981 CEST	49767	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:54:16.547823906 CEST	49767	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:54:16.552614927 CEST	32583	49767	198.23.227.212	192.168.2.5
Sep 19, 2024 14:54:17.338025093 CEST	49768	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:54:17.343017101 CEST	32583	49768	198.23.227.212	192.168.2.5
Sep 19, 2024 14:54:17.343327045 CEST	49768	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:54:17.348341942 CEST	49768	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:54:17.353404045 CEST	32583	49768	198.23.227.212	192.168.2.5
Sep 19, 2024 14:54:18.921420097 CEST	32583	49768	198.23.227.212	192.168.2.5
Sep 19, 2024 14:54:18.921513081 CEST	49768	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:54:18.921700001 CEST	49768	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:54:18.926597118 CEST	32583	49768	198.23.227.212	192.168.2.5
Sep 19, 2024 14:54:19.697386026 CEST	49769	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:54:19.702377081 CEST	32583	49769	198.23.227.212	192.168.2.5
Sep 19, 2024 14:54:19.702490091 CEST	49769	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:54:19.705770016 CEST	49769	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:54:19.710630894 CEST	32583	49769	198.23.227.212	192.168.2.5
Sep 19, 2024 14:54:21.281567097 CEST	32583	49769	198.23.227.212	192.168.2.5
Sep 19, 2024 14:54:21.281640053 CEST	49769	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:54:21.288876057 CEST	49769	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:54:21.293782949 CEST	32583	49769	198.23.227.212	192.168.2.5
Sep 19, 2024 14:54:22.043282032 CEST	49770	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:54:22.048521042 CEST	32583	49770	198.23.227.212	192.168.2.5
Sep 19, 2024 14:54:22.048593998 CEST	49770	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:54:22.053492069 CEST	49770	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:54:22.058509111 CEST	32583	49770	198.23.227.212	192.168.2.5
Sep 19, 2024 14:54:23.626887083 CEST	32583	49770	198.23.227.212	192.168.2.5
Sep 19, 2024 14:54:23.627003908 CEST	49770	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:54:23.627129078 CEST	49770	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:54:23.631849051 CEST	32583	49770	198.23.227.212	192.168.2.5
Sep 19, 2024 14:54:24.353656054 CEST	49771	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:54:24.358644009 CEST	32583	49771	198.23.227.212	192.168.2.5
Sep 19, 2024 14:54:24.358727932 CEST	49771	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:54:24.362427950 CEST	49771	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:54:24.367363930 CEST	32583	49771	198.23.227.212	192.168.2.5
Sep 19, 2024 14:54:25.942123890 CEST	32583	49771	198.23.227.212	192.168.2.5
Sep 19, 2024 14:54:25.942625999 CEST	49771	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:54:25.942832947 CEST	49771	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:54:25.947571993 CEST	32583	49771	198.23.227.212	192.168.2.5
Sep 19, 2024 14:54:26.637341022 CEST	49772	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:54:26.642328978 CEST	32583	49772	198.23.227.212	192.168.2.5
Sep 19, 2024 14:54:26.642421007 CEST	49772	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:54:26.646440983 CEST	49772	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:54:26.651297092 CEST	32583	49772	198.23.227.212	192.168.2.5
Sep 19, 2024 14:54:28.243572950 CEST	32583	49772	198.23.227.212	192.168.2.5
Sep 19, 2024 14:54:28.244478941 CEST	49772	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:54:28.244478941 CEST	49772	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:54:28.249342918 CEST	32583	49772	198.23.227.212	192.168.2.5
Sep 19, 2024 14:54:28.916578054 CEST	49773	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:54:28.921967030 CEST	32583	49773	198.23.227.212	192.168.2.5
Sep 19, 2024 14:54:28.922075033 CEST	49773	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:54:28.926374912 CEST	49773	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:54:28.931366920 CEST	32583	49773	198.23.227.212	192.168.2.5
Sep 19, 2024 14:54:30.534392118 CEST	32583	49773	198.23.227.212	192.168.2.5
Sep 19, 2024 14:54:30.534465075 CEST	49773	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:54:30.534590960 CEST	49773	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:54:30.539350986 CEST	32583	49773	198.23.227.212	192.168.2.5
Sep 19, 2024 14:54:31.181860924 CEST	49774	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:54:31.186917067 CEST	32583	49774	198.23.227.212	192.168.2.5
Sep 19, 2024 14:54:31.191138983 CEST	49774	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:54:31.194534063 CEST	49774	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:54:31.199378014 CEST	32583	49774	198.23.227.212	192.168.2.5
Sep 19, 2024 14:54:32.764153957 CEST	32583	49774	198.23.227.212	192.168.2.5
Sep 19, 2024 14:54:32.766686916 CEST	49774	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:54:32.766856909 CEST	49774	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:54:32.771626949 CEST	32583	49774	198.23.227.212	192.168.2.5
Sep 19, 2024 14:54:33.401283979 CEST	49775	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:54:33.406408072 CEST	32583	49775	198.23.227.212	192.168.2.5
Sep 19, 2024 14:54:33.406547070 CEST	49775	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:54:33.411819935 CEST	49775	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:54:33.416724920 CEST	32583	49775	198.23.227.212	192.168.2.5
Sep 19, 2024 14:54:34.983733892 CEST	32583	49775	198.23.227.212	192.168.2.5
Sep 19, 2024 14:54:34.983942986 CEST	49775	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:54:34.984302044 CEST	49775	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:54:34.989202023 CEST	32583	49775	198.23.227.212	192.168.2.5
Sep 19, 2024 14:54:35.587974072 CEST	49776	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:54:35.592927933 CEST	32583	49776	198.23.227.212	192.168.2.5
Sep 19, 2024 14:54:35.593033075 CEST	49776	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:54:35.596376896 CEST	49776	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:54:35.601301908 CEST	32583	49776	198.23.227.212	192.168.2.5
Sep 19, 2024 14:54:37.153166056 CEST	32583	49776	198.23.227.212	192.168.2.5
Sep 19, 2024 14:54:37.153991938 CEST	49776	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:54:37.163295984 CEST	49776	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:54:37.168148994 CEST	32583	49776	198.23.227.212	192.168.2.5
Sep 19, 2024 14:54:37.760149956 CEST	49777	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:54:37.765173912 CEST	32583	49777	198.23.227.212	192.168.2.5
Sep 19, 2024 14:54:37.765263081 CEST	49777	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:54:37.768345118 CEST	49777	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:54:37.773212910 CEST	32583	49777	198.23.227.212	192.168.2.5
Sep 19, 2024 14:54:39.345036983 CEST	32583	49777	198.23.227.212	192.168.2.5
Sep 19, 2024 14:54:39.345124006 CEST	49777	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:54:39.345352888 CEST	49777	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:54:39.350152016 CEST	32583	49777	198.23.227.212	192.168.2.5
Sep 19, 2024 14:54:40.103806019 CEST	49778	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:54:40.108827114 CEST	32583	49778	198.23.227.212	192.168.2.5
Sep 19, 2024 14:54:40.108923912 CEST	49778	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:54:40.112355947 CEST	49778	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:54:40.117158890 CEST	32583	49778	198.23.227.212	192.168.2.5
Sep 19, 2024 14:54:41.689261913 CEST	32583	49778	198.23.227.212	192.168.2.5
Sep 19, 2024 14:54:41.692625999 CEST	49778	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:54:41.692723036 CEST	49778	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:54:41.697659969 CEST	32583	49778	198.23.227.212	192.168.2.5
Sep 19, 2024 14:54:42.244453907 CEST	49779	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:54:42.253211021 CEST	32583	49779	198.23.227.212	192.168.2.5
Sep 19, 2024 14:54:42.253299952 CEST	49779	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:54:42.258245945 CEST	49779	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:54:42.263189077 CEST	32583	49779	198.23.227.212	192.168.2.5
Sep 19, 2024 14:54:43.825824022 CEST	32583	49779	198.23.227.212	192.168.2.5
Sep 19, 2024 14:54:43.826006889 CEST	49779	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:54:43.826381922 CEST	49779	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:54:43.831192970 CEST	32583	49779	198.23.227.212	192.168.2.5
Sep 19, 2024 14:54:44.467135906 CEST	49780	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:54:44.472206116 CEST	32583	49780	198.23.227.212	192.168.2.5
Sep 19, 2024 14:54:44.472320080 CEST	49780	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:54:44.519701004 CEST	49780	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:54:44.524996042 CEST	32583	49780	198.23.227.212	192.168.2.5
Sep 19, 2024 14:54:46.031903982 CEST	32583	49780	198.23.227.212	192.168.2.5
Sep 19, 2024 14:54:46.032560110 CEST	49780	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:54:46.032958984 CEST	49780	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:54:46.037780046 CEST	32583	49780	198.23.227.212	192.168.2.5
Sep 19, 2024 14:54:46.540983915 CEST	49781	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:54:46.546025038 CEST	32583	49781	198.23.227.212	192.168.2.5
Sep 19, 2024 14:54:46.546154022 CEST	49781	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:54:46.549339056 CEST	49781	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:54:46.554167986 CEST	32583	49781	198.23.227.212	192.168.2.5
Sep 19, 2024 14:54:48.090140104 CEST	32583	49781	198.23.227.212	192.168.2.5
Sep 19, 2024 14:54:48.090251923 CEST	49781	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:54:48.090451002 CEST	49781	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:54:48.095916986 CEST	32583	49781	198.23.227.212	192.168.2.5
Sep 19, 2024 14:54:48.588005066 CEST	49782	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:54:48.593147993 CEST	32583	49782	198.23.227.212	192.168.2.5
Sep 19, 2024 14:54:48.593255997 CEST	49782	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:54:48.596519947 CEST	49782	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:54:48.602247000 CEST	32583	49782	198.23.227.212	192.168.2.5
Sep 19, 2024 14:54:50.179783106 CEST	32583	49782	198.23.227.212	192.168.2.5
Sep 19, 2024 14:54:50.180011988 CEST	49782	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:54:50.180299997 CEST	49782	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:54:50.185029030 CEST	32583	49782	198.23.227.212	192.168.2.5
Sep 19, 2024 14:54:50.666304111 CEST	49783	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:54:50.671475887 CEST	32583	49783	198.23.227.212	192.168.2.5
Sep 19, 2024 14:54:50.671566010 CEST	49783	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:54:50.674824953 CEST	49783	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:54:50.679713964 CEST	32583	49783	198.23.227.212	192.168.2.5
Sep 19, 2024 14:54:52.217161894 CEST	32583	49783	198.23.227.212	192.168.2.5
Sep 19, 2024 14:54:52.217806101 CEST	49783	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:54:52.218080997 CEST	49783	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:54:52.223000050 CEST	32583	49783	198.23.227.212	192.168.2.5
Sep 19, 2024 14:54:52.933496952 CEST	49784	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:54:52.941610098 CEST	32583	49784	198.23.227.212	192.168.2.5
Sep 19, 2024 14:54:52.942503929 CEST	49784	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:54:52.945358038 CEST	49784	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:54:52.950525999 CEST	32583	49784	198.23.227.212	192.168.2.5
Sep 19, 2024 14:54:54.639885902 CEST	32583	49784	198.23.227.212	192.168.2.5
Sep 19, 2024 14:54:54.642709017 CEST	49784	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:54:54.642904997 CEST	49784	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:54:54.647742033 CEST	32583	49784	198.23.227.212	192.168.2.5
Sep 19, 2024 14:54:55.088505030 CEST	49785	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:54:55.094588995 CEST	32583	49785	198.23.227.212	192.168.2.5
Sep 19, 2024 14:54:55.094682932 CEST	49785	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:54:55.098129034 CEST	49785	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:54:55.103871107 CEST	32583	49785	198.23.227.212	192.168.2.5
Sep 19, 2024 14:54:56.677170038 CEST	32583	49785	198.23.227.212	192.168.2.5
Sep 19, 2024 14:54:56.677325010 CEST	49785	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:54:56.677534103 CEST	49785	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:54:56.682560921 CEST	32583	49785	198.23.227.212	192.168.2.5
Sep 19, 2024 14:54:57.119505882 CEST	49786	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:54:57.124453068 CEST	32583	49786	198.23.227.212	192.168.2.5
Sep 19, 2024 14:54:57.124540091 CEST	49786	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:54:57.129735947 CEST	49786	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:54:57.134742022 CEST	32583	49786	198.23.227.212	192.168.2.5
Sep 19, 2024 14:54:58.685105085 CEST	32583	49786	198.23.227.212	192.168.2.5
Sep 19, 2024 14:54:58.685179949 CEST	49786	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:54:58.685298920 CEST	49786	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:54:58.690090895 CEST	32583	49786	198.23.227.212	192.168.2.5
Sep 19, 2024 14:54:59.103578091 CEST	49787	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:54:59.108721018 CEST	32583	49787	198.23.227.212	192.168.2.5
Sep 19, 2024 14:54:59.108812094 CEST	49787	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:54:59.111946106 CEST	49787	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:54:59.116899014 CEST	32583	49787	198.23.227.212	192.168.2.5
Sep 19, 2024 14:55:00.684782982 CEST	32583	49787	198.23.227.212	192.168.2.5
Sep 19, 2024 14:55:00.688736916 CEST	49787	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:55:00.688776016 CEST	49787	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:55:00.697622061 CEST	32583	49787	198.23.227.212	192.168.2.5
Sep 19, 2024 14:55:01.103570938 CEST	49788	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:55:01.108544111 CEST	32583	49788	198.23.227.212	192.168.2.5
Sep 19, 2024 14:55:01.108683109 CEST	49788	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:55:01.112139940 CEST	49788	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:55:01.117029905 CEST	32583	49788	198.23.227.212	192.168.2.5
Sep 19, 2024 14:55:02.965382099 CEST	32583	49788	198.23.227.212	192.168.2.5
Sep 19, 2024 14:55:02.965459108 CEST	49788	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:55:02.965676069 CEST	49788	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:55:03.353730917 CEST	49789	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:55:03.431149960 CEST	49788	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:55:03.437887907 CEST	32583	49788	198.23.227.212	192.168.2.5
Sep 19, 2024 14:55:03.438004017 CEST	49788	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:55:03.438466072 CEST	32583	49788	198.23.227.212	192.168.2.5
Sep 19, 2024 14:55:03.438515902 CEST	49788	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:55:03.444586992 CEST	32583	49788	198.23.227.212	192.168.2.5
Sep 19, 2024 14:55:03.444649935 CEST	32583	49789	198.23.227.212	192.168.2.5
Sep 19, 2024 14:55:03.444691896 CEST	32583	49788	198.23.227.212	192.168.2.5
Sep 19, 2024 14:55:03.444740057 CEST	49789	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:55:03.444772005 CEST	49788	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:55:03.632268906 CEST	49789	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:55:03.637542009 CEST	32583	49789	198.23.227.212	192.168.2.5
Sep 19, 2024 14:55:05.015108109 CEST	32583	49789	198.23.227.212	192.168.2.5
Sep 19, 2024 14:55:05.015292883 CEST	49789	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:55:05.015459061 CEST	49789	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:55:05.020255089 CEST	32583	49789	198.23.227.212	192.168.2.5
Sep 19, 2024 14:55:05.400702953 CEST	49790	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:55:05.414050102 CEST	32583	49790	198.23.227.212	192.168.2.5
Sep 19, 2024 14:55:05.414138079 CEST	49790	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:55:05.420162916 CEST	49790	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:55:05.425048113 CEST	32583	49790	198.23.227.212	192.168.2.5
Sep 19, 2024 14:55:06.981379032 CEST	32583	49790	198.23.227.212	192.168.2.5
Sep 19, 2024 14:55:06.981471062 CEST	49790	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:55:06.981638908 CEST	49790	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:55:06.987102985 CEST	32583	49790	198.23.227.212	192.168.2.5
Sep 19, 2024 14:55:07.353660107 CEST	49791	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:55:07.358694077 CEST	32583	49791	198.23.227.212	192.168.2.5
Sep 19, 2024 14:55:07.358784914 CEST	49791	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:55:07.362472057 CEST	49791	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:55:07.367547989 CEST	32583	49791	198.23.227.212	192.168.2.5
Sep 19, 2024 14:55:08.920078993 CEST	32583	49791	198.23.227.212	192.168.2.5
Sep 19, 2024 14:55:08.922869921 CEST	49791	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:55:08.922993898 CEST	49791	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:55:08.927836895 CEST	32583	49791	198.23.227.212	192.168.2.5
Sep 19, 2024 14:55:09.609458923 CEST	49792	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:55:09.614559889 CEST	32583	49792	198.23.227.212	192.168.2.5
Sep 19, 2024 14:55:09.614667892 CEST	49792	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:55:09.618160009 CEST	49792	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:55:09.623086929 CEST	32583	49792	198.23.227.212	192.168.2.5
Sep 19, 2024 14:55:11.208857059 CEST	32583	49792	198.23.227.212	192.168.2.5
Sep 19, 2024 14:55:11.208960056 CEST	49792	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:55:11.209357977 CEST	49792	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:55:11.214189053 CEST	32583	49792	198.23.227.212	192.168.2.5
Sep 19, 2024 14:55:11.626303911 CEST	49793	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:55:11.631309986 CEST	32583	49793	198.23.227.212	192.168.2.5
Sep 19, 2024 14:55:11.631402969 CEST	49793	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:55:11.636076927 CEST	49793	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:55:11.640888929 CEST	32583	49793	198.23.227.212	192.168.2.5
Sep 19, 2024 14:55:13.271634102 CEST	32583	49793	198.23.227.212	192.168.2.5
Sep 19, 2024 14:55:13.271815062 CEST	49793	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:55:13.272269964 CEST	49793	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:55:13.277153015 CEST	32583	49793	198.23.227.212	192.168.2.5
Sep 19, 2024 14:55:13.683227062 CEST	49794	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:55:13.688508987 CEST	32583	49794	198.23.227.212	192.168.2.5
Sep 19, 2024 14:55:13.688595057 CEST	49794	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:55:13.693872929 CEST	49794	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:55:13.698784113 CEST	32583	49794	198.23.227.212	192.168.2.5
Sep 19, 2024 14:55:15.266717911 CEST	32583	49794	198.23.227.212	192.168.2.5
Sep 19, 2024 14:55:15.266891003 CEST	49794	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:55:15.267076969 CEST	49794	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:55:15.271980047 CEST	32583	49794	198.23.227.212	192.168.2.5
Sep 19, 2024 14:55:15.608669996 CEST	49795	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:55:15.614118099 CEST	32583	49795	198.23.227.212	192.168.2.5
Sep 19, 2024 14:55:15.614242077 CEST	49795	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:55:15.617520094 CEST	49795	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:55:15.622504950 CEST	32583	49795	198.23.227.212	192.168.2.5
Sep 19, 2024 14:55:17.185693026 CEST	32583	49795	198.23.227.212	192.168.2.5
Sep 19, 2024 14:55:17.185810089 CEST	49795	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:55:17.185977936 CEST	49795	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:55:17.190793037 CEST	32583	49795	198.23.227.212	192.168.2.5
Sep 19, 2024 14:55:17.616434097 CEST	49796	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:55:17.621690035 CEST	32583	49796	198.23.227.212	192.168.2.5
Sep 19, 2024 14:55:17.624620914 CEST	49796	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:55:17.627943039 CEST	49796	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:55:17.632926941 CEST	32583	49796	198.23.227.212	192.168.2.5
Sep 19, 2024 14:55:19.204211950 CEST	32583	49796	198.23.227.212	192.168.2.5
Sep 19, 2024 14:55:19.204292059 CEST	49796	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:55:19.204406977 CEST	49796	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:55:19.209230900 CEST	32583	49796	198.23.227.212	192.168.2.5
Sep 19, 2024 14:55:19.509825945 CEST	49797	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:55:19.514810085 CEST	32583	49797	198.23.227.212	192.168.2.5
Sep 19, 2024 14:55:19.514911890 CEST	49797	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:55:19.518301010 CEST	49797	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:55:19.523195028 CEST	32583	49797	198.23.227.212	192.168.2.5
Sep 19, 2024 14:55:21.533888102 CEST	32583	49797	198.23.227.212	192.168.2.5
Sep 19, 2024 14:55:21.534008980 CEST	32583	49797	198.23.227.212	192.168.2.5
Sep 19, 2024 14:55:21.534101009 CEST	32583	49797	198.23.227.212	192.168.2.5
Sep 19, 2024 14:55:21.534203053 CEST	49797	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:55:21.534203053 CEST	49797	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:55:21.534348965 CEST	49797	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:55:21.539309025 CEST	32583	49797	198.23.227.212	192.168.2.5
Sep 19, 2024 14:55:21.842005014 CEST	49798	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:55:21.848633051 CEST	32583	49798	198.23.227.212	192.168.2.5
Sep 19, 2024 14:55:21.848725080 CEST	49798	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:55:21.853677034 CEST	49798	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:55:21.859680891 CEST	32583	49798	198.23.227.212	192.168.2.5
Sep 19, 2024 14:55:23.610335112 CEST	32583	49798	198.23.227.212	192.168.2.5
Sep 19, 2024 14:55:23.610666990 CEST	49798	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:55:23.610821962 CEST	49798	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:55:23.615746975 CEST	32583	49798	198.23.227.212	192.168.2.5
Sep 19, 2024 14:55:23.900388956 CEST	49799	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:55:23.905380964 CEST	32583	49799	198.23.227.212	192.168.2.5
Sep 19, 2024 14:55:23.908621073 CEST	49799	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:55:23.911923885 CEST	49799	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:55:23.916846037 CEST	32583	49799	198.23.227.212	192.168.2.5
Sep 19, 2024 14:55:25.500510931 CEST	32583	49799	198.23.227.212	192.168.2.5
Sep 19, 2024 14:55:25.500715971 CEST	49799	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:55:25.500767946 CEST	49799	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:55:25.507294893 CEST	32583	49799	198.23.227.212	192.168.2.5
Sep 19, 2024 14:55:25.812912941 CEST	49800	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:55:25.818088055 CEST	32583	49800	198.23.227.212	192.168.2.5
Sep 19, 2024 14:55:25.818195105 CEST	49800	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:55:25.821623087 CEST	49800	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:55:25.826549053 CEST	32583	49800	198.23.227.212	192.168.2.5
Sep 19, 2024 14:55:27.391947031 CEST	32583	49800	198.23.227.212	192.168.2.5
Sep 19, 2024 14:55:27.392054081 CEST	49800	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:55:27.392244101 CEST	49800	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:55:27.397222996 CEST	32583	49800	198.23.227.212	192.168.2.5
Sep 19, 2024 14:55:27.772664070 CEST	49801	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:55:27.777714968 CEST	32583	49801	198.23.227.212	192.168.2.5
Sep 19, 2024 14:55:27.777806044 CEST	49801	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:55:27.781431913 CEST	49801	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:55:27.786247015 CEST	32583	49801	198.23.227.212	192.168.2.5
Sep 19, 2024 14:55:29.357235909 CEST	32583	49801	198.23.227.212	192.168.2.5
Sep 19, 2024 14:55:29.359496117 CEST	49801	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:55:29.359672070 CEST	49801	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:55:29.364509106 CEST	32583	49801	198.23.227.212	192.168.2.5
Sep 19, 2024 14:55:29.735301018 CEST	49802	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:55:29.740293026 CEST	32583	49802	198.23.227.212	192.168.2.5
Sep 19, 2024 14:55:29.742677927 CEST	49802	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:55:29.768490076 CEST	49802	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:55:29.773411989 CEST	32583	49802	198.23.227.212	192.168.2.5
Sep 19, 2024 14:55:31.312200069 CEST	32583	49802	198.23.227.212	192.168.2.5
Sep 19, 2024 14:55:31.312314034 CEST	49802	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:55:31.312526941 CEST	49802	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:55:31.317301989 CEST	32583	49802	198.23.227.212	192.168.2.5
Sep 19, 2024 14:55:31.562551022 CEST	49803	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:55:31.567569017 CEST	32583	49803	198.23.227.212	192.168.2.5
Sep 19, 2024 14:55:31.567665100 CEST	49803	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:55:31.571070910 CEST	49803	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:55:31.575922012 CEST	32583	49803	198.23.227.212	192.168.2.5
Sep 19, 2024 14:55:33.139997005 CEST	32583	49803	198.23.227.212	192.168.2.5
Sep 19, 2024 14:55:33.140228033 CEST	49803	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:55:33.140273094 CEST	49803	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:55:33.145185947 CEST	32583	49803	198.23.227.212	192.168.2.5
Sep 19, 2024 14:55:33.417524099 CEST	49804	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:55:33.422708988 CEST	32583	49804	198.23.227.212	192.168.2.5
Sep 19, 2024 14:55:33.422821999 CEST	49804	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:55:33.426119089 CEST	49804	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:55:33.431070089 CEST	32583	49804	198.23.227.212	192.168.2.5
Sep 19, 2024 14:55:34.986121893 CEST	32583	49804	198.23.227.212	192.168.2.5
Sep 19, 2024 14:55:34.986705065 CEST	49804	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:55:34.986942053 CEST	49804	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:55:34.991796017 CEST	32583	49804	198.23.227.212	192.168.2.5
Sep 19, 2024 14:55:35.273324013 CEST	49805	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:55:35.278350115 CEST	32583	49805	198.23.227.212	192.168.2.5
Sep 19, 2024 14:55:35.278516054 CEST	49805	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:55:35.281863928 CEST	49805	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:55:35.286814928 CEST	32583	49805	198.23.227.212	192.168.2.5
Sep 19, 2024 14:55:36.880026102 CEST	32583	49805	198.23.227.212	192.168.2.5
Sep 19, 2024 14:55:36.880675077 CEST	49805	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:55:36.880800009 CEST	49805	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:55:36.885662079 CEST	32583	49805	198.23.227.212	192.168.2.5
Sep 19, 2024 14:55:37.232485056 CEST	49806	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:55:37.237454891 CEST	32583	49806	198.23.227.212	192.168.2.5
Sep 19, 2024 14:55:37.240612984 CEST	49806	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:55:37.320818901 CEST	49806	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:55:37.325725079 CEST	32583	49806	198.23.227.212	192.168.2.5
Sep 19, 2024 14:55:38.812517881 CEST	32583	49806	198.23.227.212	192.168.2.5
Sep 19, 2024 14:55:38.812702894 CEST	49806	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:55:38.812820911 CEST	49806	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:55:38.817783117 CEST	32583	49806	198.23.227.212	192.168.2.5
Sep 19, 2024 14:55:39.212410927 CEST	49807	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:55:39.217549086 CEST	32583	49807	198.23.227.212	192.168.2.5
Sep 19, 2024 14:55:39.217642069 CEST	49807	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:55:39.222349882 CEST	49807	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:55:39.227406025 CEST	32583	49807	198.23.227.212	192.168.2.5
Sep 19, 2024 14:55:40.763705969 CEST	32583	49807	198.23.227.212	192.168.2.5
Sep 19, 2024 14:55:40.763844967 CEST	49807	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:55:40.763922930 CEST	49807	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:55:40.768897057 CEST	32583	49807	198.23.227.212	192.168.2.5
Sep 19, 2024 14:55:41.068403006 CEST	49808	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:55:41.073465109 CEST	32583	49808	198.23.227.212	192.168.2.5
Sep 19, 2024 14:55:41.073591948 CEST	49808	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:55:41.076956034 CEST	49808	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:55:41.081989050 CEST	32583	49808	198.23.227.212	192.168.2.5
Sep 19, 2024 14:55:42.830462933 CEST	32583	49808	198.23.227.212	192.168.2.5
Sep 19, 2024 14:55:42.832645893 CEST	49808	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:55:42.832823992 CEST	49808	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:55:42.838011980 CEST	32583	49808	198.23.227.212	192.168.2.5
Sep 19, 2024 14:55:43.116049051 CEST	49809	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:55:43.121038914 CEST	32583	49809	198.23.227.212	192.168.2.5
Sep 19, 2024 14:55:43.122893095 CEST	49809	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:55:43.126379967 CEST	49809	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:55:43.131211996 CEST	32583	49809	198.23.227.212	192.168.2.5
Sep 19, 2024 14:55:44.707576990 CEST	32583	49809	198.23.227.212	192.168.2.5
Sep 19, 2024 14:55:44.707653999 CEST	49809	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:55:44.707845926 CEST	49809	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:55:44.712779045 CEST	32583	49809	198.23.227.212	192.168.2.5
Sep 19, 2024 14:55:44.967116117 CEST	49810	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:55:44.972330093 CEST	32583	49810	198.23.227.212	192.168.2.5
Sep 19, 2024 14:55:44.972446918 CEST	49810	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:55:44.975923061 CEST	49810	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:55:44.980803967 CEST	32583	49810	198.23.227.212	192.168.2.5
Sep 19, 2024 14:55:46.547820091 CEST	32583	49810	198.23.227.212	192.168.2.5
Sep 19, 2024 14:55:46.547910929 CEST	49810	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:55:46.548022032 CEST	49810	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:55:46.552875996 CEST	32583	49810	198.23.227.212	192.168.2.5
Sep 19, 2024 14:55:47.101470947 CEST	49811	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:55:47.106695890 CEST	32583	49811	198.23.227.212	192.168.2.5
Sep 19, 2024 14:55:47.108653069 CEST	49811	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:55:47.147878885 CEST	49811	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:55:47.152750969 CEST	32583	49811	198.23.227.212	192.168.2.5
Sep 19, 2024 14:55:48.670227051 CEST	32583	49811	198.23.227.212	192.168.2.5
Sep 19, 2024 14:55:48.670309067 CEST	49811	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:55:48.670603037 CEST	49811	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:55:48.675466061 CEST	32583	49811	198.23.227.212	192.168.2.5
Sep 19, 2024 14:55:49.000113010 CEST	49812	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:55:49.005078077 CEST	32583	49812	198.23.227.212	192.168.2.5
Sep 19, 2024 14:55:49.007126093 CEST	49812	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:55:49.010428905 CEST	49812	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:55:49.015454054 CEST	32583	49812	198.23.227.212	192.168.2.5
Sep 19, 2024 14:55:50.560307980 CEST	32583	49812	198.23.227.212	192.168.2.5
Sep 19, 2024 14:55:50.560437918 CEST	49812	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:55:50.560694933 CEST	49812	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:55:50.565488100 CEST	32583	49812	198.23.227.212	192.168.2.5
Sep 19, 2024 14:55:50.903871059 CEST	49813	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:55:50.909105062 CEST	32583	49813	198.23.227.212	192.168.2.5
Sep 19, 2024 14:55:50.910722971 CEST	49813	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:55:50.914377928 CEST	49813	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:55:50.919313908 CEST	32583	49813	198.23.227.212	192.168.2.5
Sep 19, 2024 14:55:52.500808954 CEST	32583	49813	198.23.227.212	192.168.2.5
Sep 19, 2024 14:55:52.500912905 CEST	49813	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:55:52.501127005 CEST	49813	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:55:52.507492065 CEST	32583	49813	198.23.227.212	192.168.2.5
Sep 19, 2024 14:55:52.862149954 CEST	49814	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:55:52.867326021 CEST	32583	49814	198.23.227.212	192.168.2.5
Sep 19, 2024 14:55:52.867461920 CEST	49814	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:55:52.872328043 CEST	49814	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:55:52.877101898 CEST	32583	49814	198.23.227.212	192.168.2.5
Sep 19, 2024 14:55:54.453018904 CEST	32583	49814	198.23.227.212	192.168.2.5
Sep 19, 2024 14:55:54.453269005 CEST	49814	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:55:54.456140995 CEST	49814	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:55:54.460948944 CEST	32583	49814	198.23.227.212	192.168.2.5
Sep 19, 2024 14:55:54.779515982 CEST	49815	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:55:54.784645081 CEST	32583	49815	198.23.227.212	192.168.2.5
Sep 19, 2024 14:55:54.784758091 CEST	49815	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:55:54.789495945 CEST	49815	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:55:54.794795036 CEST	32583	49815	198.23.227.212	192.168.2.5
Sep 19, 2024 14:55:56.361438036 CEST	32583	49815	198.23.227.212	192.168.2.5
Sep 19, 2024 14:55:56.361526966 CEST	49815	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:55:56.361716986 CEST	49815	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:55:56.366501093 CEST	32583	49815	198.23.227.212	192.168.2.5
Sep 19, 2024 14:55:56.703238010 CEST	49816	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:55:56.708115101 CEST	32583	49816	198.23.227.212	192.168.2.5
Sep 19, 2024 14:55:56.708646059 CEST	49816	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:55:56.712337971 CEST	49816	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:55:56.717237949 CEST	32583	49816	198.23.227.212	192.168.2.5
Sep 19, 2024 14:55:58.308229923 CEST	32583	49816	198.23.227.212	192.168.2.5
Sep 19, 2024 14:55:58.308418036 CEST	49816	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:55:58.308568001 CEST	49816	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:55:58.313322067 CEST	32583	49816	198.23.227.212	192.168.2.5
Sep 19, 2024 14:55:58.567123890 CEST	49817	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:55:58.572099924 CEST	32583	49817	198.23.227.212	192.168.2.5
Sep 19, 2024 14:55:58.572237015 CEST	49817	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:55:58.576112032 CEST	49817	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:55:58.580919027 CEST	32583	49817	198.23.227.212	192.168.2.5
Sep 19, 2024 14:56:00.140721083 CEST	32583	49817	198.23.227.212	192.168.2.5
Sep 19, 2024 14:56:00.143402100 CEST	49817	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:56:00.143402100 CEST	49817	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:56:00.148319006 CEST	32583	49817	198.23.227.212	192.168.2.5
Sep 19, 2024 14:56:00.402509928 CEST	49818	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:56:00.407943964 CEST	32583	49818	198.23.227.212	192.168.2.5
Sep 19, 2024 14:56:00.408152103 CEST	49818	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:56:00.428431988 CEST	49818	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:56:00.433715105 CEST	32583	49818	198.23.227.212	192.168.2.5
Sep 19, 2024 14:56:01.982851982 CEST	32583	49818	198.23.227.212	192.168.2.5
Sep 19, 2024 14:56:01.983339071 CEST	49818	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:56:01.983339071 CEST	49818	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:56:01.988291025 CEST	32583	49818	198.23.227.212	192.168.2.5
Sep 19, 2024 14:56:02.284939051 CEST	49819	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:56:02.290141106 CEST	32583	49819	198.23.227.212	192.168.2.5
Sep 19, 2024 14:56:02.290281057 CEST	49819	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:56:02.293914080 CEST	49819	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:56:02.298790932 CEST	32583	49819	198.23.227.212	192.168.2.5
Sep 19, 2024 14:56:03.883785963 CEST	32583	49819	198.23.227.212	192.168.2.5
Sep 19, 2024 14:56:03.884617090 CEST	49819	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:56:03.884905100 CEST	49819	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:56:03.889735937 CEST	32583	49819	198.23.227.212	192.168.2.5
Sep 19, 2024 14:56:04.161488056 CEST	49820	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:56:04.166555882 CEST	32583	49820	198.23.227.212	192.168.2.5
Sep 19, 2024 14:56:04.166815042 CEST	49820	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:56:04.170861959 CEST	49820	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:56:04.175717115 CEST	32583	49820	198.23.227.212	192.168.2.5
Sep 19, 2024 14:56:05.720983028 CEST	32583	49820	198.23.227.212	192.168.2.5
Sep 19, 2024 14:56:05.724651098 CEST	49820	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:56:05.724873066 CEST	49820	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:56:05.729640007 CEST	32583	49820	198.23.227.212	192.168.2.5
Sep 19, 2024 14:56:06.347522974 CEST	49821	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:56:06.352560043 CEST	32583	49821	198.23.227.212	192.168.2.5
Sep 19, 2024 14:56:06.352715015 CEST	49821	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:56:06.369915962 CEST	49821	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:56:06.374701977 CEST	32583	49821	198.23.227.212	192.168.2.5
Sep 19, 2024 14:56:08.065128088 CEST	32583	49821	198.23.227.212	192.168.2.5
Sep 19, 2024 14:56:08.068766117 CEST	49821	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:56:08.069000959 CEST	49821	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:56:08.073802948 CEST	32583	49821	198.23.227.212	192.168.2.5
Sep 19, 2024 14:56:08.391654968 CEST	49822	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:56:08.396502018 CEST	32583	49822	198.23.227.212	192.168.2.5
Sep 19, 2024 14:56:08.396749973 CEST	49822	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:56:08.400381088 CEST	49822	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:56:08.405237913 CEST	32583	49822	198.23.227.212	192.168.2.5
Sep 19, 2024 14:56:09.967767954 CEST	32583	49822	198.23.227.212	192.168.2.5
Sep 19, 2024 14:56:09.967988014 CEST	49822	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:56:09.968195915 CEST	49822	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:56:09.972961903 CEST	32583	49822	198.23.227.212	192.168.2.5
Sep 19, 2024 14:56:10.255125999 CEST	49823	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:56:10.260025024 CEST	32583	49823	198.23.227.212	192.168.2.5
Sep 19, 2024 14:56:10.260107994 CEST	49823	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:56:10.263458967 CEST	49823	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:56:10.268291950 CEST	32583	49823	198.23.227.212	192.168.2.5
Sep 19, 2024 14:56:11.849857092 CEST	32583	49823	198.23.227.212	192.168.2.5
Sep 19, 2024 14:56:11.849951029 CEST	49823	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:56:11.850078106 CEST	49823	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:56:11.854792118 CEST	32583	49823	198.23.227.212	192.168.2.5
Sep 19, 2024 14:56:11.978535891 CEST	49824	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:56:12.138118029 CEST	32583	49824	198.23.227.212	192.168.2.5
Sep 19, 2024 14:56:12.138273001 CEST	49824	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:56:12.205127954 CEST	49824	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:56:12.210092068 CEST	32583	49824	198.23.227.212	192.168.2.5
Sep 19, 2024 14:56:13.701663971 CEST	32583	49824	198.23.227.212	192.168.2.5
Sep 19, 2024 14:56:13.701730967 CEST	49824	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:56:13.701859951 CEST	49824	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:56:13.706655979 CEST	32583	49824	198.23.227.212	192.168.2.5
Sep 19, 2024 14:56:13.977427006 CEST	49825	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:56:13.982388973 CEST	32583	49825	198.23.227.212	192.168.2.5
Sep 19, 2024 14:56:13.982578993 CEST	49825	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:56:13.987428904 CEST	49825	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:56:13.992234945 CEST	32583	49825	198.23.227.212	192.168.2.5
Sep 19, 2024 14:56:15.565756083 CEST	32583	49825	198.23.227.212	192.168.2.5
Sep 19, 2024 14:56:15.568650007 CEST	49825	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:56:15.568813086 CEST	49825	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:56:15.788314104 CEST	32583	49825	198.23.227.212	192.168.2.5
Sep 19, 2024 14:56:15.833386898 CEST	49826	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:56:15.838517904 CEST	32583	49826	198.23.227.212	192.168.2.5
Sep 19, 2024 14:56:15.838603973 CEST	49826	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:56:15.842001915 CEST	49826	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:56:15.847142935 CEST	32583	49826	198.23.227.212	192.168.2.5
Sep 19, 2024 14:56:17.405141115 CEST	32583	49826	198.23.227.212	192.168.2.5
Sep 19, 2024 14:56:17.405509949 CEST	49826	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:56:17.405654907 CEST	49826	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:56:17.410410881 CEST	32583	49826	198.23.227.212	192.168.2.5
Sep 19, 2024 14:56:17.705889940 CEST	49827	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:56:17.711092949 CEST	32583	49827	198.23.227.212	192.168.2.5
Sep 19, 2024 14:56:17.711184025 CEST	49827	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:56:17.714737892 CEST	49827	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:56:17.719541073 CEST	32583	49827	198.23.227.212	192.168.2.5
Sep 19, 2024 14:56:19.265055895 CEST	32583	49827	198.23.227.212	192.168.2.5
Sep 19, 2024 14:56:19.265194893 CEST	49827	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:56:19.265371084 CEST	49827	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:56:19.271558046 CEST	32583	49827	198.23.227.212	192.168.2.5
Sep 19, 2024 14:56:19.552964926 CEST	49828	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:56:19.557845116 CEST	32583	49828	198.23.227.212	192.168.2.5
Sep 19, 2024 14:56:19.557933092 CEST	49828	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:56:19.581404924 CEST	49828	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:56:19.586597919 CEST	32583	49828	198.23.227.212	192.168.2.5
Sep 19, 2024 14:56:21.143318892 CEST	32583	49828	198.23.227.212	192.168.2.5
Sep 19, 2024 14:56:21.143403053 CEST	49828	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:56:21.143580914 CEST	49828	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:56:21.148313046 CEST	32583	49828	198.23.227.212	192.168.2.5
Sep 19, 2024 14:56:21.434211016 CEST	49829	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:56:21.439141989 CEST	32583	49829	198.23.227.212	192.168.2.5
Sep 19, 2024 14:56:21.439224958 CEST	49829	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:56:21.442589998 CEST	49829	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:56:21.447818995 CEST	32583	49829	198.23.227.212	192.168.2.5
Sep 19, 2024 14:56:23.019026995 CEST	32583	49829	198.23.227.212	192.168.2.5
Sep 19, 2024 14:56:23.019231081 CEST	49829	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:56:23.019294977 CEST	49829	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:56:23.024143934 CEST	32583	49829	198.23.227.212	192.168.2.5
Sep 19, 2024 14:56:23.119256973 CEST	49830	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:56:23.124368906 CEST	32583	49830	198.23.227.212	192.168.2.5
Sep 19, 2024 14:56:23.124440908 CEST	49830	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:56:23.373688936 CEST	49830	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:56:23.378746033 CEST	32583	49830	198.23.227.212	192.168.2.5
Sep 19, 2024 14:56:24.686070919 CEST	32583	49830	198.23.227.212	192.168.2.5
Sep 19, 2024 14:56:24.688730955 CEST	49830	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:56:24.688880920 CEST	49830	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:56:24.693777084 CEST	32583	49830	198.23.227.212	192.168.2.5
Sep 19, 2024 14:56:24.977365017 CEST	49831	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:56:24.982357025 CEST	32583	49831	198.23.227.212	192.168.2.5
Sep 19, 2024 14:56:24.982449055 CEST	49831	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:56:24.985764980 CEST	49831	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:56:24.990561008 CEST	32583	49831	198.23.227.212	192.168.2.5
Sep 19, 2024 14:56:26.547091961 CEST	32583	49831	198.23.227.212	192.168.2.5
Sep 19, 2024 14:56:26.547301054 CEST	49831	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:56:26.547806978 CEST	49831	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:56:26.552797079 CEST	32583	49831	198.23.227.212	192.168.2.5
Sep 19, 2024 14:56:26.851061106 CEST	49832	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:56:26.856059074 CEST	32583	49832	198.23.227.212	192.168.2.5
Sep 19, 2024 14:56:26.856724977 CEST	49832	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:56:26.860060930 CEST	49832	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:56:26.865910053 CEST	32583	49832	198.23.227.212	192.168.2.5
Sep 19, 2024 14:56:29.388452053 CEST	32583	49832	198.23.227.212	192.168.2.5
Sep 19, 2024 14:56:29.389044046 CEST	32583	49832	198.23.227.212	192.168.2.5
Sep 19, 2024 14:56:29.389219999 CEST	49832	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:56:29.389436960 CEST	32583	49832	198.23.227.212	192.168.2.5
Sep 19, 2024 14:56:29.390077114 CEST	32583	49832	198.23.227.212	192.168.2.5
Sep 19, 2024 14:56:29.390434027 CEST	49832	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:56:29.390772104 CEST	49832	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:56:29.392096043 CEST	49832	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:56:29.401216984 CEST	32583	49832	198.23.227.212	192.168.2.5
Sep 19, 2024 14:56:29.685467958 CEST	49833	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:56:29.690980911 CEST	32583	49833	198.23.227.212	192.168.2.5
Sep 19, 2024 14:56:29.692462921 CEST	49833	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:56:29.695712090 CEST	49833	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:56:29.700680017 CEST	32583	49833	198.23.227.212	192.168.2.5
Sep 19, 2024 14:56:31.369718075 CEST	32583	49833	198.23.227.212	192.168.2.5
Sep 19, 2024 14:56:31.369951010 CEST	49833	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:56:31.369951010 CEST	49833	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:56:31.374877930 CEST	32583	49833	198.23.227.212	192.168.2.5
Sep 19, 2024 14:56:31.679946899 CEST	49834	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:56:31.684959888 CEST	32583	49834	198.23.227.212	192.168.2.5
Sep 19, 2024 14:56:31.685065985 CEST	49834	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:56:31.688515902 CEST	49834	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:56:31.693320990 CEST	32583	49834	198.23.227.212	192.168.2.5
Sep 19, 2024 14:56:33.232973099 CEST	32583	49834	198.23.227.212	192.168.2.5
Sep 19, 2024 14:56:33.235479116 CEST	49834	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:56:33.235794067 CEST	49834	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:56:33.240636110 CEST	32583	49834	198.23.227.212	192.168.2.5
Sep 19, 2024 14:56:33.491575003 CEST	49835	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:56:33.496467113 CEST	32583	49835	198.23.227.212	192.168.2.5
Sep 19, 2024 14:56:33.496584892 CEST	49835	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:56:33.499963045 CEST	49835	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:56:33.504745960 CEST	32583	49835	198.23.227.212	192.168.2.5
Sep 19, 2024 14:56:35.047420979 CEST	32583	49835	198.23.227.212	192.168.2.5
Sep 19, 2024 14:56:35.047492027 CEST	49835	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:56:35.047625065 CEST	49835	32583	192.168.2.5	198.23.227.212
Sep 19, 2024 14:56:35.052592039 CEST	32583	49835	198.23.227.212	192.168.2.5

Target ID:	0
Start time:	08:52:26
Start date:	19/09/2024
Path:	C:\Users\user\Desktop\documents-pdf.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\documents-pdf.exe"
Imagebase:	0x400000
File size:	456'704 bytes
MD5 hash:	12D7E4DBCB67711B60C8F626D81C7438
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000000.00000002.2128363256.000000000093D000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000000.00000002.2128430234.0000000000981000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000000.00000003.2038922031.00000000022C0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000000.00000003.2038922031.00000000022C0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000000.00000003.2038922031.00000000022C0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000000.00000003.2038922031.00000000022C0000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: REMCOS_RAT_variants, Description: unknown, Source: 00000000.00000003.2038922031.00000000022C0000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM, Description: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003), Source: 00000000.00000003.2038922031.00000000022C0000.00000004.00001000.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000000.00000002.2127973802.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000000.00000002.2127973802.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000000.00000002.2127973802.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000000.00000002.2127973802.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Author: unknown Rule: REMCOS_RAT_variants, Description: unknown, Source: 00000000.00000002.2127973802.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Author: unknown Rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM, Description: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003), Source: 00000000.00000002.2127973802.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Author: ditekSHen Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000000.00000002.2128264560.0000000000850000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000000.00000002.2128264560.0000000000850000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000000.00000002.2128264560.0000000000850000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000000.00000002.2128264560.0000000000850000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000000.00000002.2128264560.0000000000850000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Target ID:	3
Start time:	08:52:26
Start date:	19/09/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 4508 -s 956
Imagebase:	0x610000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	5
Start time:	08:52:27
Start date:	19/09/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 4508 -s 1128
Imagebase:	0x610000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	7
Start time:	08:52:29
Start date:	19/09/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 4508 -s 1136
Imagebase:	0x610000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	9
Start time:	08:52:29
Start date:	19/09/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 4508 -s 1164
Imagebase:	0x610000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	11
Start time:	08:52:30
Start date:	19/09/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 4508 -s 1156
Imagebase:	0x610000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	13
Start time:	08:52:31
Start date:	19/09/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 4508 -s 1212
Imagebase:	0x610000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	15
Start time:	08:52:32
Start date:	19/09/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 4508 -s 1252
Imagebase:	0x610000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	16
Start time:	08:52:32
Start date:	19/09/2024
Path:	C:\Users\user\AppData\Roaming\yava_explore.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\yava_explore.exe"
Imagebase:	0x400000
File size:	456'704 bytes
MD5 hash:	12D7E4DBCB67711B60C8F626D81C7438
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000010.00000002.4507176842.000000000081D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000010.00000002.4507148871.00000000007D9000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000010.00000002.4507176842.0000000000828000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000010.00000003.2103257618.0000000002220000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000010.00000003.2103257618.0000000002220000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000010.00000003.2103257618.0000000002220000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000010.00000003.2103257618.0000000002220000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: REMCOS_RAT_variants, Description: unknown, Source: 00000010.00000003.2103257618.0000000002220000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM, Description: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003), Source: 00000010.00000003.2103257618.0000000002220000.00000004.00001000.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000010.00000002.4507281694.00000000021A0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000010.00000002.4507281694.00000000021A0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000010.00000002.4507281694.00000000021A0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000010.00000002.4507281694.00000000021A0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000010.00000002.4507281694.00000000021A0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000010.00000002.4506857118.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000010.00000002.4506857118.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000010.00000002.4506857118.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000010.00000002.4506857118.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Author: unknown Rule: REMCOS_RAT_variants, Description: unknown, Source: 00000010.00000002.4506857118.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Author: unknown Rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM, Description: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003), Source: 00000010.00000002.4506857118.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Author: ditekSHen
Antivirus matches:	Detection: 76%, ReversingLabs
Reputation:	low
Has exited:	false

Target ID:	18
Start time:	08:52:32
Start date:	19/09/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 4508 -s 1380
Imagebase:	0x610000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	20
Start time:	08:52:33
Start date:	19/09/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 5080 -s 684
Imagebase:	0x610000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	22
Start time:	08:52:33
Start date:	19/09/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 5080 -s 744
Imagebase:	0x610000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	24
Start time:	08:52:35
Start date:	19/09/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 5080 -s 776
Imagebase:	0x610000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	26
Start time:	08:52:36
Start date:	19/09/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 5080 -s 680
Imagebase:	0x610000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	28
Start time:	08:52:37
Start date:	19/09/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 5080 -s 684
Imagebase:	0x610000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	30
Start time:	08:52:38
Start date:	19/09/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 5080 -s 732
Imagebase:	0x610000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	31
Start time:	08:52:39
Start date:	19/09/2024
Path:	C:\Users\user\AppData\Roaming\yava_explore.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\yava_explore.exe"
Imagebase:	0x400000
File size:	456'704 bytes
MD5 hash:	12D7E4DBCB67711B60C8F626D81C7438
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 0000001F.00000002.2190431886.000000000067C000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 0000001F.00000002.2190470825.00000000006C0000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 0000001F.00000003.2174054334.0000000002290000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 0000001F.00000003.2174054334.0000000002290000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 0000001F.00000003.2174054334.0000000002290000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 0000001F.00000003.2174054334.0000000002290000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: REMCOS_RAT_variants, Description: unknown, Source: 0000001F.00000003.2174054334.0000000002290000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM, Description: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003), Source: 0000001F.00000003.2174054334.0000000002290000.00000004.00001000.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 0000001F.00000002.2190120515.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 0000001F.00000002.2190120515.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 0000001F.00000002.2190120515.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 0000001F.00000002.2190120515.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Author: unknown Rule: REMCOS_RAT_variants, Description: unknown, Source: 0000001F.00000002.2190120515.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Author: unknown Rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM, Description: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003), Source: 0000001F.00000002.2190120515.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Author: ditekSHen Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 0000001F.00000002.2190598574.0000000002210000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 0000001F.00000002.2190598574.0000000002210000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 0000001F.00000002.2190598574.0000000002210000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 0000001F.00000002.2190598574.0000000002210000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 0000001F.00000002.2190598574.0000000002210000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Has exited:	true

Target ID:	33
Start time:	08:52:40
Start date:	19/09/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 5744 -s 580
Imagebase:	0x610000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	35
Start time:	08:52:40
Start date:	19/09/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 5080 -s 780
Imagebase:	0x610000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	37
Start time:	08:52:41
Start date:	19/09/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 5080 -s 716
Imagebase:	0x610000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true