Windows Analysis Report
YESOHDKMIm.exe

AI detected suspicious sample

Source: Yara match	File source: 15.3.yavascript.exe.2280000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.YESOHDKMIm.exe.2160e67.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.yavascript.exe.2190e67.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.yavascript.exe.2190e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.YESOHDKMIm.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.YESOHDKMIm.exe.2160e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.yavascript.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.3.yavascript.exe.2210000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.YESOHDKMIm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.3.yavascript.exe.2210000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.YESOHDKMIm.exe.21e0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.yavascript.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.yavascript.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.yavascript.exe.2090e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.3.yavascript.exe.2280000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.YESOHDKMIm.exe.21e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.yavascript.exe.2090e67.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.yavascript.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000019.00000002.1539911339.00000000007BA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1496387665.0000000000694000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000003.1473498633.0000000002210000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.2618326835.0000000000814000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.1539311942.0000000000400000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1496784989.0000000002160000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1352037586.00000000021E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1496029203.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.2617261877.0000000000400000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.1540122253.0000000002190000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.1433585955.0000000002280000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.2618536470.0000000002090000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: YESOHDKMIm.exe PID: 2804, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: yavascript.exe PID: 7148, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: yavascript.exe PID: 3236, type: MEMORYSTR

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.7% probability

Machine Learning detection for sample

Source: YESOHDKMIm.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Code function: 0_2_004338C8 CryptAcquireContextA,CryptGenRandom,CryptReleaseContext,	0_2_004338C8
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Code function: 0_2_02193B2F CryptAcquireContextA,CryptGenRandom,CryptReleaseContext,	0_2_02193B2F
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 15_2_004338C8 CryptAcquireContextA,CryptGenRandom,CryptReleaseContext,	15_2_004338C8
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 15_2_020C3B2F CryptAcquireContextA,CryptGenRandom,CryptReleaseContext,	15_2_020C3B2F
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 25_2_004338C8 CryptAcquireContextA,CryptGenRandom,CryptReleaseContext,	25_2_004338C8
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 25_2_021C3B2F CryptAcquireContextA,CryptGenRandom,CryptReleaseContext,	25_2_021C3B2F

Source: YESOHDKMIm.exe

Binary or memory string: -----BEGIN PUBLIC KEY-----

Exploits

Yara detected UAC Bypass using CMSTP

Source: Yara match	File source: 15.3.yavascript.exe.2280000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.YESOHDKMIm.exe.2160e67.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.yavascript.exe.2190e67.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.yavascript.exe.2190e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.YESOHDKMIm.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.YESOHDKMIm.exe.2160e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.yavascript.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.3.yavascript.exe.2210000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.YESOHDKMIm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.3.yavascript.exe.2210000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.YESOHDKMIm.exe.21e0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.yavascript.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.yavascript.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.yavascript.exe.2090e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.3.yavascript.exe.2280000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.YESOHDKMIm.exe.21e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.yavascript.exe.2090e67.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.yavascript.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000019.00000003.1473498633.0000000002210000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.1539311942.0000000000400000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1496784989.0000000002160000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1352037586.00000000021E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1496029203.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.2617261877.0000000000400000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.1540122253.0000000002190000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.1433585955.0000000002280000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.2618536470.0000000002090000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: YESOHDKMIm.exe PID: 2804, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: yavascript.exe PID: 7148, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: yavascript.exe PID: 3236, type: MEMORYSTR

Privilege Escalation

Contains functionality to bypass UAC (CMSTPLUA)

Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Code function: 0_2_00407538 _wcslen,CoGetObject,	0_2_00407538
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 15_2_00407538 _wcslen,CoGetObject,	15_2_00407538
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 25_2_00407538 _wcslen,CoGetObject,	25_2_00407538

Source: YESOHDKMIm.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\YESOHDKMIm.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Suricata IDS alerts for network traffic

Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Code function: 0_2_0040928E __EH_prolog,__CxxThrowException@8,FindFirstFileW,FindNextFileW,FindClose,FindClose,	0_2_0040928E
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Code function: 0_2_0041C322 FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,RemoveDirectoryW,FindClose,	0_2_0041C322
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Code function: 0_2_0040C388 FindFirstFileW,PathFileExistsW,FindNextFileW,FindClose,FindClose,	0_2_0040C388
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Code function: 0_2_004096A0 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,	0_2_004096A0
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Code function: 0_2_00408847 __EH_prolog,FindFirstFileW,__CxxThrowException@8,FindNextFileW,FindClose,	0_2_00408847
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Code function: 0_2_00407877 FindFirstFileW,FindNextFileW,	0_2_00407877
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Code function: 0_2_0044E8F9 FindFirstFileExA,	0_2_0044E8F9
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Code function: 0_2_0040BB6B FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,	0_2_0040BB6B
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Code function: 0_2_00419B86 FindFirstFileW,FindNextFileW,FindNextFileW,	0_2_00419B86
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Code function: 0_2_0040BD72 FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,	0_2_0040BD72
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Code function: 0_2_0217C589 FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,RemoveDirectoryW,FindClose,	0_2_0217C589
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Code function: 0_2_0216C5EF FindFirstFileW,PathFileExistsW,FindNextFileW,FindClose,FindClose,	0_2_0216C5EF
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Code function: 0_2_02168AAE __EH_prolog,FindFirstFileW,__CxxThrowException@8,FindNextFileW,FindClose,	0_2_02168AAE
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Code function: 0_2_02167ADE FindFirstFileW,FindNextFileW,	0_2_02167ADE
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Code function: 0_2_021AEB60 FindFirstFileExA,	0_2_021AEB60
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Code function: 0_2_02169907 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,	0_2_02169907
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Code function: 0_2_0216BDD2 FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,	0_2_0216BDD2
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Code function: 0_2_02179DED FindFirstFileW,	0_2_02179DED
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 15_2_0040928E __EH_prolog,__CxxThrowException@8,FindFirstFileW,FindNextFileW,FindClose,FindClose,	15_2_0040928E
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 15_2_0041C322 FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,RemoveDirectoryW,FindClose,	15_2_0041C322
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 15_2_0040C388 FindFirstFileW,PathFileExistsW,FindNextFileW,FindClose,FindClose,	15_2_0040C388
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 15_2_004096A0 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,	15_2_004096A0
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 15_2_00408847 __EH_prolog,FindFirstFileW,__CxxThrowException@8,FindNextFileW,FindClose,	15_2_00408847
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 15_2_00407877 FindFirstFileW,FindNextFileW,	15_2_00407877
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 15_2_0044E8F9 FindFirstFileExA,	15_2_0044E8F9
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 15_2_0040BB6B FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,	15_2_0040BB6B
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 15_2_00419B86 FindFirstFileW,FindNextFileW,FindNextFileW,	15_2_00419B86
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 15_2_0040BD72 FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,	15_2_0040BD72
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 15_2_020AC589 FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,RemoveDirectoryW,FindClose,	15_2_020AC589
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 15_2_0209C5EF FindFirstFileW,PathFileExistsW,FindNextFileW,FindClose,FindClose,	15_2_0209C5EF
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 15_2_02098AAE __EH_prolog,FindFirstFileW,__CxxThrowException@8,FindNextFileW,FindClose,	15_2_02098AAE
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 15_2_02097ADE FindFirstFileW,FindNextFileW,	15_2_02097ADE
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 15_2_020DEB60 FindFirstFileExA,	15_2_020DEB60
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 15_2_02099907 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,	15_2_02099907
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 15_2_0209BDD2 FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,	15_2_0209BDD2
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 15_2_020A9DED FindFirstFileW,	15_2_020A9DED
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 25_2_0040928E __EH_prolog,__CxxThrowException@8,FindFirstFileW,FindNextFileW,FindClose,FindClose,	25_2_0040928E
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 25_2_0041C322 FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,RemoveDirectoryW,FindClose,	25_2_0041C322
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 25_2_0040C388 FindFirstFileW,PathFileExistsW,FindNextFileW,FindClose,FindClose,	25_2_0040C388
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 25_2_004096A0 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,	25_2_004096A0
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 25_2_00408847 __EH_prolog,FindFirstFileW,__CxxThrowException@8,FindNextFileW,FindClose,	25_2_00408847
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 25_2_00407877 FindFirstFileW,FindNextFileW,	25_2_00407877
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 25_2_0044E8F9 FindFirstFileExA,	25_2_0044E8F9
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 25_2_0040BB6B FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,	25_2_0040BB6B
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 25_2_00419B86 FindFirstFileW,FindNextFileW,FindNextFileW,	25_2_00419B86
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 25_2_0040BD72 FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,	25_2_0040BD72
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 25_2_021AC589 FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,RemoveDirectoryW,FindClose,	25_2_021AC589
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 25_2_0219C5EF FindFirstFileW,PathFileExistsW,FindNextFileW,FindClose,FindClose,	25_2_0219C5EF
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 25_2_02198AAE __EH_prolog,FindFirstFileW,__CxxThrowException@8,FindNextFileW,FindClose,	25_2_02198AAE
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 25_2_02197ADE FindFirstFileW,FindNextFileW,	25_2_02197ADE
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 25_2_021DEB60 FindFirstFileExA,	25_2_021DEB60
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 25_2_02199907 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,	25_2_02199907
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 25_2_0219BDD2 FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,	25_2_0219BDD2
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 25_2_021A9DED FindFirstFileW,	25_2_021A9DED

Source: C:\Users\user\Desktop\YESOHDKMIm.exe

Code function: 0_2_00407CD2 SetEvent,GetFileAttributesW,DeleteFileW,HeapCreate,ShellExecuteW,GetLogicalDriveStringsA,SetFileAttributesW,DeleteFileA,Sleep,StrToIntA,CreateDirectoryW,

0_2_00407CD2

Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\WER\ReportQueue\
Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\
Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\WER\
Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_yavascript.exe_3d328a8faf94a4241bd0f3187864b2c92a157f9_012b365d_c78d28d7-2adb-4b67-8c0b-397c281cde3f\
Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\WER\ReportQueue
Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_yavascript.exe_96681bba23e4b313c649b06b74a0d9f844b06fff_012b365d_21b14de8-9abb-49d0-9025-9a35c86b09c3\

Networking

Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.9:49762 -> 198.23.227.212:32583
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.9:49773 -> 198.23.227.212:32583
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.9:49788 -> 198.23.227.212:32583
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.9:49797 -> 198.23.227.212:32583
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.9:49807 -> 198.23.227.212:32583
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.9:49816 -> 198.23.227.212:32583
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.9:49822 -> 198.23.227.212:32583
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.9:49871 -> 198.23.227.212:32583
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.9:49844 -> 198.23.227.212:32583
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.9:49852 -> 198.23.227.212:32583
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.9:49882 -> 198.23.227.212:32583
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.9:49861 -> 198.23.227.212:32583
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.9:49833 -> 198.23.227.212:32583
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.9:49900 -> 198.23.227.212:32583
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.9:49891 -> 198.23.227.212:32583
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.9:49911 -> 198.23.227.212:32583
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.9:49921 -> 198.23.227.212:32583
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.9:49927 -> 198.23.227.212:32583
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.9:49938 -> 198.23.227.212:32583
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.9:49947 -> 198.23.227.212:32583
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.9:49955 -> 198.23.227.212:32583
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.9:49965 -> 198.23.227.212:32583
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.9:49975 -> 198.23.227.212:32583
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.9:49984 -> 198.23.227.212:32583
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.9:49993 -> 198.23.227.212:32583
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.9:50005 -> 198.23.227.212:32583
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.9:50008 -> 198.23.227.212:32583
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.9:50010 -> 198.23.227.212:32583
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.9:50012 -> 198.23.227.212:32583
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.9:50011 -> 198.23.227.212:32583
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.9:50016 -> 198.23.227.212:32583
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.9:50017 -> 198.23.227.212:32583
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.9:50022 -> 198.23.227.212:32583
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.9:50020 -> 198.23.227.212:32583
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.9:50018 -> 198.23.227.212:32583
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.9:50013 -> 198.23.227.212:32583
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.9:50025 -> 198.23.227.212:32583
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.9:50024 -> 198.23.227.212:32583
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.9:50026 -> 198.23.227.212:32583
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.9:50014 -> 198.23.227.212:32583
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.9:50034 -> 198.23.227.212:32583
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.9:50028 -> 198.23.227.212:32583
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.9:50035 -> 198.23.227.212:32583
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.9:50038 -> 198.23.227.212:32583
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.9:50030 -> 198.23.227.212:32583
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.9:50041 -> 198.23.227.212:32583
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.9:50037 -> 198.23.227.212:32583
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.9:50040 -> 198.23.227.212:32583
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.9:50049 -> 198.23.227.212:32583
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.9:50047 -> 198.23.227.212:32583
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.9:50059 -> 198.23.227.212:32583
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.9:50051 -> 198.23.227.212:32583
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.9:50015 -> 198.23.227.212:32583
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.9:50056 -> 198.23.227.212:32583
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.9:50033 -> 198.23.227.212:32583
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.9:50032 -> 198.23.227.212:32583
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.9:50044 -> 198.23.227.212:32583
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.9:50063 -> 198.23.227.212:32583
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.9:50061 -> 198.23.227.212:32583
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.9:50052 -> 198.23.227.212:32583
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.9:50036 -> 198.23.227.212:32583
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.9:50054 -> 198.23.227.212:32583
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.9:50062 -> 198.23.227.212:32583
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.9:50055 -> 198.23.227.212:32583
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.9:50019 -> 198.23.227.212:32583
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.9:50066 -> 198.23.227.212:32583
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.9:50053 -> 198.23.227.212:32583
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.9:50067 -> 198.23.227.212:32583
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.9:50068 -> 198.23.227.212:32583
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.9:50023 -> 198.23.227.212:32583
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.9:50021 -> 198.23.227.212:32583
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.9:50060 -> 198.23.227.212:32583
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.9:50050 -> 198.23.227.212:32583
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.9:50045 -> 198.23.227.212:32583
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.9:50064 -> 198.23.227.212:32583
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.9:50009 -> 198.23.227.212:32583
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.9:50039 -> 198.23.227.212:32583
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.9:50065 -> 198.23.227.212:32583
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.9:50046 -> 198.23.227.212:32583
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.9:50057 -> 198.23.227.212:32583
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.9:50027 -> 198.23.227.212:32583
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.9:50029 -> 198.23.227.212:32583
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.9:50048 -> 198.23.227.212:32583
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.9:50031 -> 198.23.227.212:32583
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.9:50058 -> 198.23.227.212:32583
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.9:50043 -> 198.23.227.212:32583
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.9:50042 -> 198.23.227.212:32583
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.9:49751 -> 198.23.227.212:32583

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

IPs: 198.23.227.212

Source: global traffic

TCP traffic: 192.168.2.9:49751 -> 198.23.227.212:32583

Source: Joe Sandbox View

IP Address: 198.23.227.212 198.23.227.212

Source: Joe Sandbox View

ASN Name: AS-COLOCROSSINGUS AS-COLOCROSSINGUS

Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 20.12.23.50:443 -> 192.168.2.9:49782
Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 4.245.163.56:443 -> 192.168.2.9:49998

Source: unknown	TCP traffic detected without corresponding DNS query: 198.23.227.212
Source: unknown	TCP traffic detected without corresponding DNS query: 198.23.227.212
Source: unknown	TCP traffic detected without corresponding DNS query: 198.23.227.212
Source: unknown	TCP traffic detected without corresponding DNS query: 198.23.227.212
Source: unknown	TCP traffic detected without corresponding DNS query: 198.23.227.212
Source: unknown	TCP traffic detected without corresponding DNS query: 198.23.227.212
Source: unknown	TCP traffic detected without corresponding DNS query: 198.23.227.212
Source: unknown	TCP traffic detected without corresponding DNS query: 198.23.227.212
Source: unknown	TCP traffic detected without corresponding DNS query: 198.23.227.212
Source: unknown	TCP traffic detected without corresponding DNS query: 198.23.227.212
Source: unknown	TCP traffic detected without corresponding DNS query: 198.23.227.212
Source: unknown	TCP traffic detected without corresponding DNS query: 198.23.227.212
Source: unknown	TCP traffic detected without corresponding DNS query: 198.23.227.212
Source: unknown	TCP traffic detected without corresponding DNS query: 198.23.227.212
Source: unknown	TCP traffic detected without corresponding DNS query: 198.23.227.212
Source: unknown	TCP traffic detected without corresponding DNS query: 198.23.227.212
Source: unknown	TCP traffic detected without corresponding DNS query: 198.23.227.212
Source: unknown	TCP traffic detected without corresponding DNS query: 198.23.227.212
Source: unknown	TCP traffic detected without corresponding DNS query: 198.23.227.212
Source: unknown	TCP traffic detected without corresponding DNS query: 198.23.227.212
Source: unknown	TCP traffic detected without corresponding DNS query: 198.23.227.212
Source: unknown	TCP traffic detected without corresponding DNS query: 198.23.227.212
Source: unknown	TCP traffic detected without corresponding DNS query: 198.23.227.212
Source: unknown	TCP traffic detected without corresponding DNS query: 198.23.227.212
Source: unknown	TCP traffic detected without corresponding DNS query: 198.23.227.212
Source: unknown	TCP traffic detected without corresponding DNS query: 198.23.227.212
Source: unknown	TCP traffic detected without corresponding DNS query: 198.23.227.212
Source: unknown	TCP traffic detected without corresponding DNS query: 198.23.227.212
Source: unknown	TCP traffic detected without corresponding DNS query: 198.23.227.212
Source: unknown	TCP traffic detected without corresponding DNS query: 198.23.227.212
Source: unknown	TCP traffic detected without corresponding DNS query: 198.23.227.212
Source: unknown	TCP traffic detected without corresponding DNS query: 198.23.227.212
Source: unknown	TCP traffic detected without corresponding DNS query: 198.23.227.212
Source: unknown	TCP traffic detected without corresponding DNS query: 198.23.227.212
Source: unknown	TCP traffic detected without corresponding DNS query: 198.23.227.212
Source: unknown	TCP traffic detected without corresponding DNS query: 198.23.227.212
Source: unknown	TCP traffic detected without corresponding DNS query: 198.23.227.212
Source: unknown	TCP traffic detected without corresponding DNS query: 198.23.227.212
Source: unknown	TCP traffic detected without corresponding DNS query: 198.23.227.212
Source: unknown	TCP traffic detected without corresponding DNS query: 198.23.227.212
Source: unknown	TCP traffic detected without corresponding DNS query: 198.23.227.212
Source: unknown	TCP traffic detected without corresponding DNS query: 198.23.227.212
Source: unknown	TCP traffic detected without corresponding DNS query: 198.23.227.212
Source: unknown	TCP traffic detected without corresponding DNS query: 198.23.227.212
Source: unknown	TCP traffic detected without corresponding DNS query: 198.23.227.212
Source: unknown	TCP traffic detected without corresponding DNS query: 198.23.227.212
Source: unknown	TCP traffic detected without corresponding DNS query: 198.23.227.212
Source: unknown	TCP traffic detected without corresponding DNS query: 198.23.227.212
Source: unknown	TCP traffic detected without corresponding DNS query: 198.23.227.212
Source: unknown	TCP traffic detected without corresponding DNS query: 198.23.227.212

Source: C:\Users\user\Desktop\YESOHDKMIm.exe

Code function: 0_2_0041B411 InternetOpenW,InternetOpenUrlW,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

0_2_0041B411

Source: yavascript.exe	String found in binary or memory: http://geoplugin.net/json.gp
Source: YESOHDKMIm.exe, 00000000.00000002.1496784989.0000000002160000.00000040.00001000.00020000.00000000.sdmp, YESOHDKMIm.exe, 00000000.00000003.1352037586.00000000021E0000.00000004.00001000.00020000.00000000.sdmp, YESOHDKMIm.exe, 00000000.00000002.1496029203.0000000000400000.00000040.00000001.01000000.00000003.sdmp, yavascript.exe, 0000000F.00000002.2618536470.0000000002090000.00000040.00001000.00020000.00000000.sdmp, yavascript.exe, 0000000F.00000002.2617261877.0000000000400000.00000040.00000001.01000000.00000007.sdmp, yavascript.exe, 0000000F.00000003.1433585955.0000000002280000.00000004.00001000.00020000.00000000.sdmp, yavascript.exe, 00000019.00000003.1473498633.0000000002210000.00000004.00001000.00020000.00000000.sdmp, yavascript.exe, 00000019.00000002.1539311942.0000000000400000.00000040.00000001.01000000.00000007.sdmp, yavascript.exe, 00000019.00000002.1540122253.0000000002190000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/json.gp/C
Source: Amcache.hve.4.dr	String found in binary or memory: http://upx.sf.net

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to register a low level keyboard hook

Source: C:\Users\user\Desktop\YESOHDKMIm.exe

Code function: 0_2_0040A2F3 SetWindowsHookExA 0000000D,0040A2DF,00000000

0_2_0040A2F3

Source: C:\Users\user\Desktop\YESOHDKMIm.exe

Code function: 0_2_0040B749 OpenClipboard,GetClipboardData,CloseClipboard,

0_2_0040B749

Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Code function: 0_2_004168FC OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,SetClipboardData,CloseClipboard,OpenClipboard,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,	0_2_004168FC
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 15_2_004168FC OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,SetClipboardData,CloseClipboard,OpenClipboard,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,	15_2_004168FC
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 25_2_004168FC OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,SetClipboardData,CloseClipboard,OpenClipboard,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,	25_2_004168FC

Source: C:\Users\user\Desktop\YESOHDKMIm.exe

Code function: 0_2_0040B749 OpenClipboard,GetClipboardData,CloseClipboard,

0_2_0040B749

Source: C:\Users\user\Desktop\YESOHDKMIm.exe

Code function: 0_2_0040A41B GetForegroundWindow,GetWindowThreadProcessId,GetKeyboardLayout,GetKeyState,GetKeyboardState,ToUnicodeEx,ToUnicodeEx,ToUnicodeEx,ToUnicodeEx,

0_2_0040A41B

Source: Yara match	File source: 15.3.yavascript.exe.2280000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.YESOHDKMIm.exe.2160e67.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.yavascript.exe.2190e67.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.yavascript.exe.2190e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.YESOHDKMIm.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.YESOHDKMIm.exe.2160e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.yavascript.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.3.yavascript.exe.2210000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.YESOHDKMIm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.3.yavascript.exe.2210000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.YESOHDKMIm.exe.21e0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.yavascript.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.yavascript.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.yavascript.exe.2090e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.3.yavascript.exe.2280000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.YESOHDKMIm.exe.21e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.yavascript.exe.2090e67.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.yavascript.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000019.00000003.1473498633.0000000002210000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.1539311942.0000000000400000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1496784989.0000000002160000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1352037586.00000000021E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1496029203.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.2617261877.0000000000400000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.1540122253.0000000002190000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.1433585955.0000000002280000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.2618536470.0000000002090000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: YESOHDKMIm.exe PID: 2804, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: yavascript.exe PID: 7148, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: yavascript.exe PID: 3236, type: MEMORYSTR

E-Banking Fraud

Contains functionalty to change the wallpaper

Source: Yara match	File source: 15.3.yavascript.exe.2280000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.YESOHDKMIm.exe.2160e67.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.yavascript.exe.2190e67.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.yavascript.exe.2190e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.YESOHDKMIm.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.YESOHDKMIm.exe.2160e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.yavascript.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.3.yavascript.exe.2210000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.YESOHDKMIm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.3.yavascript.exe.2210000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.YESOHDKMIm.exe.21e0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.yavascript.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.yavascript.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.yavascript.exe.2090e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.3.yavascript.exe.2280000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.YESOHDKMIm.exe.21e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.yavascript.exe.2090e67.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.yavascript.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000019.00000002.1539911339.00000000007BA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1496387665.0000000000694000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000003.1473498633.0000000002210000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.2618326835.0000000000814000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.1539311942.0000000000400000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1496784989.0000000002160000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1352037586.00000000021E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1496029203.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.2617261877.0000000000400000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.1540122253.0000000002190000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.1433585955.0000000002280000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.2618536470.0000000002090000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: YESOHDKMIm.exe PID: 2804, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: yavascript.exe PID: 7148, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: yavascript.exe PID: 3236, type: MEMORYSTR

Spam, unwanted Advertisements and Ransom Demands

Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Code function: 0_2_0041CA73 SystemParametersInfoW,	0_2_0041CA73
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Code function: 0_2_0217CCDA SystemParametersInfoW,	0_2_0217CCDA
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 15_2_0041CA73 SystemParametersInfoW,	15_2_0041CA73
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 15_2_020ACCDA SystemParametersInfoW,	15_2_020ACCDA
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 25_2_0041CA73 SystemParametersInfoW,	25_2_0041CA73
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 25_2_021ACCDA SystemParametersInfoW,	25_2_021ACCDA

System Summary

Malicious sample detected (through community Yara rule)

Source: 15.3.yavascript.exe.2280000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 15.3.yavascript.exe.2280000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 15.3.yavascript.exe.2280000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 0.2.YESOHDKMIm.exe.2160e67.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 0.2.YESOHDKMIm.exe.2160e67.1.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 0.2.YESOHDKMIm.exe.2160e67.1.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 25.2.yavascript.exe.2190e67.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 25.2.yavascript.exe.2190e67.1.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 25.2.yavascript.exe.2190e67.1.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 25.2.yavascript.exe.2190e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 25.2.yavascript.exe.2190e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 25.2.yavascript.exe.2190e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 0.2.YESOHDKMIm.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 0.2.YESOHDKMIm.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 0.2.YESOHDKMIm.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 0.2.YESOHDKMIm.exe.2160e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 0.2.YESOHDKMIm.exe.2160e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 0.2.YESOHDKMIm.exe.2160e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 15.2.yavascript.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 15.2.yavascript.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 15.2.yavascript.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 25.3.yavascript.exe.2210000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 25.3.yavascript.exe.2210000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 25.3.yavascript.exe.2210000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 0.2.YESOHDKMIm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 0.2.YESOHDKMIm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 0.2.YESOHDKMIm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 25.3.yavascript.exe.2210000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 25.3.yavascript.exe.2210000.0.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 25.3.yavascript.exe.2210000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 0.3.YESOHDKMIm.exe.21e0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 0.3.YESOHDKMIm.exe.21e0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 0.3.YESOHDKMIm.exe.21e0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 25.2.yavascript.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 25.2.yavascript.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 25.2.yavascript.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 25.2.yavascript.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 25.2.yavascript.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 25.2.yavascript.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 15.2.yavascript.exe.2090e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 15.2.yavascript.exe.2090e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 15.2.yavascript.exe.2090e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 15.3.yavascript.exe.2280000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 15.3.yavascript.exe.2280000.0.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 15.3.yavascript.exe.2280000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 0.3.YESOHDKMIm.exe.21e0000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 0.3.YESOHDKMIm.exe.21e0000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 0.3.YESOHDKMIm.exe.21e0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 15.2.yavascript.exe.2090e67.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 15.2.yavascript.exe.2090e67.1.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 15.2.yavascript.exe.2090e67.1.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 15.2.yavascript.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 15.2.yavascript.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 15.2.yavascript.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 00000019.00000002.1539850016.0000000000750000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000000.00000002.1496727546.0000000002110000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000019.00000003.1473498633.0000000002210000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 00000019.00000003.1473498633.0000000002210000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 00000019.00000003.1473498633.0000000002210000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 0000000F.00000002.2617952063.0000000000760000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000019.00000002.1539311942.0000000000400000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 00000019.00000002.1539311942.0000000000400000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 00000019.00000002.1539311942.0000000000400000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 00000000.00000002.1496784989.0000000002160000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 00000000.00000002.1496784989.0000000002160000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000000.00000003.1352037586.00000000021E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 00000000.00000003.1352037586.00000000021E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 00000000.00000003.1352037586.00000000021E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 00000000.00000002.1496029203.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 00000000.00000002.1496029203.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 00000000.00000002.1496029203.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 0000000F.00000002.2617261877.0000000000400000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 0000000F.00000002.2617261877.0000000000400000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 0000000F.00000002.2617261877.0000000000400000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 00000019.00000002.1540122253.0000000002190000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 00000019.00000002.1540122253.0000000002190000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 0000000F.00000003.1433585955.0000000002280000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 0000000F.00000003.1433585955.0000000002280000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 0000000F.00000003.1433585955.0000000002280000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 0000000F.00000002.2618536470.0000000002090000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 0000000F.00000002.2618536470.0000000002090000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: Process Memory Space: YESOHDKMIm.exe PID: 2804, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: Process Memory Space: yavascript.exe PID: 7148, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: Process Memory Space: yavascript.exe PID: 3236, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown

Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Code function: 0_2_0041330D OpenProcess,NtQueryInformationProcess,GetCurrentProcess,DuplicateHandle,GetFinalPathNameByHandleW,CloseHandle,CreateFileMappingW,MapViewOfFile,GetFileSize,UnmapViewOfFile,CloseHandle,CloseHandle,CloseHandle,	0_2_0041330D
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Code function: 0_2_0041D620 NtdllDefWindowProc_A,GetCursorPos,SetForegroundWindow,TrackPopupMenu,IsWindowVisible,ShowWindow,ShowWindow,SetForegroundWindow,Shell_NotifyIcon,ExitProcess,CreatePopupMenu,AppendMenuA,	0_2_0041D620
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Code function: 0_2_0041BBC6 OpenProcess,NtResumeProcess,CloseHandle,	0_2_0041BBC6
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Code function: 0_2_0041BB9A OpenProcess,NtSuspendProcess,CloseHandle,	0_2_0041BB9A
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Code function: 0_2_02173574 OpenProcess,NtQueryInformationProcess,GetCurrentProcess,DuplicateHandle,GetFinalPathNameByHandleW,CloseHandle,CreateFileMappingW,MapViewOfFile,GetFileSize,UnmapViewOfFile,	0_2_02173574
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Code function: 0_2_0217D887 NtdllDefWindowProc_A,GetCursorPos,SetForegroundWindow,TrackPopupMenu,IsWindowVisible,ShowWindow,ShowWindow,SetForegroundWindow,Shell_NotifyIcon,ExitProcess,CreatePopupMenu,AppendMenuA,	0_2_0217D887
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Code function: 0_2_0217BE01 OpenProcess,NtSuspendProcess,CloseHandle,	0_2_0217BE01
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Code function: 0_2_0217BE2D OpenProcess,NtResumeProcess,CloseHandle,	0_2_0217BE2D
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 15_2_0041330D OpenProcess,NtQueryInformationProcess,GetCurrentProcess,DuplicateHandle,GetFinalPathNameByHandleW,CloseHandle,CreateFileMappingW,MapViewOfFile,GetFileSize,UnmapViewOfFile,CloseHandle,CloseHandle,CloseHandle,	15_2_0041330D
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 15_2_0041D620 NtdllDefWindowProc_A,GetCursorPos,SetForegroundWindow,TrackPopupMenu,IsWindowVisible,ShowWindow,ShowWindow,SetForegroundWindow,Shell_NotifyIcon,ExitProcess,CreatePopupMenu,AppendMenuA,	15_2_0041D620
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 15_2_0041BBC6 OpenProcess,NtResumeProcess,CloseHandle,	15_2_0041BBC6
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 15_2_0041BB9A OpenProcess,NtSuspendProcess,CloseHandle,	15_2_0041BB9A
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 15_2_020A3574 OpenProcess,NtQueryInformationProcess,GetCurrentProcess,DuplicateHandle,GetFinalPathNameByHandleW,CloseHandle,CreateFileMappingW,MapViewOfFile,GetFileSize,UnmapViewOfFile,	15_2_020A3574
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 15_2_020AD887 NtdllDefWindowProc_A,GetCursorPos,SetForegroundWindow,TrackPopupMenu,IsWindowVisible,ShowWindow,ShowWindow,SetForegroundWindow,Shell_NotifyIcon,ExitProcess,CreatePopupMenu,AppendMenuA,	15_2_020AD887
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 15_2_020ABE01 OpenProcess,NtSuspendProcess,CloseHandle,	15_2_020ABE01
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 15_2_020ABE2D OpenProcess,NtResumeProcess,CloseHandle,	15_2_020ABE2D
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 25_2_0041330D OpenProcess,NtQueryInformationProcess,GetCurrentProcess,DuplicateHandle,GetFinalPathNameByHandleW,CloseHandle,CreateFileMappingW,MapViewOfFile,GetFileSize,UnmapViewOfFile,CloseHandle,CloseHandle,CloseHandle,	25_2_0041330D
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 25_2_0041D620 NtdllDefWindowProc_A,GetCursorPos,SetForegroundWindow,TrackPopupMenu,IsWindowVisible,ShowWindow,ShowWindow,SetForegroundWindow,Shell_NotifyIcon,ExitProcess,CreatePopupMenu,AppendMenuA,	25_2_0041D620
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 25_2_0041BBC6 OpenProcess,NtResumeProcess,CloseHandle,	25_2_0041BBC6
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 25_2_0041BB9A OpenProcess,NtSuspendProcess,CloseHandle,	25_2_0041BB9A
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 25_2_021A3574 OpenProcess,NtQueryInformationProcess,GetCurrentProcess,DuplicateHandle,GetFinalPathNameByHandleW,CloseHandle,CreateFileMappingW,MapViewOfFile,GetFileSize,UnmapViewOfFile,	25_2_021A3574
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 25_2_021AD887 NtdllDefWindowProc_A,GetCursorPos,SetForegroundWindow,TrackPopupMenu,IsWindowVisible,ShowWindow,ShowWindow,SetForegroundWindow,Shell_NotifyIcon,ExitProcess,CreatePopupMenu,AppendMenuA,	25_2_021AD887
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 25_2_021ABE01 OpenProcess,NtSuspendProcess,CloseHandle,	25_2_021ABE01
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 25_2_021ABE2D OpenProcess,NtResumeProcess,CloseHandle,	25_2_021ABE2D

Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Code function: 0_2_004167EF ExitWindowsEx,LoadLibraryA,GetProcAddress,	0_2_004167EF
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Code function: 0_2_02176A5B ExitWindowsEx,LoadLibraryA,GetProcAddress,	0_2_02176A5B
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 15_2_004167EF ExitWindowsEx,LoadLibraryA,GetProcAddress,	15_2_004167EF
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 15_2_020A6A5B ExitWindowsEx,LoadLibraryA,GetProcAddress,	15_2_020A6A5B
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 25_2_004167EF ExitWindowsEx,LoadLibraryA,GetProcAddress,	25_2_004167EF
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 25_2_021A6A5B ExitWindowsEx,LoadLibraryA,GetProcAddress,	25_2_021A6A5B

Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Code function: 0_2_0043706A	0_2_0043706A
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Code function: 0_2_00414005	0_2_00414005
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Code function: 0_2_0043E11C	0_2_0043E11C
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Code function: 0_2_004541D9	0_2_004541D9
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Code function: 0_2_004381E8	0_2_004381E8
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Code function: 0_2_0041F18B	0_2_0041F18B
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Code function: 0_2_00446270	0_2_00446270
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Code function: 0_2_0043E34B	0_2_0043E34B
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Code function: 0_2_004533AB	0_2_004533AB
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Code function: 0_2_0042742E	0_2_0042742E
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Code function: 0_2_00437566	0_2_00437566
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Code function: 0_2_0043E5A8	0_2_0043E5A8
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Code function: 0_2_004387F0	0_2_004387F0
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Code function: 0_2_0043797E	0_2_0043797E
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Code function: 0_2_004339D7	0_2_004339D7
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Code function: 0_2_0044DA49	0_2_0044DA49
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Code function: 0_2_00427AD7	0_2_00427AD7
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Code function: 0_2_0041DBF3	0_2_0041DBF3
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Code function: 0_2_00427C40	0_2_00427C40
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Code function: 0_2_00437DB3	0_2_00437DB3
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Code function: 0_2_00435EEB	0_2_00435EEB
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Code function: 0_2_0043DEED	0_2_0043DEED
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Code function: 0_2_00426E9F	0_2_00426E9F
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Code function: 0_2_021972D1	0_2_021972D1
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Code function: 0_2_0219E383	0_2_0219E383
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Code function: 0_2_0217F3F2	0_2_0217F3F2
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Code function: 0_2_02187106	0_2_02187106
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Code function: 0_2_0219E154	0_2_0219E154
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Code function: 0_2_021B3612	0_2_021B3612
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Code function: 0_2_02187695	0_2_02187695
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Code function: 0_2_021A64D7	0_2_021A64D7
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Code function: 0_2_0219E5B2	0_2_0219E5B2
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Code function: 0_2_02198A57	0_2_02198A57
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Code function: 0_2_0219E80F	0_2_0219E80F
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Code function: 0_2_0217DE5A	0_2_0217DE5A
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Code function: 0_2_02187EA7	0_2_02187EA7
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Code function: 0_2_02193C3E	0_2_02193C3E
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Code function: 0_2_02187D3E	0_2_02187D3E
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 15_2_0043706A	15_2_0043706A
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 15_2_00414005	15_2_00414005
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 15_2_0043E11C	15_2_0043E11C
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 15_2_004541D9	15_2_004541D9
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 15_2_004381E8	15_2_004381E8
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 15_2_0041F18B	15_2_0041F18B
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 15_2_00446270	15_2_00446270
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 15_2_0043E34B	15_2_0043E34B
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 15_2_004533AB	15_2_004533AB
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 15_2_0042742E	15_2_0042742E
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 15_2_00437566	15_2_00437566
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 15_2_0043E5A8	15_2_0043E5A8
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 15_2_004387F0	15_2_004387F0
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 15_2_0043797E	15_2_0043797E
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 15_2_004339D7	15_2_004339D7
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 15_2_0044DA49	15_2_0044DA49
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 15_2_00427AD7	15_2_00427AD7
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 15_2_0041DBF3	15_2_0041DBF3
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 15_2_00427C40	15_2_00427C40
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 15_2_00437DB3	15_2_00437DB3
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 15_2_00435EEB	15_2_00435EEB
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 15_2_0043DEED	15_2_0043DEED
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 15_2_00426E9F	15_2_00426E9F
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 15_2_020C72D1	15_2_020C72D1
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 15_2_020CE383	15_2_020CE383
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 15_2_020AF3F2	15_2_020AF3F2
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 15_2_020B7106	15_2_020B7106
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 15_2_020CE154	15_2_020CE154
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 15_2_020E3612	15_2_020E3612
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 15_2_020B7695	15_2_020B7695
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 15_2_020D64D7	15_2_020D64D7
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 15_2_020CE5B2	15_2_020CE5B2
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 15_2_020C8A57	15_2_020C8A57
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 15_2_020CE80F	15_2_020CE80F
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 15_2_020ADE5A	15_2_020ADE5A
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 15_2_020B7EA7	15_2_020B7EA7
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 15_2_020C3C3E	15_2_020C3C3E
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 15_2_020B7D3E	15_2_020B7D3E
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 25_2_0043706A	25_2_0043706A
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 25_2_00414005	25_2_00414005
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 25_2_0043E11C	25_2_0043E11C
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 25_2_004541D9	25_2_004541D9
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 25_2_004381E8	25_2_004381E8
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 25_2_0041F18B	25_2_0041F18B
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 25_2_00446270	25_2_00446270
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 25_2_0043E34B	25_2_0043E34B
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 25_2_004533AB	25_2_004533AB
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 25_2_0042742E	25_2_0042742E
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 25_2_00437566	25_2_00437566
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 25_2_0043E5A8	25_2_0043E5A8
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 25_2_004387F0	25_2_004387F0
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 25_2_0043797E	25_2_0043797E
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 25_2_004339D7	25_2_004339D7
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 25_2_0044DA49	25_2_0044DA49
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 25_2_00427AD7	25_2_00427AD7
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 25_2_0041DBF3	25_2_0041DBF3
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 25_2_00427C40	25_2_00427C40
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 25_2_00437DB3	25_2_00437DB3
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 25_2_00435EEB	25_2_00435EEB
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 25_2_0043DEED	25_2_0043DEED
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 25_2_00426E9F	25_2_00426E9F
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 25_2_021C72D1	25_2_021C72D1
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 25_2_021CE383	25_2_021CE383
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 25_2_021AF3F2	25_2_021AF3F2
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 25_2_021B7106	25_2_021B7106
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 25_2_021CE154	25_2_021CE154
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 25_2_021E3612	25_2_021E3612
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 25_2_021B7695	25_2_021B7695
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 25_2_021D64D7	25_2_021D64D7
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 25_2_021CE5B2	25_2_021CE5B2
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 25_2_021C8A57	25_2_021C8A57
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 25_2_021CE80F	25_2_021CE80F
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 25_2_021ADE5A	25_2_021ADE5A
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 25_2_021B7EA7	25_2_021B7EA7
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 25_2_021C3C3E	25_2_021C3C3E
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 25_2_021B7D3E	25_2_021B7D3E

Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: String function: 0040417E appears 46 times
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: String function: 021C50D7 appears 45 times
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: String function: 021C4A68 appears 41 times
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: String function: 00434801 appears 82 times
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: String function: 020C50D7 appears 45 times
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: String function: 00457AA8 appears 34 times
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: String function: 00445951 appears 56 times
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: String function: 00402213 appears 38 times
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: String function: 004052FD appears 32 times
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: String function: 00434E70 appears 108 times
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: String function: 00401FAB appears 39 times
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: String function: 020C4A68 appears 41 times
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: String function: 00411FA2 appears 32 times
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: String function: 00402093 appears 100 times
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: String function: 004020DF appears 40 times
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: String function: 004046F7 appears 34 times
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: String function: 00401E65 appears 69 times
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: String function: 0044854A appears 36 times
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Code function: String function: 00402093 appears 50 times
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Code function: String function: 021950D7 appears 45 times
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Code function: String function: 00434801 appears 41 times
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Code function: String function: 02194A68 appears 41 times
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Code function: String function: 00401E65 appears 35 times
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Code function: String function: 00434E70 appears 54 times

Source: C:\Users\user\Desktop\YESOHDKMIm.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 2804 -s 992

Source: YESOHDKMIm.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 15.3.yavascript.exe.2280000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 15.3.yavascript.exe.2280000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 15.3.yavascript.exe.2280000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 0.2.YESOHDKMIm.exe.2160e67.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 0.2.YESOHDKMIm.exe.2160e67.1.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 0.2.YESOHDKMIm.exe.2160e67.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 25.2.yavascript.exe.2190e67.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 25.2.yavascript.exe.2190e67.1.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 25.2.yavascript.exe.2190e67.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 25.2.yavascript.exe.2190e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 25.2.yavascript.exe.2190e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 25.2.yavascript.exe.2190e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 0.2.YESOHDKMIm.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 0.2.YESOHDKMIm.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 0.2.YESOHDKMIm.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 0.2.YESOHDKMIm.exe.2160e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 0.2.YESOHDKMIm.exe.2160e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 0.2.YESOHDKMIm.exe.2160e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 15.2.yavascript.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 15.2.yavascript.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 15.2.yavascript.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 25.3.yavascript.exe.2210000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 25.3.yavascript.exe.2210000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 25.3.yavascript.exe.2210000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 0.2.YESOHDKMIm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 0.2.YESOHDKMIm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 0.2.YESOHDKMIm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 25.3.yavascript.exe.2210000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 25.3.yavascript.exe.2210000.0.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 25.3.yavascript.exe.2210000.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 0.3.YESOHDKMIm.exe.21e0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 0.3.YESOHDKMIm.exe.21e0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 0.3.YESOHDKMIm.exe.21e0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 25.2.yavascript.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 25.2.yavascript.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 25.2.yavascript.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 25.2.yavascript.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 25.2.yavascript.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 25.2.yavascript.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 15.2.yavascript.exe.2090e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 15.2.yavascript.exe.2090e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 15.2.yavascript.exe.2090e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 15.3.yavascript.exe.2280000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 15.3.yavascript.exe.2280000.0.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 15.3.yavascript.exe.2280000.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 0.3.YESOHDKMIm.exe.21e0000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 0.3.YESOHDKMIm.exe.21e0000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 0.3.YESOHDKMIm.exe.21e0000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 15.2.yavascript.exe.2090e67.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 15.2.yavascript.exe.2090e67.1.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 15.2.yavascript.exe.2090e67.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 15.2.yavascript.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 15.2.yavascript.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 15.2.yavascript.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 00000019.00000002.1539850016.0000000000750000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000000.00000002.1496727546.0000000002110000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000019.00000003.1473498633.0000000002210000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 00000019.00000003.1473498633.0000000002210000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 00000019.00000003.1473498633.0000000002210000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 0000000F.00000002.2617952063.0000000000760000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000019.00000002.1539311942.0000000000400000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 00000019.00000002.1539311942.0000000000400000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 00000019.00000002.1539311942.0000000000400000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 00000000.00000002.1496784989.0000000002160000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 00000000.00000002.1496784989.0000000002160000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000000.00000003.1352037586.00000000021E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 00000000.00000003.1352037586.00000000021E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 00000000.00000003.1352037586.00000000021E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 00000000.00000002.1496029203.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 00000000.00000002.1496029203.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 00000000.00000002.1496029203.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 0000000F.00000002.2617261877.0000000000400000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 0000000F.00000002.2617261877.0000000000400000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 0000000F.00000002.2617261877.0000000000400000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 00000019.00000002.1540122253.0000000002190000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 00000019.00000002.1540122253.0000000002190000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 0000000F.00000003.1433585955.0000000002280000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 0000000F.00000003.1433585955.0000000002280000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 0000000F.00000003.1433585955.0000000002280000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 0000000F.00000002.2618536470.0000000002090000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 0000000F.00000002.2618536470.0000000002090000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: Process Memory Space: YESOHDKMIm.exe PID: 2804, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: Process Memory Space: yavascript.exe PID: 7148, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: Process Memory Space: yavascript.exe PID: 3236, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23

Source: YESOHDKMIm.exe	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: yavascript.exe.0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winEXE@19/67@0/1

Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Code function: 0_2_0041798D GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,	0_2_0041798D
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Code function: 0_2_02177BF4 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,	0_2_02177BF4
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 15_2_0041798D GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,	15_2_0041798D
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 15_2_020A7BF4 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,	15_2_020A7BF4
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 25_2_0041798D GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,	25_2_0041798D
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 25_2_021A7BF4 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,	25_2_021A7BF4

Source: C:\Users\user\Desktop\YESOHDKMIm.exe

Code function: 0_2_0040F4AF GetModuleFileNameW,CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,CloseHandle,

0_2_0040F4AF

Source: C:\Users\user\Desktop\YESOHDKMIm.exe

Code function: 0_2_0041B539 FindResourceA,LoadResource,LockResource,SizeofResource,

0_2_0041B539

Source: C:\Users\user\Desktop\YESOHDKMIm.exe

Code function: 0_2_0041AADB OpenSCManagerW,OpenServiceW,CloseServiceHandle,StartServiceW,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,

0_2_0041AADB

Source: C:\Users\user\Desktop\YESOHDKMIm.exe

File created: C:\Users\user\AppData\Roaming\yavascript.exe

Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess2804
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7148
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess3236
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Mutant created: \Sessions\1\BaseNamedObjects\Rmc-T59BEJ

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\a5e3e4a4-63a5-4b8c-bfcb-42cbeaa9fbfe

Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Command line argument: Software\	0_2_0040EA00
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Command line argument: Rmc-T59BEJ	0_2_0040EA00
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Command line argument: Exe	0_2_0040EA00
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Command line argument: Exe	0_2_0040EA00
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Command line argument: Rmc-T59BEJ	0_2_0040EA00
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Command line argument: (TG	0_2_0040EA00
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Command line argument: Inj	0_2_0040EA00
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Command line argument: Inj	0_2_0040EA00
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Command line argument: 0i	0_2_0040EA00
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Command line argument: 0i	0_2_0040EA00
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Command line argument: 0i	0_2_0040EA00
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Command line argument: HSG	0_2_0040EA00
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Command line argument: 0i	0_2_0040EA00
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Command line argument: exepath	0_2_0040EA00
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Command line argument: HSG	0_2_0040EA00
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Command line argument: exepath	0_2_0040EA00
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Command line argument: 0i	0_2_0040EA00
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Command line argument: licence	0_2_0040EA00
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Command line argument: tMG	0_2_0040EA00
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Command line argument: `SG	0_2_0040EA00
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Command line argument: Administrator	0_2_0040EA00
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Command line argument: User	0_2_0040EA00
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Command line argument: del	0_2_0040EA00
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Command line argument: del	0_2_0040EA00
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Command line argument: del	0_2_0040EA00
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Command line argument: Software\	15_2_0040EA00
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Command line argument: Rmc-T59BEJ	15_2_0040EA00
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Command line argument: Exe	15_2_0040EA00
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Command line argument: Exe	15_2_0040EA00
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Command line argument: Rmc-T59BEJ	15_2_0040EA00
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Command line argument: (TG	15_2_0040EA00
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Command line argument: Inj	15_2_0040EA00
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Command line argument: Inj	15_2_0040EA00
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Command line argument: RG	15_2_0040EA00
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Command line argument: RG	15_2_0040EA00
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Command line argument: RG	15_2_0040EA00
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Command line argument: HSG	15_2_0040EA00
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Command line argument: RG	15_2_0040EA00
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Command line argument: exepath	15_2_0040EA00
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Command line argument: HSG	15_2_0040EA00
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Command line argument: exepath	15_2_0040EA00
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Command line argument: RG	15_2_0040EA00
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Command line argument: licence	15_2_0040EA00
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Command line argument: tMG	15_2_0040EA00
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Command line argument: `SG	15_2_0040EA00
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Command line argument: Administrator	15_2_0040EA00
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Command line argument: User	15_2_0040EA00
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Command line argument: del	15_2_0040EA00
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Command line argument: del	15_2_0040EA00
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Command line argument: del	15_2_0040EA00
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Command line argument: Software\	25_2_0040EA00
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Command line argument: 0SG	25_2_0040EA00
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Command line argument: Exe	25_2_0040EA00
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Command line argument: 0SG	25_2_0040EA00
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Command line argument: (TG	25_2_0040EA00
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Command line argument: Inj	25_2_0040EA00
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Command line argument: Inj	25_2_0040EA00
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Command line argument: RG	25_2_0040EA00
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Command line argument: RG	25_2_0040EA00
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Command line argument: RG	25_2_0040EA00
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Command line argument: HSG	25_2_0040EA00
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Command line argument: RG	25_2_0040EA00
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Command line argument: exepath	25_2_0040EA00
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Command line argument: HSG	25_2_0040EA00
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Command line argument: exepath	25_2_0040EA00
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Command line argument: RG	25_2_0040EA00
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Command line argument: licence	25_2_0040EA00
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Command line argument: tMG	25_2_0040EA00
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Command line argument: `SG	25_2_0040EA00
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Command line argument: Administrator	25_2_0040EA00
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Command line argument: User	25_2_0040EA00
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Command line argument: del	25_2_0040EA00
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Command line argument: del	25_2_0040EA00
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Command line argument: del	25_2_0040EA00

Source: YESOHDKMIm.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\YESOHDKMIm.exe

File read: C:\Users\user\Desktop\desktop.ini

Source: C:\Users\user\Desktop\YESOHDKMIm.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: YESOHDKMIm.exe

ReversingLabs: Detection: 60%

Source: C:\Users\user\Desktop\YESOHDKMIm.exe

File read: C:\Users\user\Desktop\YESOHDKMIm.exe

Source: unknown	Process created: C:\Users\user\Desktop\YESOHDKMIm.exe "C:\Users\user\Desktop\YESOHDKMIm.exe"
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 2804 -s 992
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 2804 -s 1132
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 2804 -s 1128
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 2804 -s 1156
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 2804 -s 1156
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 2804 -s 1136
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Process created: C:\Users\user\AppData\Roaming\yavascript.exe "C:\Users\user\AppData\Roaming\yavascript.exe"
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 2804 -s 968
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7148 -s 680
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7148 -s 708
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7148 -s 688
Source: unknown	Process created: C:\Users\user\AppData\Roaming\yavascript.exe "C:\Users\user\AppData\Roaming\yavascript.exe"
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7148 -s 680
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7148 -s 732
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7148 -s 728
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7148 -s 736
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7148 -s 732
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Process created: C:\Users\user\AppData\Roaming\yavascript.exe "C:\Users\user\AppData\Roaming\yavascript.exe"	Jump to behavior

Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Section loaded: msimg32.dll
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Section loaded: msvcr100.dll
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Section loaded: msimg32.dll
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Section loaded: msvcr100.dll
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Section loaded: kernel.appcore.dll

Source: C:\Users\user\Desktop\YESOHDKMIm.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Source: C:\Users\user\Desktop\YESOHDKMIm.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Detected unpacking (changes PE section rights)

Data Obfuscation

Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Unpacked PE file: 0.2.YESOHDKMIm.exe.400000.0.unpack .text:ER;.data:W;.rsrc:R;.reloc:R; vs .text:ER;.rdata:R;.data:W;.tls:W;.gfids:R;.rsrc:R;.reloc:R;
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Unpacked PE file: 15.2.yavascript.exe.400000.0.unpack .text:ER;.data:W;.rsrc:R;.reloc:R; vs .text:ER;.rdata:R;.data:W;.tls:W;.gfids:R;.rsrc:R;.reloc:R;
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Unpacked PE file: 25.2.yavascript.exe.400000.0.unpack .text:ER;.data:W;.rsrc:R;.reloc:R; vs .text:ER;.rdata:R;.data:W;.tls:W;.gfids:R;.rsrc:R;.reloc:R;

Source: C:\Users\user\Desktop\YESOHDKMIm.exe

Code function: 0_2_0041CBE1 LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetModuleHandleA,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,

0_2_0041CBE1

Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Code function: 0_2_00457186 push ecx; ret	0_2_00457199
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Code function: 0_2_0045E55D push esi; ret	0_2_0045E566
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Code function: 0_2_00457AA8 push eax; ret	0_2_00457AC6
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Code function: 0_2_00434EB6 push ecx; ret	0_2_00434EC9
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Code function: 0_2_02113242 push eax; retf	0_2_02113244
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Code function: 0_2_02112172 push cs; ret	0_2_02112175
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Code function: 0_2_02114A64 push 016C66B2h; iretd	0_2_02114AE7
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Code function: 0_2_02114994 push 016C66B2h; iretd	0_2_02114AE7
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Code function: 0_2_02113CAA push FFFFFFF6h; retf	0_2_02113CAC
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Code function: 0_2_021B73ED push ecx; ret	0_2_021B7400
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Code function: 0_2_0219511D push ecx; ret	0_2_02195130
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Code function: 0_2_02184CA7 push esi; ret	0_2_02184CA9
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Code function: 0_2_021B7D0F push eax; ret	0_2_021B7D2D
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 15_2_00457186 push ecx; ret	15_2_00457199
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 15_2_0045E55D push esi; ret	15_2_0045E566
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 15_2_00457AA8 push eax; ret	15_2_00457AC6
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 15_2_00434EB6 push ecx; ret	15_2_00434EC9
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 15_2_00762172 push cs; ret	15_2_00762175
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 15_2_00763242 push eax; retf	15_2_00763244
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 15_2_00764994 push 016C66B2h; iretd	15_2_00764AE7
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 15_2_00764A64 push 016C66B2h; iretd	15_2_00764AE7
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 15_2_00763CAA push FFFFFFF6h; retf	15_2_00763CAC
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 15_2_020E73ED push ecx; ret	15_2_020E7400
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 15_2_020C511D push ecx; ret	15_2_020C5130
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 15_2_020B4CA7 push esi; ret	15_2_020B4CA9
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 15_2_020E7D0F push eax; ret	15_2_020E7D2D
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 25_2_00457186 push ecx; ret	25_2_00457199
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 25_2_0045E55D push esi; ret	25_2_0045E566
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 25_2_00457AA8 push eax; ret	25_2_00457AC6
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 25_2_00434EB6 push ecx; ret	25_2_00434EC9
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 25_2_00752172 push cs; ret	25_2_00752175

Source: YESOHDKMIm.exe	Static PE information: section name: .text entropy: 7.3224419372179845
Source: yavascript.exe.0.dr	Static PE information: section name: .text entropy: 7.3224419372179845

Source: C:\Users\user\Desktop\YESOHDKMIm.exe

Code function: 0_2_00406EEB ShellExecuteW,URLDownloadToFileW,

0_2_00406EEB

Source: C:\Users\user\Desktop\YESOHDKMIm.exe

File created: C:\Users\user\AppData\Roaming\yavascript.exe

Jump to dropped file

Boot Survival

Creates autostart registry keys with suspicious names

Source: C:\Users\user\Desktop\YESOHDKMIm.exe

Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Rmc-T59BEJ

Delayed program exit found

Source: C:\Users\user\Desktop\YESOHDKMIm.exe

Code function: 0_2_0041AADB OpenSCManagerW,OpenServiceW,CloseServiceHandle,StartServiceW,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,

0_2_0041AADB

Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Rmc-T59BEJ			Jump to behavior
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Rmc-T59BEJ			Jump to behavior

Source: C:\Users\user\Desktop\YESOHDKMIm.exe

0_2_0041CBE1

Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX

Malware Analysis System Evasion

Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Code function: 0_2_0040F7E2 Sleep,ExitProcess,	0_2_0040F7E2
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Code function: 0_2_0216FA49 Sleep,ExitProcess,	0_2_0216FA49
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 15_2_0040F7E2 Sleep,ExitProcess,	15_2_0040F7E2
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 15_2_0209FA49 Sleep,ExitProcess,	15_2_0209FA49
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 25_2_0040F7E2 Sleep,ExitProcess,	25_2_0040F7E2
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 25_2_0219FA49 Sleep,ExitProcess,	25_2_0219FA49

Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Code function: OpenSCManagerA,EnumServicesStatusW,GetLastError,EnumServicesStatusW,OpenServiceW,QueryServiceConfigW,GetLastError,QueryServiceConfigW,CloseServiceHandle,CloseServiceHandle,	0_2_0041A7D9
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Code function: OpenSCManagerA,EnumServicesStatusW,GetLastError,EnumServicesStatusW,OpenServiceW,QueryServiceConfigW,GetLastError,QueryServiceConfigW,CloseServiceHandle,CloseServiceHandle,	0_2_0217AA40
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: OpenSCManagerA,EnumServicesStatusW,GetLastError,EnumServicesStatusW,OpenServiceW,QueryServiceConfigW,GetLastError,QueryServiceConfigW,CloseServiceHandle,CloseServiceHandle,	15_2_0041A7D9
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: OpenSCManagerA,EnumServicesStatusW,GetLastError,EnumServicesStatusW,OpenServiceW,QueryServiceConfigW,GetLastError,QueryServiceConfigW,CloseServiceHandle,CloseServiceHandle,	15_2_020AAA40
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: OpenSCManagerA,EnumServicesStatusW,GetLastError,EnumServicesStatusW,OpenServiceW,QueryServiceConfigW,GetLastError,QueryServiceConfigW,CloseServiceHandle,CloseServiceHandle,	25_2_0041A7D9
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: OpenSCManagerA,EnumServicesStatusW,GetLastError,EnumServicesStatusW,OpenServiceW,QueryServiceConfigW,GetLastError,QueryServiceConfigW,CloseServiceHandle,CloseServiceHandle,	25_2_021AAA40

Source: C:\Users\user\AppData\Roaming\yavascript.exe	Window / User API: threadDelayed 988
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Window / User API: threadDelayed 8906

Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Evaded block: after key decision			graph_0-88910
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Evaded block: after key decision			graph_0-88881

Source: C:\Users\user\Desktop\YESOHDKMIm.exe	API coverage: 4.2 %
Source: C:\Users\user\AppData\Roaming\yavascript.exe	API coverage: 6.2 %
Source: C:\Users\user\AppData\Roaming\yavascript.exe	API coverage: 4.1 %

Source: C:\Users\user\AppData\Roaming\yavascript.exe TID: 2992	Thread sleep count: 988 > 30
Source: C:\Users\user\AppData\Roaming\yavascript.exe TID: 2992	Thread sleep time: -2964000s >= -30000s
Source: C:\Users\user\AppData\Roaming\yavascript.exe TID: 2992	Thread sleep count: 8906 > 30
Source: C:\Users\user\AppData\Roaming\yavascript.exe TID: 2992	Thread sleep time: -26718000s >= -30000s

Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Code function: 0_2_0040928E __EH_prolog,__CxxThrowException@8,FindFirstFileW,FindNextFileW,FindClose,FindClose,	0_2_0040928E
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Code function: 0_2_0041C322 FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,RemoveDirectoryW,FindClose,	0_2_0041C322
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Code function: 0_2_0040C388 FindFirstFileW,PathFileExistsW,FindNextFileW,FindClose,FindClose,	0_2_0040C388
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Code function: 0_2_004096A0 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,	0_2_004096A0
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Code function: 0_2_00408847 __EH_prolog,FindFirstFileW,__CxxThrowException@8,FindNextFileW,FindClose,	0_2_00408847
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Code function: 0_2_00407877 FindFirstFileW,FindNextFileW,	0_2_00407877
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Code function: 0_2_0044E8F9 FindFirstFileExA,	0_2_0044E8F9
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Code function: 0_2_0040BB6B FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,	0_2_0040BB6B
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Code function: 0_2_00419B86 FindFirstFileW,FindNextFileW,FindNextFileW,	0_2_00419B86
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Code function: 0_2_0040BD72 FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,	0_2_0040BD72
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Code function: 0_2_0217C589 FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,RemoveDirectoryW,FindClose,	0_2_0217C589
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Code function: 0_2_0216C5EF FindFirstFileW,PathFileExistsW,FindNextFileW,FindClose,FindClose,	0_2_0216C5EF
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Code function: 0_2_02168AAE __EH_prolog,FindFirstFileW,__CxxThrowException@8,FindNextFileW,FindClose,	0_2_02168AAE
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Code function: 0_2_02167ADE FindFirstFileW,FindNextFileW,	0_2_02167ADE
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Code function: 0_2_021AEB60 FindFirstFileExA,	0_2_021AEB60
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Code function: 0_2_02169907 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,	0_2_02169907
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Code function: 0_2_0216BDD2 FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,	0_2_0216BDD2
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Code function: 0_2_02179DED FindFirstFileW,	0_2_02179DED
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 15_2_0040928E __EH_prolog,__CxxThrowException@8,FindFirstFileW,FindNextFileW,FindClose,FindClose,	15_2_0040928E
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 15_2_0041C322 FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,RemoveDirectoryW,FindClose,	15_2_0041C322
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 15_2_0040C388 FindFirstFileW,PathFileExistsW,FindNextFileW,FindClose,FindClose,	15_2_0040C388
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 15_2_004096A0 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,	15_2_004096A0
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 15_2_00408847 __EH_prolog,FindFirstFileW,__CxxThrowException@8,FindNextFileW,FindClose,	15_2_00408847
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 15_2_00407877 FindFirstFileW,FindNextFileW,	15_2_00407877
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 15_2_0044E8F9 FindFirstFileExA,	15_2_0044E8F9
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 15_2_0040BB6B FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,	15_2_0040BB6B
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 15_2_00419B86 FindFirstFileW,FindNextFileW,FindNextFileW,	15_2_00419B86
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 15_2_0040BD72 FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,	15_2_0040BD72
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 15_2_020AC589 FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,RemoveDirectoryW,FindClose,	15_2_020AC589
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 15_2_0209C5EF FindFirstFileW,PathFileExistsW,FindNextFileW,FindClose,FindClose,	15_2_0209C5EF
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 15_2_02098AAE __EH_prolog,FindFirstFileW,__CxxThrowException@8,FindNextFileW,FindClose,	15_2_02098AAE
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 15_2_02097ADE FindFirstFileW,FindNextFileW,	15_2_02097ADE
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 15_2_020DEB60 FindFirstFileExA,	15_2_020DEB60
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 15_2_02099907 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,	15_2_02099907
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 15_2_0209BDD2 FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,	15_2_0209BDD2
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 15_2_020A9DED FindFirstFileW,	15_2_020A9DED
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 25_2_0040928E __EH_prolog,__CxxThrowException@8,FindFirstFileW,FindNextFileW,FindClose,FindClose,	25_2_0040928E
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 25_2_0041C322 FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,RemoveDirectoryW,FindClose,	25_2_0041C322
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 25_2_0040C388 FindFirstFileW,PathFileExistsW,FindNextFileW,FindClose,FindClose,	25_2_0040C388
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 25_2_004096A0 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,	25_2_004096A0
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 25_2_00408847 __EH_prolog,FindFirstFileW,__CxxThrowException@8,FindNextFileW,FindClose,	25_2_00408847
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 25_2_00407877 FindFirstFileW,FindNextFileW,	25_2_00407877
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 25_2_0044E8F9 FindFirstFileExA,	25_2_0044E8F9
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 25_2_0040BB6B FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,	25_2_0040BB6B
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 25_2_00419B86 FindFirstFileW,FindNextFileW,FindNextFileW,	25_2_00419B86
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 25_2_0040BD72 FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,	25_2_0040BD72
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 25_2_021AC589 FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,RemoveDirectoryW,FindClose,	25_2_021AC589
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 25_2_0219C5EF FindFirstFileW,PathFileExistsW,FindNextFileW,FindClose,FindClose,	25_2_0219C5EF
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 25_2_02198AAE __EH_prolog,FindFirstFileW,__CxxThrowException@8,FindNextFileW,FindClose,	25_2_02198AAE
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 25_2_02197ADE FindFirstFileW,FindNextFileW,	25_2_02197ADE
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 25_2_021DEB60 FindFirstFileExA,	25_2_021DEB60
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 25_2_02199907 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,	25_2_02199907
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 25_2_0219BDD2 FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,	25_2_0219BDD2
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 25_2_021A9DED FindFirstFileW,	25_2_021A9DED

Source: C:\Users\user\Desktop\YESOHDKMIm.exe

Code function: 0_2_00407CD2 SetEvent,GetFileAttributesW,DeleteFileW,HeapCreate,ShellExecuteW,GetLogicalDriveStringsA,SetFileAttributesW,DeleteFileA,Sleep,StrToIntA,CreateDirectoryW,

0_2_00407CD2

Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\WER\ReportQueue\
Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\
Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\WER\
Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_yavascript.exe_3d328a8faf94a4241bd0f3187864b2c92a157f9_012b365d_c78d28d7-2adb-4b67-8c0b-397c281cde3f\
Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\WER\ReportQueue
Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_yavascript.exe_96681bba23e4b313c649b06b74a0d9f844b06fff_012b365d_21b14de8-9abb-49d0-9025-9a35c86b09c3\

Source: Amcache.hve.4.dr	Binary or memory string: VMware
Source: Amcache.hve.4.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.4.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.4.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.4.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.4.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.4.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.4.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.4.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.4.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.4.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.4.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: yavascript.exe, 0000000F.00000002.2618326835.0000000000814000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: Amcache.hve.4.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.4.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.4.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.4.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.4.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.4.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.4.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.4.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.4.dr	Binary or memory string: VMware-42 27 c7 3b 45 a3 e4 a4-61 bc 19 7c 28 5c 10 19
Source: Amcache.hve.4.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.4.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.4.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.4.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.4.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.4.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.4.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.4.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Users\user\AppData\Roaming\yavascript.exe

API call chain: ExitProcess graph end node

Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Process queried: DebugPort

Source: C:\Users\user\Desktop\YESOHDKMIm.exe

Code function: 0_2_00434A8A IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00434A8A

Source: C:\Users\user\Desktop\YESOHDKMIm.exe

0_2_0041CBE1

Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Code function: 0_2_00443355 mov eax, dword ptr fs:[00000030h]	0_2_00443355
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Code function: 0_2_02110083 push dword ptr fs:[00000030h]	0_2_02110083
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Code function: 0_2_021A35BC mov eax, dword ptr fs:[00000030h]	0_2_021A35BC
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Code function: 0_2_0216092B mov eax, dword ptr fs:[00000030h]	0_2_0216092B
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Code function: 0_2_02160D90 mov eax, dword ptr fs:[00000030h]	0_2_02160D90
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 15_2_00443355 mov eax, dword ptr fs:[00000030h]	15_2_00443355
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 15_2_00760083 push dword ptr fs:[00000030h]	15_2_00760083
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 15_2_020D35BC mov eax, dword ptr fs:[00000030h]	15_2_020D35BC
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 15_2_0209092B mov eax, dword ptr fs:[00000030h]	15_2_0209092B
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 15_2_02090D90 mov eax, dword ptr fs:[00000030h]	15_2_02090D90
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 25_2_00443355 mov eax, dword ptr fs:[00000030h]	25_2_00443355
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 25_2_00750083 push dword ptr fs:[00000030h]	25_2_00750083
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 25_2_021D35BC mov eax, dword ptr fs:[00000030h]	25_2_021D35BC
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 25_2_0219092B mov eax, dword ptr fs:[00000030h]	25_2_0219092B
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 25_2_02190D90 mov eax, dword ptr fs:[00000030h]	25_2_02190D90

Source: C:\Users\user\Desktop\YESOHDKMIm.exe

Code function: 0_2_004120B2 GetProcessHeap,HeapFree,

0_2_004120B2

Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Code function: 0_2_0043503C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_0043503C
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Code function: 0_2_00434A8A IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00434A8A
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Code function: 0_2_0043BB71 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_0043BB71
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Code function: 0_2_00434BD8 SetUnhandledExceptionFilter,	0_2_00434BD8
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Code function: 0_2_021952A3 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_021952A3
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Code function: 0_2_02194CF1 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_02194CF1
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Code function: 0_2_0219BDD8 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_0219BDD8
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 15_2_0043503C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	15_2_0043503C
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 15_2_00434A8A IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	15_2_00434A8A
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 15_2_0043BB71 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	15_2_0043BB71
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 15_2_00434BD8 SetUnhandledExceptionFilter,	15_2_00434BD8
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 15_2_020C52A3 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	15_2_020C52A3
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 15_2_020C4CF1 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	15_2_020C4CF1
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 15_2_020CBDD8 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	15_2_020CBDD8
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 25_2_0043503C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	25_2_0043503C
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 25_2_00434A8A IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	25_2_00434A8A
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 25_2_0043BB71 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	25_2_0043BB71
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 25_2_00434BD8 SetUnhandledExceptionFilter,	25_2_00434BD8
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 25_2_021C52A3 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	25_2_021C52A3
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 25_2_021C4CF1 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	25_2_021C4CF1
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: 25_2_021CBDD8 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	25_2_021CBDD8

Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Code function: GetCurrentProcessId,OpenMutexA,CloseHandle,CreateThread,CloseHandle,Sleep,OpenProcess, svchost.exe	0_2_00412132
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: GetCurrentProcessId,OpenMutexA,CloseHandle,CreateThread,CloseHandle,Sleep,OpenProcess, svchost.exe	15_2_00412132
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: GetCurrentProcessId,OpenMutexA,CloseHandle,CreateThread,CloseHandle,Sleep,OpenProcess, svchost.exe	25_2_00412132

Source: C:\Users\user\Desktop\YESOHDKMIm.exe

Code function: 0_2_00419662 mouse_event,

0_2_00419662

Source: C:\Users\user\Desktop\YESOHDKMIm.exe

Process created: C:\Users\user\AppData\Roaming\yavascript.exe "C:\Users\user\AppData\Roaming\yavascript.exe"

Source: C:\Users\user\Desktop\YESOHDKMIm.exe

Code function: 0_2_00434CB6 cpuid

0_2_00434CB6

Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Code function: EnumSystemLocalesW,	0_2_0045201B
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Code function: EnumSystemLocalesW,	0_2_004520B6
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	0_2_00452143
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Code function: GetLocaleInfoW,	0_2_00452393
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Code function: EnumSystemLocalesW,	0_2_00448484
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_004524BC
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Code function: GetLocaleInfoW,	0_2_004525C3
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_00452690
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Code function: GetLocaleInfoW,	0_2_0044896D
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Code function: GetLocaleInfoA,	0_2_0040F90C
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Code function: IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,	0_2_00451D58
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Code function: EnumSystemLocalesW,	0_2_00451FD0
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Code function: EnumSystemLocalesW,	0_2_021B2237
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Code function: EnumSystemLocalesW,	0_2_021B2282
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Code function: EnumSystemLocalesW,	0_2_021B231D
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Code function: EnumSystemLocalesW,	0_2_021A86EB
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_021B2723
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Code function: GetLocaleInfoW,	0_2_021B25FA
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Code function: GetLocaleInfoA,	0_2_0216FB73
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Code function: GetLocaleInfoW,	0_2_021A8BD4
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Code function: GetLocaleInfoW,	0_2_021B282A
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_021B28F7
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Code function: IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,	0_2_021B1FBF
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: EnumSystemLocalesW,	15_2_0045201B
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: EnumSystemLocalesW,	15_2_004520B6
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	15_2_00452143
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: GetLocaleInfoW,	15_2_00452393
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: EnumSystemLocalesW,	15_2_00448484
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	15_2_004524BC
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: GetLocaleInfoW,	15_2_004525C3
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	15_2_00452690
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: GetLocaleInfoW,	15_2_0044896D
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: GetLocaleInfoA,	15_2_0040F90C
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,	15_2_00451D58
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: EnumSystemLocalesW,	15_2_00451FD0
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: EnumSystemLocalesW,	15_2_020E2237
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: EnumSystemLocalesW,	15_2_020E2282
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: EnumSystemLocalesW,	15_2_020E231D
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: EnumSystemLocalesW,	15_2_020D86EB
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	15_2_020E2723
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: GetLocaleInfoW,	15_2_020E25FA
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: GetLocaleInfoA,	15_2_0209FB73
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: GetLocaleInfoW,	15_2_020D8BD4
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: GetLocaleInfoW,	15_2_020E282A
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	15_2_020E28F7
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,	15_2_020E1FBF
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: EnumSystemLocalesW,	25_2_0045201B
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: EnumSystemLocalesW,	25_2_004520B6
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	25_2_00452143
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: GetLocaleInfoW,	25_2_00452393
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: EnumSystemLocalesW,	25_2_00448484
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	25_2_004524BC
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: GetLocaleInfoW,	25_2_004525C3
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	25_2_00452690
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: GetLocaleInfoW,	25_2_0044896D
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: GetLocaleInfoA,	25_2_0040F90C
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,	25_2_00451D58
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: EnumSystemLocalesW,	25_2_00451FD0
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: EnumSystemLocalesW,	25_2_021E2237
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: EnumSystemLocalesW,	25_2_021E2282
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: EnumSystemLocalesW,	25_2_021E231D
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: EnumSystemLocalesW,	25_2_021D86EB
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	25_2_021E2723
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: GetLocaleInfoW,	25_2_021E25FA
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: GetLocaleInfoA,	25_2_0219FB73
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: GetLocaleInfoW,	25_2_021D8BD4
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: GetLocaleInfoW,	25_2_021E282A
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	25_2_021E28F7
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,	25_2_021E1FBF

Source: C:\Users\user\Desktop\YESOHDKMIm.exe

Code function: 0_2_0041A045 __EH_prolog,73C05D90,CreateDirectoryW,Sleep,Sleep,GetLocalTime,Sleep,

0_2_0041A045

Source: C:\Users\user\Desktop\YESOHDKMIm.exe

Code function: 0_2_0041B69E GetComputerNameExW,GetUserNameW,

0_2_0041B69E

Source: C:\Users\user\Desktop\YESOHDKMIm.exe

Code function: 0_2_00449210 _free,_free,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,_free,

0_2_00449210

Source: C:\Users\user\AppData\Roaming\yavascript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Source: Amcache.hve.4.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.4.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.4.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.4.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23090.2008-0\msmpeng.exe
Source: Amcache.hve.4.dr	Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information

Contains functionality to steal Chrome passwords or cookies

Source: Yara match	File source: 15.3.yavascript.exe.2280000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.YESOHDKMIm.exe.2160e67.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.yavascript.exe.2190e67.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.yavascript.exe.2190e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.YESOHDKMIm.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.YESOHDKMIm.exe.2160e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.yavascript.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.3.yavascript.exe.2210000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.YESOHDKMIm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.3.yavascript.exe.2210000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.YESOHDKMIm.exe.21e0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.yavascript.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.yavascript.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.yavascript.exe.2090e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.3.yavascript.exe.2280000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.YESOHDKMIm.exe.21e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.yavascript.exe.2090e67.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.yavascript.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000019.00000002.1539911339.00000000007BA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1496387665.0000000000694000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000003.1473498633.0000000002210000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.2618326835.0000000000814000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.1539311942.0000000000400000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1496784989.0000000002160000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1352037586.00000000021E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1496029203.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.2617261877.0000000000400000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.1540122253.0000000002190000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.1433585955.0000000002280000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.2618536470.0000000002090000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: YESOHDKMIm.exe PID: 2804, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: yavascript.exe PID: 7148, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: yavascript.exe PID: 3236, type: MEMORYSTR

Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Code function: \AppData\Local\Google\Chrome\User Data\Default\Login Data	0_2_0040BA4D
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: \AppData\Local\Google\Chrome\User Data\Default\Login Data	15_2_0040BA4D
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: \AppData\Local\Google\Chrome\User Data\Default\Login Data	25_2_0040BA4D

Contains functionality to steal Firefox passwords or cookies

Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Code function: \AppData\Roaming\Mozilla\Firefox\Profiles\	0_2_0040BB6B
Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Code function: \key3.db	0_2_0040BB6B
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: \AppData\Roaming\Mozilla\Firefox\Profiles\	15_2_0040BB6B
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: \key3.db	15_2_0040BB6B
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: \AppData\Roaming\Mozilla\Firefox\Profiles\	25_2_0040BB6B
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: \key3.db	25_2_0040BB6B

Remote Access Functionality

Detected Remcos RAT

Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Mutex created: \Sessions\1\BaseNamedObjects\Rmc-T59BEJ	Jump to behavior
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Mutex created: \Sessions\1\BaseNamedObjects\Rmc-T59BEJ
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Mutex created: \Sessions\1\BaseNamedObjects\Rmc-T59BEJ

Source: Yara match	File source: 15.3.yavascript.exe.2280000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.YESOHDKMIm.exe.2160e67.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.yavascript.exe.2190e67.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.yavascript.exe.2190e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.YESOHDKMIm.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.YESOHDKMIm.exe.2160e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.yavascript.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.3.yavascript.exe.2210000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.YESOHDKMIm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.3.yavascript.exe.2210000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.YESOHDKMIm.exe.21e0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.yavascript.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.yavascript.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.yavascript.exe.2090e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.3.yavascript.exe.2280000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.YESOHDKMIm.exe.21e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.yavascript.exe.2090e67.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.yavascript.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000019.00000002.1539911339.00000000007BA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1496387665.0000000000694000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000003.1473498633.0000000002210000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.2618326835.0000000000814000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.1539311942.0000000000400000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1496784989.0000000002160000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1352037586.00000000021E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1496029203.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.2617261877.0000000000400000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.1540122253.0000000002190000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.1433585955.0000000002280000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.2618536470.0000000002090000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: YESOHDKMIm.exe PID: 2804, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: yavascript.exe PID: 7148, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: yavascript.exe PID: 3236, type: MEMORYSTR

Source: C:\Users\user\Desktop\YESOHDKMIm.exe	Code function: cmd.exe	0_2_0040569A
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: cmd.exe	15_2_0040569A
Source: C:\Users\user\AppData\Roaming\yavascript.exe	Code function: cmd.exe	25_2_0040569A

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	1 OS Credential Dumping	2 System Time Discovery	Remote Services	11 Archive Collected Data	11 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	12 Command and Scripting Interpreter	1 Windows Service	1 Bypass User Account Control	3 Obfuscated Files or Information	111 Input Capture	1 Account Discovery	Remote Desktop Protocol	111 Input Capture	2 Encrypted Channel	Exfiltration Over Bluetooth	1 Defacement
Email Addresses	DNS Server	Domain Accounts	2 Service Execution	11 Registry Run Keys / Startup Folder	1 Access Token Manipulation	12 Software Packing	2 Credentials In Files	1 System Service Discovery	SMB/Windows Admin Shares	3 Clipboard Data	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 Windows Service	1 DLL Side-Loading	NTDS	4 File and Directory Discovery	Distributed Component Object Model	Input Capture	1 Remote Access Software	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	21 Process Injection	1 Bypass User Account Control	LSA Secrets	23 System Information Discovery	SSH	Keylogging	1 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	11 Registry Run Keys / Startup Folder	1 Masquerading	Cached Domain Credentials	141 Security Software Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	2 Virtualization/Sandbox Evasion	DCSync	2 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Access Token Manipulation	Proc Filesystem	1 Process Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	21 Process Injection	/etc/passwd and /etc/shadow	1 Application Window Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	Dynamic API Resolution	Network Sniffing	1 System Owner/User Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
YESOHDKMIm.exe	61%	ReversingLabs	Win32.Trojan.Leonem
YESOHDKMIm.exe	100%	Avira	HEUR/AGEN.1306992
YESOHDKMIm.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\yavascript.exe	61%	ReversingLabs	Win32.Trojan.Leonem

Name	IP	Active	Malicious	Antivirus Detection	Reputation
s-part-0017.t-0009.t-msedge.net	13.107.246.45	true	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
http://geoplugin.net/json.gp	yavascript.exe	false	high
http://upx.sf.net	Amcache.hve.4.dr	false	high
http://geoplugin.net/json.gp/C	YESOHDKMIm.exe, 00000000.00000002.1496784989.0000000002160000.00000040.00001000.00020000.00000000.sdmp, YESOHDKMIm.exe, 00000000.00000003.1352037586.00000000021E0000.00000004.00001000.00020000.00000000.sdmp, YESOHDKMIm.exe, 00000000.00000002.1496029203.0000000000400000.00000040.00000001.01000000.00000003.sdmp, yavascript.exe, 0000000F.00000002.2618536470.0000000002090000.00000040.00001000.00020000.00000000.sdmp, yavascript.exe, 0000000F.00000002.2617261877.0000000000400000.00000040.00000001.01000000.00000007.sdmp, yavascript.exe, 0000000F.00000003.1433585955.0000000002280000.00000004.00001000.00020000.00000000.sdmp, yavascript.exe, 00000019.00000003.1473498633.0000000002210000.00000004.00001000.00020000.00000000.sdmp, yavascript.exe, 00000019.00000002.1539311942.0000000000400000.00000040.00000001.01000000.00000007.sdmp, yavascript.exe, 00000019.00000002.1540122253.0000000002190000.00000040.00001000.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
198.23.227.212	unknown	United States		36352	AS-COLOCROSSINGUS	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1550261
Start date and time:	2024-11-06 16:12:04 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 9s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	40
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	YESOHDKMIm.exe renamed because original name is a hash value
Original Sample Name:	df25fa5d95355db39284da9c5e28bc040305fb125683a470b92c7a4cc225645c.exe
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winEXE@19/67@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 14 Number of non-executed functions: 390
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WerFault.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 13.89.179.12, 20.42.73.29
Excluded domains from analysis (whitelisted): login.live.com, slscr.update.microsoft.com, otelrules.azureedge.net, otelrules.afd.azureedge.net, blobcollector.events.data.trafficmanager.net, onedsblobprdeus15.eastus.cloudapp.azure.com, azureedge-t-prod.trafficmanager.net, umwatson.events.data.microsoft.com, onedsblobprdcus17.centralus.cloudapp.azure.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: YESOHDKMIm.exe

Simulations

Behavior and APIs

Time	Type	Description
10:13:11	API Interceptor	2x Sleep call for process: WerFault.exe modified
10:13:44	API Interceptor	281626x Sleep call for process: yavascript.exe modified
15:12:59	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run Rmc-T59BEJ "C:\Users\user\AppData\Roaming\yavascript.exe"
15:13:07	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run Rmc-T59BEJ "C:\Users\user\AppData\Roaming\yavascript.exe"

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
198.23.227.212	NujUXO42Rg.exe	Get hash	malicious	Remcos	Browse
	ZeaS4nUxg4.exe	Get hash	malicious	Remcos	Browse
	documents-pdf.exe	Get hash	malicious	Remcos	Browse
	1kZ9olJiaG.exe	Get hash	malicious	Remcos	Browse
	ltlbVjClX9.exe	Get hash	malicious	Remcos	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
s-part-0017.t-0009.t-msedge.net	https://www.google.co.in/url?q=jODz3y3HOSozuuQiApLh&rct=5CHARyytTPSJ3J3wDcT&sa=t&esrc=sf_rand_string_mixed(5)FgECA0xys8Em2FL&source=&cd=HXUursu8uEcr4eTiw9XH&cad=XpPkDfJ6CHARlDJVS0Y&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp%2Fir.nbaikp3.sa.com%2Fdelaw%2Flawn%2Fkoo%2Fsf_rand_string_mixed(24)/braswells@helenaindustries.com	Get hash	malicious	Unknown	Browse	13.107.246.45
	fIwP4c7xYt.exe	Get hash	malicious	GuLoader	Browse	13.107.246.45
	2CUvvDyapb.exe	Get hash	malicious	Remcos	Browse	13.107.246.45
	DHOYXfCAeB.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	13.107.246.45
	http://blacksaltys.com	Get hash	malicious	Unknown	Browse	13.107.246.45
	http://blacksaltys.com	Get hash	malicious	Unknown	Browse	13.107.246.45
	N2DJ1eUIE6.exe	Get hash	malicious	FormBook, GuLoader	Browse	13.107.246.45
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	https://booking.com@slongre.com/vrmcoabu	Get hash	malicious	Unknown	Browse	13.107.246.45
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.45

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AS-COLOCROSSINGUS	173090160965f4af6053e0cc550b1580793735ec4c6bd2a63005d1f358aeab4a3375f6790f876.dat-decoded.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	107.174.244.110
	FACF9877656789000.bat.exe	Get hash	malicious	Remcos	Browse	192.3.101.137
	1730880308a25cd41259538643a6a02b355f33de1f56cb7e6d874f22aad09eac2596439da1840.dat-decoded.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	107.173.160.168
	1730880247cf66167bcfd0746932f87db200bfceb4d3c06bb32722efa7cbc37412fdc49363938.dat-decoded.exe	Get hash	malicious	XWorm	Browse	192.3.176.176
	givenmebestthignswithgoodnewforentirerlifethingstobe.hta	Get hash	malicious	Cobalt Strike, HTMLPhisher	Browse	172.245.135.166
	goodthingsforentireprocessgetmebackwithgoodnewsthings.hta	Get hash	malicious	Cobalt Strike, HTMLPhisher	Browse	107.172.61.130
	createdbestthingswithentirelifewithgoodfeaturesareonhere.hta	Get hash	malicious	Cobalt Strike, HTMLPhisher	Browse	107.173.4.23
	xBA TM06-Q6-11-24.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	107.174.244.110
	NujUXO42Rg.exe	Get hash	malicious	Remcos	Browse	198.23.227.212
	Payment Advice-RefA22D4YdWsbE5.xla.xlsx	Get hash	malicious	FormBook, HTMLPhisher	Browse	107.173.4.23

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_YESOHDKMIm.exe_153331ae1e10073ccd2a7c0ea68cb7f6a2d16c_002bbdc9_03c5192a-21cd-409f-ae90-dc396ce6015d\Report.wer

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9503615464249552
Encrypted:	false
SSDEEP:	192:RasUiAim056r3tujxrZr6GzuiFLZ24IO88m:R9UiAiN56rAj9zuiFLY4IO8V
MD5:	7B8D3EE7A080A23CFEE409AFB012E459
SHA1:	9A9BCCEEAE02804A8C324AE75C0987C292E0B80F
SHA-256:	43F856BA4494890660F0B95E916B435E4ABF51C9A57D0AC29481857F2B975EF1
SHA-512:	CE5DE5D6BF3A28DBD65EC630003D8047513FB59D3449C874ED2FAC8B0A0CA3DF0447E2206543B62043111035CC621C8187E5B5FD67F0D5CB53866C39508A61F7
Malicious:	true
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.5.3.7.9.5.7.8.6.6.9.1.2.3.5.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.0.3.c.5.1.9.2.a.-.2.1.c.d.-.4.0.9.f.-.a.e.9.0.-.d.c.3.9.6.c.e.6.0.1.5.d.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.a.1.a.1.1.8.a.b.-.5.3.f.1.-.4.5.6.7.-.9.d.a.7.-.2.7.d.d.6.f.b.f.e.3.8.0.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.Y.E.S.O.H.D.K.M.I.m...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.a.f.4.-.0.0.0.1.-.0.0.1.4.-.b.b.9.a.-.c.5.5.b.5.e.3.0.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.0.f.2.b.f.7.6.8.8.3.c.4.2.f.b.0.3.f.1.8.9.3.c.6.b.5.1.0.b.2.3.6.0.0.0.0.f.f.f.f.!.0.0.0.0.6.7.4.b.d.1.0.d.e.f.1.7.2.7.8.7.6.7.0.6.c.9.8.6.1.f.b.1.6.8.5.0.f.d.d.7.a.2.d.0.!.Y.E.S.O.H.D.K.M.I.m...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.1.0././.1.7.:.0.7.:.4.5.:.5.3.!.0.!.Y.E.S.O.H.D.K.M.I.m...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.9.6.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_YESOHDKMIm.exe_153331ae1e10073ccd2a7c0ea68cb7f6a2d16c_002bbdc9_1a4c5f90-1685-4f59-9fe9-7364e8eed234\Report.wer

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9637637379755916
Encrypted:	false
SSDEEP:	192:YzsUiATtm056r3tujxrZr6pzuiFLZ24IO88m:FUiAZN56rAjKzuiFLY4IO8V
MD5:	3230C152A2E98F3DDA0BF352154DE7C7
SHA1:	13F762DE813149947CB3D08135AD81AFEF600E34
SHA-256:	8ECC7A866845A9130E9750138961C138130CFA8842D8B5A13BFB24B779E6934C
SHA-512:	74132F56F6FE41080277B0B046319DC9F1813C9E09B309C06C9EDC7882F450F7E17F080E2A2BF26203A5A1FAC981064A6AD49B2F9B1D6A2CF396BB897BAB9DEB
Malicious:	true
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.5.3.7.9.5.8.2.7.5.0.8.3.1.0.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.1.a.4.c.5.f.9.0.-.1.6.8.5.-.4.f.5.9.-.9.f.e.9.-.7.3.6.4.e.8.e.e.d.2.3.4.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.1.f.d.d.9.d.a.a.-.2.8.f.b.-.4.4.9.d.-.a.2.4.4.-.9.4.1.a.d.6.b.9.5.1.6.c.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.Y.E.S.O.H.D.K.M.I.m...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.a.f.4.-.0.0.0.1.-.0.0.1.4.-.b.b.9.a.-.c.5.5.b.5.e.3.0.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.0.f.2.b.f.7.6.8.8.3.c.4.2.f.b.0.3.f.1.8.9.3.c.6.b.5.1.0.b.2.3.6.0.0.0.0.f.f.f.f.!.0.0.0.0.6.7.4.b.d.1.0.d.e.f.1.7.2.7.8.7.6.7.0.6.c.9.8.6.1.f.b.1.6.8.5.0.f.d.d.7.a.2.d.0.!.Y.E.S.O.H.D.K.M.I.m...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.1.0././.1.7.:.0.7.:.4.5.:.5.3.!.0.!.Y.E.S.O.H.D.K.M.I.m...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.9.6.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_YESOHDKMIm.exe_153331ae1e10073ccd2a7c0ea68cb7f6a2d16c_002bbdc9_92a3fb56-325f-4ccf-a4fa-668e43f9db68\Report.wer

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.963685164520514
Encrypted:	false
SSDEEP:	192:isUiAZm056r3tujxrZr6pzuiFLZ24IO88m:1UiAZN56rAjKzuiFLY4IO8V
MD5:	3CFDAC4B9776479259402049849F9AF2
SHA1:	4F0FEE62A9E80E55BC45FF36CBC5E3FD70D6E6F6
SHA-256:	97E0058D3DE06EF1726695B9BD544EBC766A637906F0A6D3F6129AC48518F9C7
SHA-512:	D9258204BA192F4A9F0AC2D8EA6D61207C177D443D770DF55F1CAB1877D49F5B541E97A7F1C60B90C66E949E26510D863A4E877391C5AC3F073C8DA1733BFA4B
Malicious:	true
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.5.3.7.9.5.8.2.0.5.0.7.0.1.2.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.9.2.a.3.f.b.5.6.-.3.2.5.f.-.4.c.c.f.-.a.4.f.a.-.6.6.8.e.4.3.f.9.d.b.6.8.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.d.2.e.9.5.4.3.c.-.3.6.f.c.-.4.1.8.f.-.8.b.0.3.-.f.a.8.1.0.c.0.f.a.c.f.9.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.Y.E.S.O.H.D.K.M.I.m...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.a.f.4.-.0.0.0.1.-.0.0.1.4.-.b.b.9.a.-.c.5.5.b.5.e.3.0.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.0.f.2.b.f.7.6.8.8.3.c.4.2.f.b.0.3.f.1.8.9.3.c.6.b.5.1.0.b.2.3.6.0.0.0.0.f.f.f.f.!.0.0.0.0.6.7.4.b.d.1.0.d.e.f.1.7.2.7.8.7.6.7.0.6.c.9.8.6.1.f.b.1.6.8.5.0.f.d.d.7.a.2.d.0.!.Y.E.S.O.H.D.K.M.I.m...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.1.0././.1.7.:.0.7.:.4.5.:.5.3.!.0.!.Y.E.S.O.H.D.K.M.I.m...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.9.6.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_YESOHDKMIm.exe_153331ae1e10073ccd2a7c0ea68cb7f6a2d16c_002bbdc9_9e6fdc43-fdf8-43d3-a3dd-bfc8ca98f9ee\Report.wer

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9637314353544473
Encrypted:	false
SSDEEP:	192:fsUiAZm056r3tujxrZr6pzuiFLZ24IO88m:0UiAZN56rAjKzuiFLY4IO8V
MD5:	5AB40933380694AB2D4C57ED3B17104B
SHA1:	700BBE220841519A4D70E7BB2DCD05CAEE8E63D3
SHA-256:	7302CBA868EABDC11B15B4612088BE8DCCE92C7CBB4ED037906F50FAE8FC4C92
SHA-512:	D96F59FD3FF5753DEAA4A2AAB2FDA98D57ADF219AD9F888FC00570225FC5B925847DDFA28A8EC583F1B50899458BEE1398A29077C1B2EE6B74C145F5D6BD671C
Malicious:	true
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.5.3.7.9.5.8.0.0.6.4.9.7.1.3.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.9.e.6.f.d.c.4.3.-.f.d.f.8.-.4.3.d.3.-.a.3.d.d.-.b.f.c.8.c.a.9.8.f.9.e.e.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.4.5.f.7.e.2.4.f.-.b.d.6.b.-.4.4.b.6.-.8.2.e.8.-.8.b.7.8.6.e.b.5.d.7.9.f.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.Y.E.S.O.H.D.K.M.I.m...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.a.f.4.-.0.0.0.1.-.0.0.1.4.-.b.b.9.a.-.c.5.5.b.5.e.3.0.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.0.f.2.b.f.7.6.8.8.3.c.4.2.f.b.0.3.f.1.8.9.3.c.6.b.5.1.0.b.2.3.6.0.0.0.0.f.f.f.f.!.0.0.0.0.6.7.4.b.d.1.0.d.e.f.1.7.2.7.8.7.6.7.0.6.c.9.8.6.1.f.b.1.6.8.5.0.f.d.d.7.a.2.d.0.!.Y.E.S.O.H.D.K.M.I.m...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.1.0././.1.7.:.0.7.:.4.5.:.5.3.!.0.!.Y.E.S.O.H.D.K.M.I.m...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.9.6.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_YESOHDKMIm.exe_153331ae1e10073ccd2a7c0ea68cb7f6a2d16c_002bbdc9_c7c9d1c9-fa1c-4b30-aaf7-00830b6c5aac\Report.wer

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9641410067440029
Encrypted:	false
SSDEEP:	192:UQsUiA4m056r3tujxrZr6pzuiFLZ24IO88m:UTUiA4N56rAjKzuiFLY4IO8V
MD5:	368A68B54CA7C7497952829C34E21930
SHA1:	C54BCEAB823EFD9656AF05E6283EBE04C4E6D950
SHA-256:	47A5E0845930632BC20D6B2E9A83737327E35239EE0FAAAB51C6DD108ED48BAC
SHA-512:	6BB1867F547F00F8691A44CEE5F514E5795FA0150166D1D447F3EDC68B447D070CA55920ECCEC2F1711CCA9E098E40E02B1CF1FA54ADCB433DE8265DA493973D
Malicious:	true
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.5.3.7.9.5.7.9.3.9.4.1.3.8.9.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.c.7.c.9.d.1.c.9.-.f.a.1.c.-.4.b.3.0.-.a.a.f.7.-.0.0.8.3.0.b.6.c.5.a.a.c.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.b.5.b.0.4.9.8.f.-.e.2.2.d.-.4.a.b.2.-.a.f.5.e.-.7.9.6.4.6.9.1.a.5.1.3.8.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.Y.E.S.O.H.D.K.M.I.m...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.a.f.4.-.0.0.0.1.-.0.0.1.4.-.b.b.9.a.-.c.5.5.b.5.e.3.0.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.0.f.2.b.f.7.6.8.8.3.c.4.2.f.b.0.3.f.1.8.9.3.c.6.b.5.1.0.b.2.3.6.0.0.0.0.f.f.f.f.!.0.0.0.0.6.7.4.b.d.1.0.d.e.f.1.7.2.7.8.7.6.7.0.6.c.9.8.6.1.f.b.1.6.8.5.0.f.d.d.7.a.2.d.0.!.Y.E.S.O.H.D.K.M.I.m...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.1.0././.1.7.:.0.7.:.4.5.:.5.3.!.0.!.Y.E.S.O.H.D.K.M.I.m...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.9.6.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_YESOHDKMIm.exe_153331ae1e10073ccd2a7c0ea68cb7f6a2d16c_002bbdc9_da78b0e3-d944-4ba7-91d1-ebb23de76c5b\Report.wer

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9636246440037198
Encrypted:	false
SSDEEP:	192:9OsUiATm056r3tujxrZr6pzuiFLZ24IO88m:9RUiATN56rAjKzuiFLY4IO8V
MD5:	B527E21BB6855EAF8930F0CB073A4A39
SHA1:	68E09721D6432846376D2657ADAC04D888AE7E7B
SHA-256:	69F869FE0EFA595FEDCA261F032F31973E1BB00C48091ACC3AAF122F4DD0D538
SHA-512:	F32565CBA2E17F595B4AF7ED5D6CA565C1E24A6A7BF74D779EE83D03F07CA2476C61CB5FD53479C1ED1644B8C9132683CFE7054FB7737319C2552791755175CD
Malicious:	true
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.5.3.7.9.5.8.1.3.8.7.1.1.2.9.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.d.a.7.8.b.0.e.3.-.d.9.4.4.-.4.b.a.7.-.9.1.d.1.-.e.b.b.2.3.d.e.7.6.c.5.b.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.5.9.a.7.d.b.1.5.-.f.a.2.3.-.4.7.1.2.-.8.1.5.e.-.a.9.1.8.5.1.3.9.1.b.0.0.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.Y.E.S.O.H.D.K.M.I.m...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.a.f.4.-.0.0.0.1.-.0.0.1.4.-.b.b.9.a.-.c.5.5.b.5.e.3.0.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.0.f.2.b.f.7.6.8.8.3.c.4.2.f.b.0.3.f.1.8.9.3.c.6.b.5.1.0.b.2.3.6.0.0.0.0.f.f.f.f.!.0.0.0.0.6.7.4.b.d.1.0.d.e.f.1.7.2.7.8.7.6.7.0.6.c.9.8.6.1.f.b.1.6.8.5.0.f.d.d.7.a.2.d.0.!.Y.E.S.O.H.D.K.M.I.m...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.1.0././.1.7.:.0.7.:.4.5.:.5.3.!.0.!.Y.E.S.O.H.D.K.M.I.m...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.9.6.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_YESOHDKMIm.exe_b67ac8cbe5fb1685c12e1ff4abef3e46d991938_002bbdc9_838e463f-6c55-44a4-9970-6b3fc7f5f0ea\Report.wer

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.0342878348567874
Encrypted:	false
SSDEEP:	192:RcLolnisUiAi/0N13FtpXtujxrZr6HXdzuiFLZ24IO8xmG:6SUiAisN13Ftpgj+zuiFLY4IO8AG
MD5:	A3B712D9731332C495AF2D4544088154
SHA1:	C59F7CFEA2CEB6EFFAE8CC13CBBBF3BD45A62155
SHA-256:	DE40485E2073D55A18ABB2604B57FD77DA1105AA4ED84A290812B3E95096628B
SHA-512:	40FBE04A1D609D5AC09C97E7F425412BC57E4D0448E376EC83727DE825C581BFF8A795D3566F093CFFF56089EDC21C0614B5BC87CB706D626758390CF3421850
Malicious:	true
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.5.3.7.9.5.8.4.5.9.5.1.7.1.6.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.5.3.7.9.5.8.5.1.8.8.9.5.1.5.....R.e.p.o.r.t.S.t.a.t.u.s.=.6.5.5.4.5.6.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.8.3.8.e.4.6.3.f.-.6.c.5.5.-.4.4.a.4.-.9.9.7.0.-.6.b.3.f.c.7.f.5.f.0.e.a.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.1.2.0.c.2.1.d.0.-.9.2.2.c.-.4.5.a.0.-.a.6.a.5.-.0.b.3.b.f.9.8.9.a.7.a.d.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.Y.E.S.O.H.D.K.M.I.m...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.a.f.4.-.0.0.0.1.-.0.0.1.4.-.b.b.9.a.-.c.5.5.b.5.e.3.0.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.0.f.2.b.f.7.6.8.8.3.c.4.2.f.b.0.3.f.1.8.9.3.c.6.b.5.1.0.b.2.3.6.0.0.0.0.f.f.f.f.!.0.0.0.0.6.7.4.b.d.1.0.d.e.f.1.7.2.7.8.7.6.7.0.6.c.9.8.6.1.f.b.1.6.8.5.0.f.d.d.7.a.2.d.0.!.Y.E.S.O.H.D.K.M.I.m...e.x.e.....T.a.r.g.e.t.A.p.p.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_yavascript.exe_27ca466ffd7290bef9fefd51faaeaa9b671b21e_012b365d_9e000b64-b17e-46c9-abee-f2bcb937e8e8\Report.wer

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8878010616187281
Encrypted:	false
SSDEEP:	192:1/pMsUoecK/0zcPG1mjJnZr9zuiFLZ24IO8fu:rvUoeZszcPLjJzuiFLY4IO8m
MD5:	DBDAA6B15D18C900DC5D24F61334FC65
SHA1:	9492470FEFF77326AE28DB82627E40A305385F99
SHA-256:	D131DC366C2A59FAFBE9F3F499B4A75EF5536301FEAF0F377D6D9689CC37CA8E
SHA-512:	B6951C5120F4FA5F01136EA44F22002660FAB9D4503B401A57E29B98DC3F73CA4B17E83E033FEA183493FEBE580A54758A19A5972B6689B099DB6CBD6130F091
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.5.3.7.9.5.9.0.2.2.6.0.7.5.3.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.5.3.7.9.5.9.0.8.1.9.8.2.4.2.....R.e.p.o.r.t.S.t.a.t.u.s.=.6.5.5.4.5.6.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.9.e.0.0.0.b.6.4.-.b.1.7.e.-.4.6.c.9.-.a.b.e.e.-.f.2.b.c.b.9.3.7.e.8.e.8.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.8.0.e.6.a.d.d.d.-.4.9.0.c.-.4.2.d.5.-.9.8.8.0.-.6.0.a.f.5.2.2.e.1.0.2.4.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.y.a.v.a.s.c.r.i.p.t...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.c.a.4.-.0.0.0.1.-.0.0.1.4.-.2.c.1.4.-.b.8.6.2.5.e.3.0.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.8.5.c.1.e.b.a.f.9.5.8.1.3.4.e.6.7.4.a.7.a.7.b.d.1.6.3.6.2.9.2.4.0.0.0.0.f.f.f.f.!.0.0.0.0.6.7.4.b.d.1.0.d.e.f.1.7.2.7.8.7.6.7.0.6.c.9.8.6.1.f.b.1.6.8.5.0.f.d.d.7.a.2.d.0.!.y.a.v.a.s.c.r.i.p.t...e.x.e.....T.a.r.g.e.t.A.p.p.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_yavascript.exe_3d328a8faf94a4241bd0f3187864b2c92a157f9_012b365d_8aaeb760-03ad-4d40-a7db-c633119c0d82\Report.wer

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9309658706368895
Encrypted:	false
SSDEEP:	192:EsUoeuI0JsAnbcA61mjxrZr60zuiFLZ24IO8yu:3UoeujJsAnbcAfjHzuiFLY4IO8T
MD5:	A5DC1B2C13F0FF84D1C6317AD734033A
SHA1:	F538A926E87DF196C869E697C3E9BDEF48F7D447
SHA-256:	6238AFCE8A9FE12F5AB32029B1BE96EA86B976369DB920ED3222B6B0E045C964
SHA-512:	E0853670BB9DA2A72869F82CEFA96C1EAC831A16C2CF4A4A0EDA3999A63FD4D5A9509384F3CF5433F5E920C38F8EC4CC7C938A302875BA6DE9CEEB278EFA6C39
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.5.3.7.9.5.9.3.0.9.9.8.0.5.5.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.8.a.a.e.b.7.6.0.-.0.3.a.d.-.4.d.4.0.-.a.7.d.b.-.c.6.3.3.1.1.9.c.0.d.8.2.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.2.a.9.5.3.7.c.b.-.6.9.c.1.-.4.6.3.7.-.b.8.b.5.-.0.e.3.f.8.4.b.b.9.e.7.7.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.y.a.v.a.s.c.r.i.p.t...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.b.e.c.-.0.0.0.1.-.0.0.1.4.-.1.b.8.f.-.e.a.5.f.5.e.3.0.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.8.5.c.1.e.b.a.f.9.5.8.1.3.4.e.6.7.4.a.7.a.7.b.d.1.6.3.6.2.9.2.4.0.0.0.0.f.f.f.f.!.0.0.0.0.6.7.4.b.d.1.0.d.e.f.1.7.2.7.8.7.6.7.0.6.c.9.8.6.1.f.b.1.6.8.5.0.f.d.d.7.a.2.d.0.!.y.a.v.a.s.c.r.i.p.t...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.1.0././.1.7.:.0.7.:.4.5.:.5.3.!.0.!.y.a.v.a.s.c.r.i.p.t...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.9.6.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_yavascript.exe_3d328a8faf94a4241bd0f3187864b2c92a157f9_012b365d_c78d28d7-2adb-4b67-8c0b-397c281cde3f\Report.wer

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9309608565477768
Encrypted:	false
SSDEEP:	192:dsUoefI0JsAnbcA61mjxrZr60zuiFLZ24IO8yu:SUoefjJsAnbcAfjHzuiFLY4IO8T
MD5:	655E6284CB64E65B8A71A65509B4FD01
SHA1:	B6F8BF662F396DEAAF2B720CBFE9BBD11538AE39
SHA-256:	526FAE737F0983DC6F95A9C7A261DCD719EDBED5E58BDD4B35AB204B99FF0B92
SHA-512:	1BFC82F1F001300450A496816D62030EC50FB2A9442C0C11F9D8BA833886A10018F93E8B608D31E49365685FF0083C62EFCB78DF2CEFFCD7C5B61DE0BF3CEE34
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.5.3.7.9.5.8.7.7.6.5.1.5.8.7.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.c.7.8.d.2.8.d.7.-.2.a.d.b.-.4.b.6.7.-.8.c.0.b.-.3.9.7.c.2.8.1.c.d.e.3.f.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.c.c.e.a.1.a.f.e.-.1.1.a.2.-.4.7.d.8.-.a.2.3.7.-.a.0.5.b.a.a.2.9.a.3.1.2.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.y.a.v.a.s.c.r.i.p.t...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.b.e.c.-.0.0.0.1.-.0.0.1.4.-.1.b.8.f.-.e.a.5.f.5.e.3.0.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.8.5.c.1.e.b.a.f.9.5.8.1.3.4.e.6.7.4.a.7.a.7.b.d.1.6.3.6.2.9.2.4.0.0.0.0.f.f.f.f.!.0.0.0.0.6.7.4.b.d.1.0.d.e.f.1.7.2.7.8.7.6.7.0.6.c.9.8.6.1.f.b.1.6.8.5.0.f.d.d.7.a.2.d.0.!.y.a.v.a.s.c.r.i.p.t...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.1.0././.1.7.:.0.7.:.4.5.:.5.3.!.0.!.y.a.v.a.s.c.r.i.p.t...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.9.6.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_yavascript.exe_3d328a8faf94a4241bd0f3187864b2c92a157f9_012b365d_ec3bd3d2-df8b-4c43-af34-0bd3f07cc8b9\Report.wer

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9308113854249886
Encrypted:	false
SSDEEP:	192:ktsUoeWI0JsAnbcA61mjxrZr60zuiFLZ24IO8yu:1UoeWjJsAnbcAfjHzuiFLY4IO8T
MD5:	5C63FAA56C328205DCEC53C3B707DC56
SHA1:	C5C634CC5B6254690B577D723D1C0776C1784C04
SHA-256:	975CBA10C0D10576642E85C4F764D4ABB5BF4FA23B45E4E1FFCC4D60C679C0AC
SHA-512:	B0A278A3261FFF5EAF341832BAE85C93BDC08787248B047BAEAD56DEAFF047CE65A1174C2C439B919E9311121059DD65EC2F450A99799AD2B4C52E5096F23339
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.5.3.7.9.5.9.0.2.7.8.3.6.1.4.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.e.c.3.b.d.3.d.2.-.d.f.8.b.-.4.c.4.3.-.a.f.3.4.-.0.b.d.3.f.0.7.c.c.8.b.9.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.f.b.b.4.6.9.c.3.-.d.2.f.c.-.4.9.4.4.-.a.1.b.a.-.9.2.5.3.d.5.d.a.c.3.3.f.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.y.a.v.a.s.c.r.i.p.t...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.b.e.c.-.0.0.0.1.-.0.0.1.4.-.1.b.8.f.-.e.a.5.f.5.e.3.0.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.8.5.c.1.e.b.a.f.9.5.8.1.3.4.e.6.7.4.a.7.a.7.b.d.1.6.3.6.2.9.2.4.0.0.0.0.f.f.f.f.!.0.0.0.0.6.7.4.b.d.1.0.d.e.f.1.7.2.7.8.7.6.7.0.6.c.9.8.6.1.f.b.1.6.8.5.0.f.d.d.7.a.2.d.0.!.y.a.v.a.s.c.r.i.p.t...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.1.0././.1.7.:.0.7.:.4.5.:.5.3.!.0.!.y.a.v.a.s.c.r.i.p.t...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.9.6.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_yavascript.exe_96681bba23e4b313c649b06b74a0d9f844b06fff_012b365d_21b14de8-9abb-49d0-9025-9a35c86b09c3\Report.wer

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9103114468504307
Encrypted:	false
SSDEEP:	192:7sUoeN4056r31mjxrZr6tzuiFLZ24IO8yu:gUoeNT56rwjGzuiFLY4IO8T
MD5:	D50E8196BD735EAD6125892C69BE23E2
SHA1:	651590A3FC6FB83CA107B8CCEB8676F12E795E29
SHA-256:	D23A5A1A3BF0D7B33980AAEC41A1078D1AE0469803507537F9F6DDD604406F64
SHA-512:	1A6B0905AB97B872E6F51F9134B0A1AB6988580FE5FBD93BDDDCA96F18B2D1EB41A67728B73DB7AD5E4DDC113E7A47C4445E517395EBAD8C72EE3AABB649F64E
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.5.3.7.9.5.8.6.2.2.8.8.6.4.2.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.2.1.b.1.4.d.e.8.-.9.a.b.b.-.4.9.d.0.-.9.0.2.5.-.9.a.3.5.c.8.6.b.0.9.c.3.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.7.f.e.2.c.e.2.c.-.a.6.0.5.-.4.e.8.f.-.b.7.3.5.-.0.c.6.3.c.0.2.9.c.7.6.9.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.y.a.v.a.s.c.r.i.p.t...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.b.e.c.-.0.0.0.1.-.0.0.1.4.-.1.b.8.f.-.e.a.5.f.5.e.3.0.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.8.5.c.1.e.b.a.f.9.5.8.1.3.4.e.6.7.4.a.7.a.7.b.d.1.6.3.6.2.9.2.4.0.0.0.0.f.f.f.f.!.0.0.0.0.6.7.4.b.d.1.0.d.e.f.1.7.2.7.8.7.6.7.0.6.c.9.8.6.1.f.b.1.6.8.5.0.f.d.d.7.a.2.d.0.!.y.a.v.a.s.c.r.i.p.t...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.1.0././.1.7.:.0.7.:.4.5.:.5.3.!.0.!.y.a.v.a.s.c.r.i.p.t...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.9.6.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_yavascript.exe_96681bba23e4b313c649b06b74a0d9f844b06fff_012b365d_32570075-cc06-45b8-941c-6750eb28381d\Report.wer

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9036858696023011
Encrypted:	false
SSDEEP:	192:6sUoeR4056r31mjxrZr6YzuiFLZ24IO8yu:dUoeRT56rwjjzuiFLY4IO8T
MD5:	B2EA820301BEF65328C387B0B6443D0E
SHA1:	144C1BCCD8CE5C98AE13160030562C269CFAD007
SHA-256:	68FFDDF4D5D85982137320D679C944416F472271F3688618816F91400A55FF7D
SHA-512:	1E6DE9533C2C340777263676BDC92ED92F91947449354808378ACD0654032B353D7EC103317CFFE68E0C3E04684BCB40A43A48E2E7D4D5130478CAA996AC9C51
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.5.3.7.9.5.8.5.5.8.1.8.3.0.6.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.3.2.5.7.0.0.7.5.-.c.c.0.6.-.4.5.b.8.-.9.4.1.c.-.6.7.5.0.e.b.2.8.3.8.1.d.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.1.2.3.8.7.b.8.9.-.2.3.e.2.-.4.3.c.f.-.a.7.d.2.-.6.2.5.6.8.8.2.8.9.0.5.0.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.y.a.v.a.s.c.r.i.p.t...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.b.e.c.-.0.0.0.1.-.0.0.1.4.-.1.b.8.f.-.e.a.5.f.5.e.3.0.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.8.5.c.1.e.b.a.f.9.5.8.1.3.4.e.6.7.4.a.7.a.7.b.d.1.6.3.6.2.9.2.4.0.0.0.0.f.f.f.f.!.0.0.0.0.6.7.4.b.d.1.0.d.e.f.1.7.2.7.8.7.6.7.0.6.c.9.8.6.1.f.b.1.6.8.5.0.f.d.d.7.a.2.d.0.!.y.a.v.a.s.c.r.i.p.t...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.1.0././.1.7.:.0.7.:.4.5.:.5.3.!.0.!.y.a.v.a.s.c.r.i.p.t...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.9.6.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_yavascript.exe_96681bba23e4b313c649b06b74a0d9f844b06fff_012b365d_76f4140a-28f9-498a-924f-22d0db79fe34\Report.wer

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	modified
Size (bytes):	65536
Entropy (8bit):	0.931181096219147
Encrypted:	false
SSDEEP:	192:fsUoe04056r31mjxrZr60zuiFLZ24IO8yu:0Uoe0T56rwjHzuiFLY4IO8T
MD5:	9E798CC39A112CB25A7007B8C989E6D9
SHA1:	FDC7B2F6AD6EA4E37BAA16525585EAC11DC23F9C
SHA-256:	70DD8C0F9833A7CF9C9743836BCE38E5AF27DBE2C7B8C212D9C47E3316465BE8
SHA-512:	CC703D3F6BC6E39149E09C328A42E6E7E2C92C083ABED9E666251B428304C756B69D1DC663EB9B2C3D52832F3A1AAA29DF1B3F4095613F3BEE8EE2E7D2252FDC
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.5.3.7.9.5.8.8.7.4.0.7.6.6.7.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.7.6.f.4.1.4.0.a.-.2.8.f.9.-.4.9.8.a.-.9.2.4.f.-.2.2.d.0.d.b.7.9.f.e.3.4.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.4.8.f.1.4.7.5.e.-.0.7.4.e.-.4.3.4.b.-.a.4.3.d.-.f.e.c.f.b.5.2.5.b.d.3.8.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.y.a.v.a.s.c.r.i.p.t...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.b.e.c.-.0.0.0.1.-.0.0.1.4.-.1.b.8.f.-.e.a.5.f.5.e.3.0.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.8.5.c.1.e.b.a.f.9.5.8.1.3.4.e.6.7.4.a.7.a.7.b.d.1.6.3.6.2.9.2.4.0.0.0.0.f.f.f.f.!.0.0.0.0.6.7.4.b.d.1.0.d.e.f.1.7.2.7.8.7.6.7.0.6.c.9.8.6.1.f.b.1.6.8.5.0.f.d.d.7.a.2.d.0.!.y.a.v.a.s.c.r.i.p.t...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.1.0././.1.7.:.0.7.:.4.5.:.5.3.!.0.!.y.a.v.a.s.c.r.i.p.t...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.9.6.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_yavascript.exe_96681bba23e4b313c649b06b74a0d9f844b06fff_012b365d_d89bdf94-e0d2-4bfb-9d3f-80e89d2b7947\Report.wer

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9309815306627104
Encrypted:	false
SSDEEP:	192:lsUoel4056r31mjxrZr60zuiFLZ24IO8yu:qUoelT56rwjHzuiFLY4IO8T
MD5:	9CE807C3715A6A3ED923ADC0250B18A3
SHA1:	EBD2380A9E5D3C89A376F6E8C8838EC233EF384C
SHA-256:	02919C6FF10F3287D08B56D6AE91B45820F83F9DAB288DF0F7F088137720A374
SHA-512:	38250AE93F96A34636B0D9F43567FBCE395EA3F5637B55F12DE758398CADAF646FE36803B2F694BD0D965F5240C23FB6AD0D026EC14D0372766EF7C181E0CE2F
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.5.3.7.9.5.9.3.8.5.1.3.1.9.2.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.d.8.9.b.d.f.9.4.-.e.0.d.2.-.4.b.f.b.-.9.d.3.f.-.8.0.e.8.9.d.2.b.7.9.4.7.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.7.2.e.2.8.8.c.e.-.5.8.7.9.-.4.4.d.3.-.b.5.6.0.-.4.a.b.a.d.c.1.4.c.5.e.5.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.y.a.v.a.s.c.r.i.p.t...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.b.e.c.-.0.0.0.1.-.0.0.1.4.-.1.b.8.f.-.e.a.5.f.5.e.3.0.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.8.5.c.1.e.b.a.f.9.5.8.1.3.4.e.6.7.4.a.7.a.7.b.d.1.6.3.6.2.9.2.4.0.0.0.0.f.f.f.f.!.0.0.0.0.6.7.4.b.d.1.0.d.e.f.1.7.2.7.8.7.6.7.0.6.c.9.8.6.1.f.b.1.6.8.5.0.f.d.d.7.a.2.d.0.!.y.a.v.a.s.c.r.i.p.t...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.1.0././.1.7.:.0.7.:.4.5.:.5.3.!.0.!.y.a.v.a.s.c.r.i.p.t...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.9.6.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_yavascript.exe_96681bba23e4b313c649b06b74a0d9f844b06fff_012b365d_fa9065ac-9d62-412f-a242-3ed788e1990f\Report.wer

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9309313483232492
Encrypted:	false
SSDEEP:	192:FisUoexE4056r31mjxrZr60zuiFLZ24IO8yu:F1UoexET56rwjHzuiFLY4IO8T
MD5:	CE8AFF58CD27B4FD76637775437E790B
SHA1:	278BFFBB8B54FD17097D195382F066D95A3C5B47
SHA-256:	F70FEC5D15A42E38EA97CC46F807BBE9282E8B4A3AC50BFC750BB02DCA4938E6
SHA-512:	A7B91CFC6614544D12EF4F0B651321000C488C2B3711B38472D37920FB390E14CF14FF58D504942BD6814C5F3C7CCE8727976401D55E4AEA427351149D7E885C
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.5.3.7.9.5.9.1.2.9.9.7.1.5.0.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.f.a.9.0.6.5.a.c.-.9.d.6.2.-.4.1.2.f.-.a.2.4.2.-.3.e.d.7.8.8.e.1.9.9.0.f.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.8.b.2.3.1.7.1.3.-.4.a.3.4.-.4.7.3.1.-.b.d.1.1.-.8.f.a.0.1.1.e.f.c.3.8.1.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.y.a.v.a.s.c.r.i.p.t...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.b.e.c.-.0.0.0.1.-.0.0.1.4.-.1.b.8.f.-.e.a.5.f.5.e.3.0.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.8.5.c.1.e.b.a.f.9.5.8.1.3.4.e.6.7.4.a.7.a.7.b.d.1.6.3.6.2.9.2.4.0.0.0.0.f.f.f.f.!.0.0.0.0.6.7.4.b.d.1.0.d.e.f.1.7.2.7.8.7.6.7.0.6.c.9.8.6.1.f.b.1.6.8.5.0.f.d.d.7.a.2.d.0.!.y.a.v.a.s.c.r.i.p.t...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.1.0././.1.7.:.0.7.:.4.5.:.5.3.!.0.!.y.a.v.a.s.c.r.i.p.t...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.9.6.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER100E.tmp.WERInternalMetadata.xml

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8306
Entropy (8bit):	3.6921957530706524
Encrypted:	false
SSDEEP:	192:R6l7wVeJndm6XFi2T6YcDNSU97Za4gmfX+AT2EkpDu89b/RsfTDVm:R6lXJc6Xw2T6YqSU99dgmfdLu/Kf4
MD5:	5973BDF8BF8D6A99C6D9F791CF180652
SHA1:	16AFE3762C55BDD97CFB7553305165A034A7ADC0
SHA-256:	66C200EE1AE801E482BB3854FBA639A3019855D39E1E82C60FA0424621BC8478
SHA-512:	B88B1B67C1690421D8C198E3E0A19B1D8864517A67BBFA67529EC014C53397E61E5565E5F9284BEE09E4FA4D4D25187776415B882827ED9C29F1AD835CE45845
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.3.2.3.6.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER103E.tmp.xml

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4579
Entropy (8bit):	4.432805812360571
Encrypted:	false
SSDEEP:	48:cvIwWl8zspJg77aI9DgWpW8VY8Ym8M4J5w6FH+q8mwkT8l2And:uIjf7I7JZ7VEJacUkT8lpnd
MD5:	AF8A8E5659332FC73391F496795BFDB4
SHA1:	2E0FC6F3AC93DF593ADA574AF1B544737FD279EF
SHA-256:	A95FCA8B0E168C836307FB93519A8E050B24C5B5E734D6FDD1366CDE47069E6C
SHA-512:	D79A8FB7786C3CF0B82B531AD382254402975BE64258A8FA5C2514088403898B88D7681A53A55BB65C3B3982AFB6438141FA507CE23A44788C4F00276C69AEEF
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="576375" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER104C.tmp.WERInternalMetadata.xml

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8396
Entropy (8bit):	3.69705998412204
Encrypted:	false
SSDEEP:	192:R6l7wVeJLm6VUF6YIuT6AxTgmfg5aAjAd2EkpB+89b/fsfKZVm:R6lXJq6VUF6Y96AxTgmfaaAjAV0/Eff
MD5:	DF85F49A19B1E03DA206CC40CAE8B57C
SHA1:	B6381A894E7A8D1EB2E34ED988EFC3340AA4D5AF
SHA-256:	345B057649385FC350D3268726EFE4EE34D5F5E603E55A1272529523777C5F6E
SHA-512:	E171A1FB117AC850FB5A8F51CE356B87A7EC0B8222AFFD9E1C905603BF86B20623A5C7284318CC232E3DD3107BD4083FA079837CDE6A1FFFD13863E375EC1247
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.1.4.8.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER107C.tmp.xml

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4720
Entropy (8bit):	4.461595105627064
Encrypted:	false
SSDEEP:	48:cvIwWl8zspJg77aI9DgWpW8VY3Ym8M4J5REF9+q8vkRz8l2A3d:uIjf7I7JZ7VnJTEKGz8lp3d
MD5:	22CCF8F0306A3D6A9515C56D64807524
SHA1:	DA8C4E16B26D04BDDEFCD6B71D19F213D2B99CE5
SHA-256:	995258E3E7C1150723826C8A1E03D0E583CBF83E058294370421A832D79296DF
SHA-512:	CA3C4563938027D48AF4DBDF0EFE8D129B78E1D969FF2C07724F2281E762C5A2B4817FF8B7C3AD98743B97DB589EDBE68B4992F0C3C72C1FC7FA3E004F1D0AA6
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="576375" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER131A.tmp.dmp

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Wed Nov 6 15:13:11 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	61666
Entropy (8bit):	2.2044952358467778
Encrypted:	false
SSDEEP:	384:yfDie9s3IRmJROw5/UByKZHi4zmbEzoznBoH4n/g9dqRNHG/:yf9s3ImJww5/61C4zmioj9nY90VG/
MD5:	F9A9812FB97200ADC1FFB3708E37477A
SHA1:	B1349CBA906C40596F216BAB22471A7D80121252
SHA-256:	4BFF39CC7B344CA036B346651A4B895F2898C78BC89474B5E056121171E5A01D
SHA-512:	85D54C6777CBA062C2EB70168D684E4F86F73F863E57BB6F61F8E2E20E2E88769E9FDA45EFA372ABE3DCE84DDBA75F7838B0FE3EC6349BCD15E8A9DE402DEB75
Malicious:	false
Preview:	MDMP..a..... .........+g........................l................3..........T.......8...........T...........H...............h...........T...............................................................................eJ..............GenuineIntel............T.............+g.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER13F6.tmp.WERInternalMetadata.xml

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8394
Entropy (8bit):	3.6963679375074054
Encrypted:	false
SSDEEP:	192:R6l7wVeJLV63Uw6YIu96ARgmfgJy2EkpBO89b2fsf8Sm:R6lXJZ63Uw6YD6ARgmfqY02Ef4
MD5:	AFE13A990EAB9015E6F876730D0ADD30
SHA1:	48D217944CD24626E06AE67CA6A92038B7402D9A
SHA-256:	6DAB57D83480088F4DFB3FB7A8CDFE2697D4981154746BD1ACE3E521AC0293A7
SHA-512:	4FF39BB8DAC2DE00FB11DAD7E7E7A63A20E7881D44FFDC20AB6C192E8AB0F0AC24586E4DB7C8C889E9B6B291DD20495D2D35E4E4F637DC25B29EA7FAA67E6CFF
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.1.4.8.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER1435.tmp.xml

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4720
Entropy (8bit):	4.462927085192471
Encrypted:	false
SSDEEP:	48:cvIwWl8zspJg77aI9DgWpW8VYyoYm8M4J5JEFm+q8vkJz8l2A3d:uIjf7I7JZ7VpFJD3K+z8lp3d
MD5:	3B66C5BB6E98A3E7ECEF31DE49B6BC10
SHA1:	AB60357FF202E3584EE3D2625E0EAC38470ED12E
SHA-256:	B92C48139A0A05D23823913F48ECA05727C3DEC4280F23E9F7E571E7D24B5D52
SHA-512:	221F48F184472A001DC2EEF1391A81B28FB43CE39877D418FD61F7D60024AC1E6AE32DB332D67EB7DF95CFD439F131E479802A8FC29A65219A8891C1C775BFF6
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="576375" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER1A2F.tmp.dmp

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Wed Nov 6 15:13:13 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	60328
Entropy (8bit):	2.196304426887188
Encrypted:	false
SSDEEP:	384:niie9s3IR3qw5Z0yK5Hi45O3GTwznBoH4n/g98baoRSXL:n89s3I6w5W9C45Emwj9nY91ooXL
MD5:	70A83626D5C67349D0966619E94071F9
SHA1:	60E84C4F80877468F442BCB146013107AE209A93
SHA-256:	551D5C247E2723B2AC6A9DCDF09A72733125958B099BD50B8AACD6E9BD4F8344
SHA-512:	201EE7B5828F096D551042A76495C228AAE047F274950E48E64EAB8DD702162D85CF4AB5CC923D40CB2005DFF81791D579BFA42325D569F042539191C962E581
Malicious:	false
Preview:	MDMP..a..... .........+g........................l................3..........T.......8...........T...........................h...........T...............................................................................eJ..............GenuineIntel............T.............+g.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER1ACC.tmp.WERInternalMetadata.xml

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6394
Entropy (8bit):	3.7147391473688693
Encrypted:	false
SSDEEP:	192:R6l7wVeJLj564UtYg5aAjAd2EkpBi89bEfsfUsm:R6lXJn564UtYaaAjAVYEEfW
MD5:	9F5DDCB3493900B1172DEE183A28687F
SHA1:	B80AD9A944523001D994FA8F6436A4FB89ADD323
SHA-256:	65E97C8734A538F539EF5854B1DC80B9EA51B467C77FBC583291C3CBF3DEE417
SHA-512:	A2996013FCD353923FA7EE347495A90104149C08EE8C77927967E2B119AB7A159BE0A8D95AF7D0E16CDD0870E9C87C64DC8C82979A1F742EBA644F59FAE7F924
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.1.4.8.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER1AEC.tmp.xml

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4720
Entropy (8bit):	4.463395034016806
Encrypted:	false
SSDEEP:	48:cvIwWl8zspJg77aI9DgWpW8VYlzYm8M4J5REFQO+q8vkRz8l2A3d:uIjf7I7JZ7V0mJTkKGz8lp3d
MD5:	2AA1CE38E5E7DD043CB112E5893BBEEB
SHA1:	25EE15FD78FB14B6E5A8723EF061CD64F4ED26DD
SHA-256:	1E1D5E4A1A81462D0EC246C732268FF665F5CB79FFC128CDEAC0405DC3E3B135
SHA-512:	A62CB0FC2AFAED4AC84A47577192D4D9A2C75A793D3ED1A168967685BADA70D30612D89335800371EC2E35D43D65EBA8053AE7A21DDA41737FF5220D81589654
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="576375" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER1D1D.tmp.dmp

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Wed Nov 6 15:13:14 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	61764
Entropy (8bit):	2.21061596339037
Encrypted:	false
SSDEEP:	384:XOie9s3IRLw5lN8VK+Hi4rAwznBoH4n/g9qykZY3:X49s3ILw5P85C4rAwj9nY9MG3
MD5:	1444F764C097D8F0C936096D0D451020
SHA1:	06C5DD43B065B2434B4D833FC821B944009FCAA1
SHA-256:	4FBFDC7769022D62F5A128A8C66D0AD4E5CF9EBF406AB890E239D0C1C41B13CF
SHA-512:	29B0A922485CF3946C26199DA725E01B1FFFFC1E282DE0FEE93F65742C526B44167E5F687FB50D39F300F14EA045D406663283949958EE3C56C6696EB51911F0
Malicious:	false
Preview:	MDMP..a..... .........+g........................l................3..........T.......8...........T...........p...............h...........T...............................................................................eJ..............GenuineIntel............T.............+g.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER1DF8.tmp.WERInternalMetadata.xml

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6394
Entropy (8bit):	3.7197831312880836
Encrypted:	false
SSDEEP:	192:R6l7wVeJLj6639EYgJy2EkpBO89bbfsfnJm:R6lXJn6639EYqY0bEfk
MD5:	E77C531F5199F3E285736CBB71B6DE08
SHA1:	9945AF29FC1869B0FE785D2838086C983824BA49
SHA-256:	211303106229C6C167B87CE5AB2867E65B75C7DBB989D6C055C850886AA0678C
SHA-512:	5E856DA58A708C22FB9506F74EBFB4723D809DAC735986763593FD0C1447CACBA047BCFE50AAEB05371B27E2762493C923A110EF5C10BCB7A96E00F0DF08AAB3
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.1.4.8.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER1E47.tmp.xml

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4720
Entropy (8bit):	4.463261837767866
Encrypted:	false
SSDEEP:	48:cvIwWl8zspJg77aI9DgWpW8VYDYm8M4J5JEF4+q8vkJz8l2A3d:uIjf7I7JZ7VLJDpK+z8lp3d
MD5:	9FEB08122BCEC8DC0409B371C8F172F4
SHA1:	3CE9C23BCDEFAAECC657924F0D5DAB4F98DF35B7
SHA-256:	E6CB2362EA7BD35993D43E14B2A802F4049A0BAB5562435B5973EA56771EC61F
SHA-512:	323BB6B30A356FE6362D6D60815141A7C9FE95282D3D4D28785ECF3085E5102E8003C14665E87D84F0BBB16D8A40AA621C9C694BFD4DCE316D5C125D680818B8
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="576375" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER233.tmp.WERInternalMetadata.xml

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8396
Entropy (8bit):	3.698465445255821
Encrypted:	false
SSDEEP:	192:R6l7wVeJLq6bpT6YIuDG6AxTgmfgJy2EkpBM89bVbfsfpvjm:R6lXJm6bpT6YtG6AxTgmfqYqVbEfx6
MD5:	2963160752AA0155189246590DD3D51E
SHA1:	97578634FF074D15F20D2C8520C78C9A6CDDF926
SHA-256:	329014850BB2D4736CC000B3391212E8006272135C2F8B6E61E3EF6DCAFF6E9E
SHA-512:	C0DEA23A08F4824152EF2BE516D85CE2DA381B7CCFFC70AB315F1D79558B69AB65EF1021E305B68FB353B5DFACC8DAE75E411FFA4955D4B95748010FE75E6A02
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.1.4.8.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2A1.tmp.xml

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4720
Entropy (8bit):	4.463092744283908
Encrypted:	false
SSDEEP:	48:cvIwWl8zspJg77aI9DgWpW8VY1Ym8M4J5JEFz+q8vkJz8l2A3d:uIjf7I7JZ7VlJDOK+z8lp3d
MD5:	0F790124B2559B57EE734137783043CD
SHA1:	57F8C353B0C8711B8724B8D23C9D303142ECCE57
SHA-256:	E508D54389BE4A2E717392B3FEB608D1C37AF7CF832F1137C433A175D64BCB3F
SHA-512:	B88B23976CD50F31390581913FA0E23A806194C24A93FE62506DB060226E13911508C52425A145C81319C977046D3D880F5E01CE2AFB481052AC865FC999D28D
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="576375" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER55E.tmp.dmp

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Wed Nov 6 15:13:08 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	60132
Entropy (8bit):	2.192935190965598
Encrypted:	false
SSDEEP:	384:N2ie9s3IR02w580yKrHi4uqEvTwznBoH4n/g9QcGobS:NQ9s3IDw57/C4uTbwj9nY9CoW
MD5:	ADB4231747537745EAA874C2A67BCC7C
SHA1:	91D8C042CB7F14B41795C91AF597DE0E6752FEAB
SHA-256:	C4D7252F10E9E1E7B4C693807CCAC6148C92ECD29987FCA28A7D9AC280C7419A
SHA-512:	B82E073D753F2FCB5844F7320AD4B25BABC7728A92B1C4673BE680F5E834CE6D7CC8309F9F1018356C845008B0DAA8C0DF48E3D0AEF8815CDB76652FB91BD5AD
Malicious:	false
Preview:	MDMP..a..... .........+g........................l................3..........T.......8...........T...............d...........h...........T...............................................................................eJ..............GenuineIntel............T.............+g.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER679.tmp.WERInternalMetadata.xml

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8396
Entropy (8bit):	3.6975943828936204
Encrypted:	false
SSDEEP:	192:R6l7wVeJLt6xzGl6YIuS6AxTgmfg5aAjAd2EkpBB89bWfsfjym:R6lXJh6xz86Yc6AxTgmfaaAjAV9WEfX
MD5:	689BB5D47721B5CD1ACE7209221573E5
SHA1:	E699D589F3B26AA2E8580194B8E2EB277255F7CE
SHA-256:	D660A73691F56EC28050DC3767F6CA40F3DC662197B23F2E1E98CD1FA7B9B353
SHA-512:	32D80EF465390131B423F4F7E17EFD3043645288E3F175B320569A1B552FDEFBC5C71D47F38F75EE85770C06FFB79937986224C3E93D1E7DA0CD79D8673C5004
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.1.4.8.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER6B8.tmp.xml

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4720
Entropy (8bit):	4.457994256438433
Encrypted:	false
SSDEEP:	48:cvIwWl8zspJg77aI9DgWpW8VYeYm8M4J5REFZ+q8vkRz8l2A3d:uIjf7I7JZ7V+JTIKGz8lp3d
MD5:	7FA1D2A80AE35518519C86F6794699E0
SHA1:	C8121ACEA6ED143FA6147CDDF44A43A133297F41
SHA-256:	87F52E7F9A56F37117A4C6612240271DFB7BFDE0274456214EEB2613770ACA52
SHA-512:	ACDCCFADB61DE6DD9DB5FCBE6A690EEA0AD5A13BD53FE46887EF7AC4E7B89C9956884E74B7F7A4314DDABB23D0312E7F6A0204FD7319A8D4CD11C7DA67FAA45E
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="576375" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER937.tmp.dmp

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Wed Nov 6 15:13:08 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	61568
Entropy (8bit):	2.202969362307641
Encrypted:	false
SSDEEP:	384:wrnDie9s3IRuw5/RByKjHi4kBmjSCDYewwznBoH4n/g9L0mcNtW:w79s3Iuw5/73C4Ym+ewwj9nY9H+tW
MD5:	FB29E89A557570C1EE0A737578406BF9
SHA1:	B372878BCCED25EF15AEC091D02849BA62F07F1D
SHA-256:	5C037B623F2869726782FF04B492E4E6415D17CDAC0EED8F91F52F79FFC85F10
SHA-512:	FC4D6F19127C4A900E6D0DFB86A713830FC23DE82C6BECCC3F0623E3373AAF729E0794EC743AE64BA5E9312829AE58C44632BC31866EDECF4F0257C92F23B768
Malicious:	false
Preview:	MDMP..a..... .........+g........................l................3..........T.......8...........T........... ...`...........h...........T...............................................................................eJ..............GenuineIntel............T.............+g.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9F3.tmp.WERInternalMetadata.xml

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8396
Entropy (8bit):	3.6975875364052273
Encrypted:	false
SSDEEP:	192:R6l7wVeJLt6bUf6YIu56AxTgmfgJy2EkpBB89bWfsfyym:R6lXJh6bUf6Yn6AxTgmfqY9WEf+
MD5:	80319B07E0C0EE21541FE9B0380211D9
SHA1:	FF52A0621260C5F862DB331552D3B1A6526A736D
SHA-256:	FC9004C3EE47792B4A9EA524976B967DB60B010AE282F9D57223E60AA87C0256
SHA-512:	87D982A7F85D6A911BC0807B1EDE04D8A6074307AD9FE7A5891783F1C5C6BAABC8875AA80C30E0F1C1A960BA7AB35291B65F73D96320133F723616EC7D87F3D3
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.1.4.8.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERA23.tmp.xml

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4720
Entropy (8bit):	4.464591360488211
Encrypted:	false
SSDEEP:	48:cvIwWl8zspJg77aI9DgWpW8VYzYm8M4J5JEFTV+q8vkJz8l2A3d:uIjf7I7JZ7VPJDoVK+z8lp3d
MD5:	6AE2FAB32565B6A2AD1CF101FEF3CD61
SHA1:	23DA2BB3A1011EC68F5BF21F9E93A82D01B458E5
SHA-256:	53ACB4464CAF5D2B31FE0ED083FB1454A8F13484F4F60E2636873F655BFB819F
SHA-512:	72864F2377C5AF0478D721A01D2339CCCA6A72431262CC2EB06372C3CF4EA1947B099A864243DB626C5DD0811D805CA5CAC0EC6F32830185AC17252A5BF74331
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="576375" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE1D9.tmp.dmp

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Wed Nov 6 15:12:58 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	60054
Entropy (8bit):	2.3306840909833326
Encrypted:	false
SSDEEP:	384:y5sI9P2YPjowfnbB6ZXKCKV93rI1A4WwlHs2nzygDE0GS:W9P2OjowfnIKjIZWqHBugTG
MD5:	E83804AC1D34C42CEFF493F9D23AECBB
SHA1:	13F4EA1CB65BA9DA497353D01918CF5F8B7477D1
SHA-256:	E5E6DF15D2CB5DBD3339EAC0B1804B779CE0727EF30A9642C08CC055552BA4C8
SHA-512:	AF016BC192F630A51D426C453F147F1B4913E5A50B3900D8182DB384466B1DEA23DACD81831A0DF6A544BF54EE8DBBE3957645492D43D0823132EB6B5B7C8030
Malicious:	false
Preview:	MDMP..a..... .......z.+g....................................t....2..........T.......8...........T...........H'..N...........\|...........h...............................................................................eJ..............GenuineIntel............T...........x.+g.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE2A5.tmp.WERInternalMetadata.xml

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8414
Entropy (8bit):	3.703035370365209
Encrypted:	false
SSDEEP:	192:R6l7wVeJw2E6QJz6YcDDSUJZhgmf6Jy2EkpBn89bSTsf6Gm:R6lXJK6S6YUSUnhgmfQYTS4fy
MD5:	AC2B85C791EBCCC4925EA162ABB4F343
SHA1:	6DCEFCFE22119E32DEB3946F737E172FAE47D6C0
SHA-256:	7FE67124EDA74205DA2A02D909D402E456A59FD0B52BC7BDD60EF0A34BA3C89C
SHA-512:	117394EFC1331E87285711FE4D1E02F52FBFADCD2CF67286A47B408D3FFDFC8A003BC7E2365C9FC8F13540682DB800FD97021D1ADCB568B65C906CD623EB9D75
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.2.8.0.4.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE2C5.tmp.xml

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4720
Entropy (8bit):	4.503787230163799
Encrypted:	false
SSDEEP:	48:cvIwWl8zspJg77aI9DgWpW8VY0Ym8M4JtJEFJT2+q8vKJiZ/2Chdd:uIjf7I7JZ7V8Jno2KEiprhdd
MD5:	F8D650D8AE547DDA724AF33FBC451AB9
SHA1:	ACFD76EBF2316B28E277CC7BF5320E59A1AF6CFD
SHA-256:	C4C3FC54CE68F1E22689FE8B5CAA1FD8F8DFB39BEB9E79C6A39F679C6BE1E67C
SHA-512:	2C3E8166F70736A339E0BC0D3881AC1E6A79A0451A173607B5B80FCB093292593592904A7ED93D80EFEBCEF08BBA395B7BBCC5AB1A565A63FBD1305E2C0A99AD
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="576375" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE498.tmp.dmp

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Wed Nov 6 15:12:59 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	87902
Entropy (8bit):	2.3613202023561266
Encrypted:	false
SSDEEP:	768:zI49s72jtkwfNxVen0SbKfcIZWSja+ACG:Ky3xAnlKUDSja+AH
MD5:	3ED9D89811C37E47DB3664EA8B0B67C2
SHA1:	5D86E41F36376E6D1E756404AC0647FF7C2A8818
SHA-256:	797ECAF7584C0E527AEBDC7ADE776DE1A0C76FEFBB039C37C0475D78BC097C90
SHA-512:	70B54EEA1732C15B1D8CA74DF71DB624E85E6EA2C58825AD53500FDDD482E8383B082767A0E8CA49F6069575ED756F675A5D3F0E5194C1BDBBC0DCFC996C6257
Malicious:	false
Preview:	MDMP..a..... .......{.+g............T...............\.......d....<..........T.......8...........T............,...*......................................................................................................eJ......h ......GenuineIntel............T...........x.+g.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE535.tmp.WERInternalMetadata.xml

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8412
Entropy (8bit):	3.7017134272597323
Encrypted:	false
SSDEEP:	192:R6l7wVeJw2464PK6YcDmLSUJZngmf6Jy2EkpB989bbTsfBJm:R6lXJG6wK6Y7SUnngmfQYJb4fe
MD5:	150F5A11974D898BC4593A4637856307
SHA1:	9C06792DC90B13BAEE0722FA92779A80A63E2AD7
SHA-256:	A51C9689E8368F520673CBA74B358C12B4EC784AC08D903D3D0CC91893EF375E
SHA-512:	B98D33AC1E3D126EB61428EACD75FD132B3835209ED347D653FB1829D39AFDBD3881CE16303664D6C264C5099D6E0913639DEEAB95913CB3E3AEFC71BB4E237E
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.2.8.0.4.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE555.tmp.xml

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4720
Entropy (8bit):	4.504186593217749
Encrypted:	false
SSDEEP:	48:cvIwWl8zspJg77aI9DgWpW8VYsYm8M4JtJEF0+q8vKJiZ/2Chdd:uIjf7I7JZ7V8JnRKEiprhdd
MD5:	F7BDC3A9DA361E59BA706D91A979B6B8
SHA1:	BD3711DD3A2CE9D9039A94E5BE105CE9CD70584B
SHA-256:	C54AD31A31967C986A07468C40737CA12D6547BB28316D9AB1738DD6059620A6
SHA-512:	289A031122A2956B05C3BD5A9F90144F2F511E66AF915AF715D13C964B7C6DA1F3A01E665D3BA50496A0653A4E19D8F827F7180A9005B28FF4C884AD721287C5
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="576375" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE738.tmp.dmp

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Wed Nov 6 15:13:00 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	86206
Entropy (8bit):	2.3410330195892475
Encrypted:	false
SSDEEP:	384:vkP4L9s7N+wfFa8BBSn+EDZ/LMiS5qKEcI1A4WwdjSdgY6EpIdLkt9VvRh:wQ9s7N+wfFj3S+KfcIZWSjcAdLkf5
MD5:	2B1F24ED8E7B457354408E1037D37145
SHA1:	905CC484C8AB2C3F1AE62CCD36501A41AADA4B10
SHA-256:	A9726AC3D66134C47DE7ACF91AD007E5649317864FD7CA03FB6D2EBE7A2FCB10
SHA-512:	98EDEA03C2F01B84ECBB76B46976150D7493DF80ED5E0EA6981C5E248E199B45551B97EC4F5EB3B5290216EB4734BB0AFACBCB7654BCEF550C9484C1BFB63F3D
Malicious:	false
Preview:	MDMP..a..... .......\|.+g............T...............\.......T....<..........T.......8...........T...........H,..v$......................................................................................................eJ......h ......GenuineIntel............T...........x.+g.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE813.tmp.WERInternalMetadata.xml

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8412
Entropy (8bit):	3.703037659408988
Encrypted:	false
SSDEEP:	192:R6l7wVeJw2v6K6YcDaSU/ZYQGgmf6Jy2EkpB089bOTsf4am:R6lXJh6K6YdSUxGgmfQYSO4f0
MD5:	BCF2BF3721FEC2DE80330B518553201D
SHA1:	56F9AFE7C7588511C6C7FC332228C9AAC9FBC9B9
SHA-256:	3A10FC0F874F6B36B2792FB6D308AE933B82E5643121CE5F957FEAB58587A8F3
SHA-512:	9D0DB14350533CA388AD69BDC750EFB3D596F8D3F44B8AE1BEC00FE8CE07B898AA287D23F1C51DF9CCB662CFCA95728130D3A4CA172B87A55F51C22A2E9A4EA2
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.2.8.0.4.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE834.tmp.xml

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4720
Entropy (8bit):	4.505667299511067
Encrypted:	false
SSDEEP:	48:cvIwWl8zspJg77aI9DgWpW8VYLYm8M4JtJEFrk+q8vKJiZ/2Chdd:uIjf7I7JZ7VTJnskKEiprhdd
MD5:	AA6CD399494BF45AE0EA7042196CA2D3
SHA1:	E44506422FFE06D20C4F121C363DD9DF9B0CA6B1
SHA-256:	50B462F8FACF0FFE12BC07E98AFBA143B725752E62327D6C0764F8201E8F9BF8
SHA-512:	6D1E2624B53AE40AEADA2EA56BF76B786974937E5681F2AFAD98F41C6E114E2A651CD28CC4F87AC292BFC522E6AC39B409E1EB121758537F5BA40A15DCA6AE3A
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="576375" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WEREC77.tmp.dmp

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Wed Nov 6 15:13:01 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	86058
Entropy (8bit):	2.3590648812391026
Encrypted:	false
SSDEEP:	384:LmgZL9s7mfwfRkZXI8+TnJyBfwiS5qKEcI1A4Wwdjr3DSAVzz0quB6:x9s7mfwfRY6JyBdfcIZWSjpuqu
MD5:	5FAE835A3E924E9C341ECFA2627CAD0C
SHA1:	B28E6517F8309EAB6ADA026D9A254848C9BD2415
SHA-256:	C31E00B4E2D5AD26BFC575026C3B73D4294F1A72B027EE9DDC30CA34CAE5B02E
SHA-512:	3A479C3F8C9B4F980F2814154FCDD5F5216CECB64BE1D153EAE19360AFEA24DE2AA285086A8C80B3903D24FC50ABDD85D879E987668CD3AA10751BE9820C4E1D
Malicious:	false
Preview:	MDMP..a..... .......}.+g............T...............\.......4....<..........T.......8...........T............,..j#......................................................................................................eJ......h ......GenuineIntel............T...........x.+g.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERED34.tmp.WERInternalMetadata.xml

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8412
Entropy (8bit):	3.7040717315174403
Encrypted:	false
SSDEEP:	192:R6l7wVeJw2i6f6YcDuSUiZYQGgmf6Jy2EkpBL89bXTsfddm:R6lXJc6f6YZSUiGgmfQYfX4fW
MD5:	14460079205F7B9B6AD4D6C751EB97F2
SHA1:	9065CB15186387EF7417B27ED974CAC471592B07
SHA-256:	18AA54A0038C637FC01B474507F21BE467C0BD881B1200D1F31F06A0CCFE0BC3
SHA-512:	082F307FB2B288FEF13AB6A6704F0BDDF5A8335CB5258F3EE44E2EE2D6C5376B4EC6C9685E831702188B40BC985A67492A9457E96CF1D6F418712F187CFE276C
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.2.8.0.4.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERED64.tmp.xml

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4720
Entropy (8bit):	4.502704211479454
Encrypted:	false
SSDEEP:	48:cvIwWl8zspJg77aI9DgWpW8VYcPYm8M4JtJEFbO+q8vKJiZ/2Chdd:uIjf7I7JZ7VlSJnHKEiprhdd
MD5:	C42C8C52EAA5FAE86820D7234EE05E56
SHA1:	0D7F77899E4DE2AE687953CA180A097DB3D91319
SHA-256:	E0B42573AA8D7987833FFCB2296FCDFE33D1FF1B6F1B2DF4404A2F398DDDFF85
SHA-512:	62125CF8C0EC26C46918846BFAAA6FB07C5B9E400B3EC0DC66697476D9FDAF20F9C0CE18382142F74241E2FC1329D2E0EFFCD1017C35CA65A124264137DCBCDA
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="576375" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WEREF17.tmp.dmp

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Wed Nov 6 15:13:02 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	93048
Entropy (8bit):	2.1134411401304787
Encrypted:	false
SSDEEP:	384:Q8BFNfTL9CPqAwf4PsiqcZHMr8BNAyBpyoHSbI1A4Wwdj7szLkvj3Kk:NH19CPpwf4kiqRobAyBp9SbIZWSjsKD
MD5:	4A4663E791A010DEF48457CF3AE7AD00
SHA1:	77EFE661FFCBB565029257CFC9F920BB3F42DA41
SHA-256:	9FD72E3B686B3BFF08AB93C1C98D09CD2224672C642E3DBCC290CCCE0E816ED1
SHA-512:	6316D09A9E6208AB57C0F98D5C4EE205A90262F7654A5BE35F4572DB4CBE19A7FFBCF96E76E4CF9FAA69339AFAA87DEE04AEBF64AD5E6F053C5C068203CC4510
Malicious:	false
Preview:	MDMP..a..... .......~.+g.........................................B..........T.......8...........T............-...=..........D...........0 ..............................................................................eJ....... ......GenuineIntel............T...........x.+g.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WEREFB5.tmp.WERInternalMetadata.xml

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8414
Entropy (8bit):	3.7039353174441323
Encrypted:	false
SSDEEP:	192:R6l7wVeJw286l6YcD8SU9PZrfjgmf6Jy2EkpBP89bcTsfA0m:R6lXJi6l6YbSU9h3gmfQYTc4fC
MD5:	4A133A44E5F5CEF47A33B4EB141CD55F
SHA1:	40ADE3760E79C4E30EBAB590D0C5E9A38A8E4922
SHA-256:	F99F9F0336FA7266B860A9496F2C1F2DC824E7EF659FB06348A1F9A6AB49D60C
SHA-512:	D37581A1185E88518E2AE43D641894412D1EE06CEC4B686290989DFF5873AB1B7B14F15F42EB43DFC45C852901C12D920451C84D9178E21CE42F6CB8F9B33AD5
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.2.8.0.4.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERF013.tmp.xml

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4720
Entropy (8bit):	4.503581059462427
Encrypted:	false
SSDEEP:	48:cvIwWl8zspJg77aI9DgWpW8VYnYm8M4JtJEFc+q8vKJiZ/2Chdd:uIjf7I7JZ7VDJnhKEiprhdd
MD5:	79E8AC04E89FBA97C0C224E2C4D1606E
SHA1:	ECC5444F2F81BAEC103F4403B3ECFEDC0FDB04A0
SHA-256:	CA709BC220E623112ACA80E0E344E52E6D68E2FBF9CE3AE9BAF2C9BDE4746CEE
SHA-512:	F05D77060AC0D5C9BF14C01C1762D9BF2C7301FF68F9CB930B4443365BE60A3B85F168BD35D75DA5F8BD8A36F4CE8B005C15B22AF0937CBED965D0537B852C42
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="576375" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERF1B7.tmp.dmp

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Wed Nov 6 15:13:02 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	92624
Entropy (8bit):	2.127066583259926
Encrypted:	false
SSDEEP:	768:ov9CPawwfPt2ZQ/AyB+v9SKIZWSj6JnfqSr7lm:oECcOoyBaSKDSjOnfqSQ
MD5:	272E7F5447B62C55E6517F8B1447E4DE
SHA1:	1114E32CA71788E7A240230EC0AAB53EA240041C
SHA-256:	2A2139ECFBBACDEF852133FFCA7FE2CF7B6827CCAC6364B03A9F18B39F897860
SHA-512:	5ECEC747E6910F2597E376DF26D3F902507BDA367D3D88487A7AC79BF068CBE8F19218257E960D2AF7E0979097B17CE66B5F6B7CB5A014FE951B18D6D1DBDFE1
Malicious:	false
Preview:	MDMP..a..... .......~.+g.........................................B..........T.......8...........T............-.. <..........D...........0 ..............................................................................eJ....... ......GenuineIntel............T...........x.+g.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERF235.tmp.WERInternalMetadata.xml

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8414
Entropy (8bit):	3.7023090298637418
Encrypted:	false
SSDEEP:	192:R6l7wVeJw2j6bn6YcDGSU9PZrfjgmf6Jy2EkpBa89bcTsfD0m:R6lXJt6r6YRSU9h3gmfQYgc4fF
MD5:	C600AE484C94EB2AFB063E2151479895
SHA1:	CAA1F30495444BCE0E0F2433147FA33469C3041E
SHA-256:	F363C506A3FB74BA3EC2F85E994ADF63AAC378B797704AAFCD4520D9C518C413
SHA-512:	1985AADFF1100A1D2DFD949F8284B23CE897169FB911EE07ACA100C27E7725030C48C3A3FFF4072347463AF01059BC2135737491069D98AC535AD6093BC11AEC
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.2.8.0.4.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERF255.tmp.xml

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4720
Entropy (8bit):	4.503511447514104
Encrypted:	false
SSDEEP:	48:cvIwWl8zspJg77aI9DgWpW8VY95Ym8M4JtJEFfRs+q8vKJiZ/2Chdd:uIjf7I7JZ7VaoJn+RsKEiprhdd
MD5:	5D3260CD4A2E478F52D04709E1C21874
SHA1:	CC401321582848D8ADC1E91FB82D0DFA44588A6C
SHA-256:	D98AFF0D0F7713B251171EBAFAD29E648961CFD7BA6314E198231F8DC519195F
SHA-512:	B7F3870189766DF1FDAFF5A8B9026EEDB495403D74F11A0A2233159717ADCFFBDC5D3E832296E2EA825298020905C580900776B5A3FC8339AD535D6440330375
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="576375" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERF32.tmp.dmp

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Wed Nov 6 15:13:10 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	60230
Entropy (8bit):	2.195060786247451
Encrypted:	false
SSDEEP:	384:hL6ie9s3IRzQ2w5r0yKNHi4Q362wTwznBoH4n/g9jT+EHo2SKH:hI9s3I9w54BC4glAwj9nY9long
MD5:	CA4AF4939CB8B6CEEAD999B4F9DD0AFC
SHA1:	3633750A7DBAA7D9DD8DCCE5F0BE388D8FE4C962
SHA-256:	7E95DAB70A007134C7043A7630B8568EF6F7270F7C1EBA23C4E4D8A0143F47C0
SHA-512:	CC73467912CF0E7450FF40E9D98F768514AEEE40B7A963EEEF6C74AC42EC6820C2966C8FCD873826802B37B8F1377C8E6C550F04613CDC9AB7B66803658E38FA
Malicious:	false
Preview:	MDMP..a..... .........+g........................l................3..........T.......8...........T...........................h...........T...............................................................................eJ..............GenuineIntel............T.............+g.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERF42.tmp.dmp

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Wed Nov 6 15:13:10 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	28486
Entropy (8bit):	2.599413544891398
Encrypted:	false
SSDEEP:	192:Dg8h3bXsCMXuG9ccHOj6Hmb5jT6H3k4wdI3HIjRF2Lb1/X33L43i:ruCvG93ucW5jmx7SRFm/XH0y
MD5:	6619B418F902DFFD5E506DA7AF26FA0C
SHA1:	048309A335BBB9D1E527550052A9F0638D1CDB30
SHA-256:	49DA76E899E34A96BE3A3853744BB89FE5720FD152463A19EDE850BC1960B6A4
SHA-512:	EF5DACB0BA1DBC5164D07B80213CEA1D161DF95AB9B778B29EA656926C58E1585EBFB05ED13517249D87C5F232CBB70890E3FC64D4E088F57D905DDF0C35D2EC
Malicious:	false
Preview:	MDMP..a..... .........+g............4...............<............$..........T.......8...........T...........0....X.......... ...........................................................................................eJ..............GenuineIntel............T.............+g............................. ..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERF8FB.tmp.dmp

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Wed Nov 6 15:13:04 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	42562
Entropy (8bit):	2.664849985638633
Encrypted:	false
SSDEEP:	192:BUepnX1RXt9KymXwM8O3Xwfourat04P7xHIj1jD8bllULuLml/bUUqX7NiDfTrdj:eIH9KyX2wfOt04jA1jBCATXmBcj
MD5:	3B0FBEB54B4A024BA7B6A8C6E4448B4A
SHA1:	758F77BAEA6381554C2736132F5EE083D38665BC
SHA-256:	CD3B32380D3AEE40AD1EDE9EF0C6A2D53F1E8ED19EF5D90142A6E621667287CF
SHA-512:	599DC0CA5A9F884334A61364EDD44B24F67E91A3FB3A0BF1CE06D0389918126FE617B0FA2D309FCD5456403270D24D68F90FF34116F6E1C93789B048A707CC3F
Malicious:	false
Preview:	MDMP..a..... .........+g............4...............<...........X0..........T.......8...........T...........P3...r........... ..........."..............................................................................eJ.......#......GenuineIntel............T...........x.+g.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERFA05.tmp.WERInternalMetadata.xml

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8316
Entropy (8bit):	3.7007794627347863
Encrypted:	false
SSDEEP:	192:R6l7wVeJw226Ip76YcDCSU9f2ZMgmfZ8Aa42EkpDg89bqTsfMIOm:R6lXJo6Ip76YlSU9+Mgmfta2cq4fp
MD5:	9EB562E779C251F5310577A68393B2FE
SHA1:	0FAD4929C0C61890163B0F3D1294B6A06910804B
SHA-256:	715D5A50DD55BFFAC853CA07C396E97944977EAA4EC79914609A44266776C389
SHA-512:	67A0D44D17C85F9702E4FCF2DE9DC28DF805C0D96E94D1CA157047A276D0702BC2D6D0FBA871DD74DD4C3BBABBE814D61C5D470F8D3376850130D7981B255A9B
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.2.8.0.4.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERFA25.tmp.xml

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4579
Entropy (8bit):	4.4924092809453935
Encrypted:	false
SSDEEP:	48:cvIwWl8zspJg77aI9DgWpW8VYkYm8M4Jtm6F/+q8SwIZ/2Chdd:uIjf7I7JZ7VAJY0kIprhdd
MD5:	42CA60120BF208C2143479E3B406A7F5
SHA1:	E0E6584DE10872806BBEBBBEF7FF42F8AB70C38B
SHA-256:	CDA7189F41C2832F24BF4C8E4093E9938AA54E593E4206043C312B672103CD74
SHA-512:	32F1B9F5624C79196BA6EE0DE5D6E5FBD3F8EC2101AB7218D9A2D7C271561DD5FADAA90F155694BECF27571CD31E0AA8962EBBC8AB4B1404CDCCBD735C25E267
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="576375" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERFCC3.tmp.dmp

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Wed Nov 6 15:13:05 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	56314
Entropy (8bit):	2.231616326512505
Encrypted:	false
SSDEEP:	384:qr8+ar9PNTevw5W7XXuuWkvHiosvM7znB34n/g94ryru:qr8L9levw5WjXuu3CvvM7jinY9Pu
MD5:	2A01D4CE3A5710A5A4ADDA87CFC3559A
SHA1:	153818367D9989EE4BE97038AEF8A40022044997
SHA-256:	F1B06867CC924A376EB9926A4DA1C401AF8F8CAA7A406BA987BD5B9F9E263E65
SHA-512:	3DAB9F5087061BA0FD8E66CDE5A2031C99A01486027E3859BD29E94CC83615F14C9498D52B6F191B1C2C0300CE0882F4F6320D645F624F5255122054FABE9C0D
Malicious:	false
Preview:	MDMP..a..... .........+g....................................t...............T.......8...........T...........@...........................t...............................................................................eJ..............GenuineIntel............T.............+g.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERFD41.tmp.WERInternalMetadata.xml

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8394
Entropy (8bit):	3.698700481081869
Encrypted:	false
SSDEEP:	192:R6l7wVeJLh6WmYre6YIui6AxTgmfgJy2EkpBy89bzfsf3Rm:R6lXJd6Wm16Y86AxTgmfqY4zEf8
MD5:	5D3D3E7D332D6562B1DE779C57F26EF0
SHA1:	242657F261317A809C668A34B58D349F90D15AD1
SHA-256:	3619A4A09B56D005550A996A65B08527823A458C9FAA9A102CBD61ED5E5D2B5F
SHA-512:	6433AC928FC12B0D7D124640B6906AF018DD83B3AA40754299A3A9FD778021038ABCB5D7331DBA93A52878BBF6A37815578D51CA6C2C3591B1B37D95E7164BB0
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.1.4.8.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERFD90.tmp.xml

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4720
Entropy (8bit):	4.464980584140717
Encrypted:	false
SSDEEP:	48:cvIwWl8zspJg77aI9DgWpW8VYjYm8M4J5JEF1e+q8vkJz8l2A3d:uIjf7I7JZ7VPJD5K+z8lp3d
MD5:	3C8942D00D5577B6A616831437C3F1C0
SHA1:	B71B668AA6EE99FB8FE6F7C5B12C5916D50EC251
SHA-256:	46147681ADFB5A7960F88B2451AA3DC9C46CAEA36DF0DCD707110141A8B4BB90
SHA-512:	4751EECE2F87CB616C2FF34B3805B17BD8E794B7E5DF9E9266602AD586B4A676B3CBC72262AD34E03DE63B48A194A3D14DA5996B3357303E4F2A178BD270B6A3
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="576375" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERFF54.tmp.dmp

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Wed Nov 6 15:13:06 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	62322
Entropy (8bit):	2.235313560880451
Encrypted:	false
SSDEEP:	384:a3X2Zb79XkPctw5c2xuKZHi4ommaowonBoH4n/g9by7DXROs:cX2l96ctw5JxhC4omiw29nY9yDhOs
MD5:	8F173BCA67E78421409EEBB88923B65B
SHA1:	99ADA5CA142813D69319535AC5577797D9163A83
SHA-256:	3F8060B994106E9955165DB960FCC1257C75B5A07BCFD18408B211C0404A5B2E
SHA-512:	E0D3B24E9155275A4B412D5455A7E5475B337B46EB5404DB013FF7285BEBE267BEC7B13226C290E5B8AFCDAA613ED41D37C8D6C61CE26CF928FEC05D24F5FAB9
Malicious:	false
Preview:	MDMP..a..... .........+g........................(...............62..........T.......8...........T...........0...B...........$...........................................................................................eJ..............GenuineIntel............T.............+g.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\yavascript.exe

Process:	C:\Users\user\Desktop\YESOHDKMIm.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	507904
Entropy (8bit):	6.886236272449968
Encrypted:	false
SSDEEP:	12288:ArfDxZYCAZETh2FbGxS/nLTekXzLZCU0k:AvvQi1YnLTznr0k
MD5:	F9294A439C591BBA283F7C6D9ED5AA37
SHA1:	674BD10DEF1727876706C9861FB16850FDD7A2D0
SHA-256:	DF25FA5D95355DB39284DA9C5E28BC040305FB125683A470B92C7A4CC225645C
SHA-512:	D6625B8C3A67AEAC1265241C2388B9C25DD6DD5FE93C0F78C115DD24CAE4189E1232254063B3DB17409757CFBD3765F8F5AFBDA236B41721B8088B52DAD2E1CC
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 61%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........\..A\..A\..AB.tAG..AB.eAB..AB.sA8..A{..A[..A\..A(..AB.zA]..AB.dA]..AB.aA]..ARich\..A........................PE..L.....e.............................^............@..........................0.......W..........................................P.......HI..................................................@H.......G..@............................................text...j........................... ..`.data............\..................@....rsrc...HI.......J...`..............@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\yavascript.exe:Zone.Identifier

Process:	C:\Users\user\Desktop\YESOHDKMIm.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Windows\appcompat\Programs\Amcache.hve

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.396543594388198
Encrypted:	false
SSDEEP:	6144:El4fiJoH0ncNXiUjt10qWG/gaocYGBoaUMMhA2NX4WABlBuNb4OBSqa:84vFWMYQUMM6VFYl4U
MD5:	82F1DE495F0F95D0C91B4D3353E20B5D
SHA1:	D9E364750F7C806DB5A50212EA2924FE405FAE1B
SHA-256:	CA30351A07CDB2D0BFCD2E85A55AC757F468A315E910122E69C3C507379F624C
SHA-512:	402978E92F67D2E774985799D5A967CCE701A0DEEF10C0FB2599441EB38B4958A3297AEC3781DCBE6F6BA2B655A0B1CA8B26A8A12668B75F35364D262E40FCC7
Malicious:	false
Preview:	regfO...O....\.Z.................... ....`......\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm.2/]^0................................................................................................................................................................................................................................................................................................................................................8i........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.886236272449968
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	YESOHDKMIm.exe
File size:	507'904 bytes
MD5:	f9294a439c591bba283f7c6d9ed5aa37
SHA1:	674bd10def1727876706c9861fb16850fdd7a2d0
SHA256:	df25fa5d95355db39284da9c5e28bc040305fb125683a470b92c7a4cc225645c
SHA512:	d6625b8c3a67aeac1265241c2388b9c25dd6dd5fe93c0f78c115dd24cae4189e1232254063b3db17409757cfbd3765f8f5afbda236b41721b8088b52dad2e1cc
SSDEEP:	12288:ArfDxZYCAZETh2FbGxS/nLTekXzLZCU0k:AvvQi1YnLTznr0k
TLSH:	DDB4F0C1B492E4B0E9904271EC399BF6177BBC7A9938598B33143F5F3D722D25A76202
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........\..A\..A\..AB.tAG..AB.eAB..AB.sA8..A{..A[..A\..A(..AB.zA]..AB.dA]..AB.aA]..ARich\..A........................PE..L......e...

File Icon


Icon Hash:	8169693147014541

Static PE Info

General

Entrypoint:	0x405edb
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x6594D5EB [Wed Jan 3 03:35:07 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	eaddeabe4dc2146d8bbc6de524b45db8

Entrypoint Preview

Instruction
call 00007FE7F0D71066h
jmp 00007FE7F0D6CDCEh
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
call 00007FE7F0D6CF8Ch
xchg cl, ch
jmp 00007FE7F0D6CF74h
call 00007FE7F0D6CF83h
fxch st(0), st(1)
jmp 00007FE7F0D6CF6Bh
fabs
fld1
mov ch, cl
xor cl, cl
jmp 00007FE7F0D6CF61h
mov byte ptr [ebp-00000090h], FFFFFFFEh
fabs
fxch st(0), st(1)
fabs
fxch st(0), st(1)
fpatan
or cl, cl
je 00007FE7F0D6CF56h
fldpi
fsubrp st(1), st(0)
or ch, ch
je 00007FE7F0D6CF54h
fchs
ret
fabs
fld st(0), st(0)
fld st(0), st(0)
fld1
fsubrp st(1), st(0)
fxch st(0), st(1)
fld1
faddp st(1), st(0)
fmulp st(1), st(0)
ftst
wait
fstsw word ptr [ebp-000000A0h]
wait
test byte ptr [ebp-0000009Fh], 00000001h
jne 00007FE7F0D6CF57h
xor ch, ch
fsqrt
ret
pop eax
jmp 00007FE7F0D6D58Fh
fstp st(0)
fld tbyte ptr [0046108Ah]
ret
fstp st(0)
or cl, cl
je 00007FE7F0D6CF5Dh
fstp st(0)
fldpi
or ch, ch
je 00007FE7F0D6CF54h
fchs
ret
fstp st(0)
fldz
or ch, ch
je 00007FE7F0D6CF49h
fchs
ret
fstp st(0)
jmp 00007FE7F0D6D565h
fstp st(0)
mov cl, ch
jmp 00007FE7F0D6CF52h
call 00007FE7F0D6CF1Eh
jmp 00007FE7F0D6D570h
int3
int3
int3
int3
int3
int3
int3
int3
push ebp
mov ebp, esp

Rich Headers

Programming Language:

[C++] VS2008 build 21022
[ASM] VS2008 build 21022
[ C ] VS2008 build 21022
[IMP] VS2005 build 50727
[RES] VS2008 build 21022
[LNK] VS2008 build 21022

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x60584	0x50	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x7c000	0x14948	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x91000	0x9f8	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x4840	0x18	.text
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x47f8	0x40	.text
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x1000	0x184	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x5fe6a	0x60000	291cab4978400488bebc300fa8565524	False	0.8006006876627604	data	7.3224419372179845	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x61000	0x1a200	0x5c00	095dbe5193fc74b6800b1bf6dabe322f	False	0.07990828804347826	dBase III DBT, next free block index 7565155	0.9319388570498974	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x7c000	0x14948	0x14a00	790d91c93bb5c0116d27ac0704c580b8	False	0.4412878787878788	data	5.462858968650598	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x91000	0x1502	0x1600	2c6bf02e7766e8d52bcdbd4bcfbb4ecb	False	0.39595170454545453	data	3.874096352062735	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
LIGENAZIMAFIFAPOGEDUCEDOD	0x86be8	0x136f	ASCII text, with very long lines (4975), with no line terminators	Tamil	India	0.5953768844221106
LIGENAZIMAFIFAPOGEDUCEDOD	0x86be8	0x136f	ASCII text, with very long lines (4975), with no line terminators	Tamil	Sri Lanka	0.5953768844221106
POJOKOLOSIVOF	0x87f58	0x1e31	ASCII text, with very long lines (7729), with no line terminators	Tamil	India	0.5835166256954328
POJOKOLOSIVOF	0x87f58	0x1e31	ASCII text, with very long lines (7729), with no line terminators	Tamil	Sri Lanka	0.5835166256954328
RAJENEWOWEZASUSARIJEJUWA	0x86200	0x9e7	ASCII text, with very long lines (2535), with no line terminators	Tamil	India	0.6055226824457594
RAJENEWOWEZASUSARIJEJUWA	0x86200	0x9e7	ASCII text, with very long lines (2535), with no line terminators	Tamil	Sri Lanka	0.6055226824457594
RT_CURSOR	0x89de8	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0			0.2953091684434968
RT_CURSOR	0x8ac90	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0			0.46705776173285196
RT_CURSOR	0x8b538	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0			0.5361271676300579
RT_CURSOR	0x8bad0	0x130	Device independent bitmap graphic, 32 x 64 x 1, image size 0			0.4375
RT_CURSOR	0x8bc00	0xb0	Device independent bitmap graphic, 16 x 32 x 1, image size 0			0.44886363636363635
RT_CURSOR	0x8bcd8	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0			0.27238805970149255
RT_CURSOR	0x8cb80	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0			0.375
RT_CURSOR	0x8d428	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0			0.5057803468208093
RT_CURSOR	0x8d9c0	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0			0.30943496801705755
RT_CURSOR	0x8e868	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0			0.427797833935018
RT_CURSOR	0x8f110	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0			0.5469653179190751
RT_ICON	0x7c8c0	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	Tamil	India	0.5472350230414746
RT_ICON	0x7c8c0	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	Tamil	Sri Lanka	0.5472350230414746
RT_ICON	0x7cf88	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216	Tamil	India	0.5964730290456431
RT_ICON	0x7cf88	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216	Tamil	Sri Lanka	0.5964730290456431
RT_ICON	0x7f530	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024	Tamil	India	0.650709219858156
RT_ICON	0x7f530	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024	Tamil	Sri Lanka	0.650709219858156
RT_ICON	0x7f9c8	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	Tamil	India	0.36220682302771856
RT_ICON	0x7f9c8	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	Tamil	Sri Lanka	0.36220682302771856
RT_ICON	0x80870	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	Tamil	India	0.49954873646209386
RT_ICON	0x80870	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	Tamil	Sri Lanka	0.49954873646209386
RT_ICON	0x81118	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	Tamil	India	0.5777649769585254
RT_ICON	0x81118	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	Tamil	Sri Lanka	0.5777649769585254
RT_ICON	0x817e0	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	Tamil	India	0.6394508670520231
RT_ICON	0x817e0	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	Tamil	Sri Lanka	0.6394508670520231
RT_ICON	0x81d48	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	Tamil	India	0.44367219917012446
RT_ICON	0x81d48	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	Tamil	Sri Lanka	0.44367219917012446
RT_ICON	0x842f0	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	Tamil	India	0.4526266416510319
RT_ICON	0x842f0	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	Tamil	Sri Lanka	0.4526266416510319
RT_ICON	0x85398	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	Tamil	India	0.4413934426229508
RT_ICON	0x85398	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	Tamil	Sri Lanka	0.4413934426229508
RT_ICON	0x85d20	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	Tamil	India	0.49556737588652483
RT_ICON	0x85d20	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	Tamil	Sri Lanka	0.49556737588652483
RT_DIALOG	0x8f900	0x58	data			0.8977272727272727
RT_STRING	0x8f958	0x396	data	Tamil	India	0.4553376906318083
RT_STRING	0x8f958	0x396	data	Tamil	Sri Lanka	0.4553376906318083
RT_STRING	0x8fcf0	0x360	data	Tamil	India	0.4664351851851852
RT_STRING	0x8fcf0	0x360	data	Tamil	Sri Lanka	0.4664351851851852
RT_STRING	0x90050	0x5fa	data	Tamil	India	0.43790849673202614
RT_STRING	0x90050	0x5fa	data	Tamil	Sri Lanka	0.43790849673202614
RT_STRING	0x90650	0x2f8	data	Tamil	India	0.4723684210526316
RT_STRING	0x90650	0x2f8	data	Tamil	Sri Lanka	0.4723684210526316
RT_ACCELERATOR	0x89d90	0x58	data	Tamil	India	0.7954545454545454
RT_ACCELERATOR	0x89d90	0x58	data	Tamil	Sri Lanka	0.7954545454545454
RT_GROUP_CURSOR	0x8baa0	0x30	data			0.9375
RT_GROUP_CURSOR	0x8bcb0	0x22	data			1.0588235294117647
RT_GROUP_CURSOR	0x8d990	0x30	data			0.9375
RT_GROUP_CURSOR	0x8f678	0x30	data			0.9375
RT_GROUP_ICON	0x7f998	0x30	data	Tamil	India	0.9375
RT_GROUP_ICON	0x7f998	0x30	data	Tamil	Sri Lanka	0.9375
RT_GROUP_ICON	0x86188	0x76	data	Tamil	India	0.6694915254237288
RT_GROUP_ICON	0x86188	0x76	data	Tamil	Sri Lanka	0.6694915254237288
RT_VERSION	0x8f6a8	0x258	data			0.5383333333333333

Imports

DLL	Import
KERNEL32.dll	InterlockedIncrement, InterlockedDecrement, GetCurrentProcess, CreateJobObjectW, WriteConsoleInputA, GetComputerNameW, GetTimeFormatA, CallNamedPipeW, FreeEnvironmentStringsA, GetTickCount, GetCommConfig, GetNumberFormatA, ClearCommBreak, GetConsoleAliasExesW, EnumTimeFormatsA, TlsSetValue, GetCurrencyFormatW, SetFileShortNameW, LoadLibraryW, ReadConsoleInputA, IsBadCodePtr, SetVolumeMountPointA, CreateProcessW, GetFileAttributesW, GetModuleFileNameW, LCMapStringA, InterlockedExchange, GetLogicalDriveStringsA, GetLastError, SetLastError, GetProcAddress, VirtualAlloc, DefineDosDeviceW, GetDiskFreeSpaceW, LoadLibraryA, OpenJobObjectW, SetEnvironmentVariableA, GlobalWire, GlobalUnWire, GetCurrentDirectoryA, OpenEventW, GetShortPathNameW, SetFileAttributesW, GetVersionExW, GetTempFileNameW, HeapAlloc, UnhandledExceptionFilter, SetUnhandledExceptionFilter, HeapReAlloc, GetStartupInfoW, RaiseException, DeleteCriticalSection, LeaveCriticalSection, EnterCriticalSection, HeapFree, VirtualFree, HeapCreate, GetModuleHandleW, Sleep, ExitProcess, WriteFile, GetStdHandle, GetModuleFileNameA, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetCommandLineW, SetHandleCount, GetFileType, GetStartupInfoA, TlsGetValue, TlsAlloc, TlsFree, GetCurrentThreadId, QueryPerformanceCounter, GetCurrentProcessId, GetSystemTimeAsFileTime, GetModuleHandleA, InitializeCriticalSectionAndSpinCount, TerminateProcess, IsDebuggerPresent, RtlUnwind, GetCPInfo, GetACP, GetOEMCP, IsValidCodePage, HeapSize, GetLocaleInfoA, WideCharToMultiByte, MultiByteToWideChar, LCMapStringW, GetStringTypeA, GetStringTypeW
GDI32.dll	GetCharWidth32A
WINHTTP.dll	WinHttpOpen

Possible Origin

Language of compilation system	Country where language is spoken	Map
Tamil	India
Tamil	Sri Lanka

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-06T16:12:50.587302+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.9	49751	198.23.227.212	32583	TCP
2024-11-06T16:13:09.816855+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.9	49762	198.23.227.212	32583	TCP
2024-11-06T16:13:12.328671+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.9	49773	198.23.227.212	32583	TCP
2024-11-06T16:13:14.896333+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.9	49788	198.23.227.212	32583	TCP
2024-11-06T16:13:14.959931+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	20.12.23.50	443	192.168.2.9	49782	TCP
2024-11-06T16:13:17.315764+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.9	49797	198.23.227.212	32583	TCP
2024-11-06T16:13:18.933205+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.9	49807	198.23.227.212	32583	TCP
2024-11-06T16:13:20.878528+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.9	49816	198.23.227.212	32583	TCP
2024-11-06T16:13:22.690599+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.9	49822	198.23.227.212	32583	TCP
2024-11-06T16:13:24.212375+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.9	49833	198.23.227.212	32583	TCP
2024-11-06T16:13:25.742825+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.9	49844	198.23.227.212	32583	TCP
2024-11-06T16:13:27.519667+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.9	49852	198.23.227.212	32583	TCP
2024-11-06T16:13:29.092252+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.9	49861	198.23.227.212	32583	TCP
2024-11-06T16:13:31.318077+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.9	49871	198.23.227.212	32583	TCP
2024-11-06T16:13:32.848204+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.9	49882	198.23.227.212	32583	TCP
2024-11-06T16:13:34.530339+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.9	49891	198.23.227.212	32583	TCP
2024-11-06T16:13:36.093696+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.9	49900	198.23.227.212	32583	TCP
2024-11-06T16:13:37.885598+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.9	49911	198.23.227.212	32583	TCP
2024-11-06T16:13:39.420587+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.9	49921	198.23.227.212	32583	TCP
2024-11-06T16:13:40.952141+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.9	49927	198.23.227.212	32583	TCP
2024-11-06T16:13:42.476589+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.9	49938	198.23.227.212	32583	TCP
2024-11-06T16:13:44.016250+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.9	49947	198.23.227.212	32583	TCP
2024-11-06T16:13:45.554180+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.9	49955	198.23.227.212	32583	TCP
2024-11-06T16:13:47.080203+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.9	49965	198.23.227.212	32583	TCP
2024-11-06T16:13:48.997526+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.9	49975	198.23.227.212	32583	TCP
2024-11-06T16:13:50.516346+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.9	49984	198.23.227.212	32583	TCP
2024-11-06T16:13:52.063169+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.9	49993	198.23.227.212	32583	TCP
2024-11-06T16:13:53.531773+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	4.245.163.56	443	192.168.2.9	49998	TCP
2024-11-06T16:13:53.604000+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.9	50005	198.23.227.212	32583	TCP
2024-11-06T16:13:55.157165+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.9	50008	198.23.227.212	32583	TCP
2024-11-06T16:13:56.702594+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.9	50009	198.23.227.212	32583	TCP
2024-11-06T16:13:58.251867+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.9	50010	198.23.227.212	32583	TCP
2024-11-06T16:13:59.866697+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.9	50011	198.23.227.212	32583	TCP
2024-11-06T16:14:01.381368+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.9	50012	198.23.227.212	32583	TCP
2024-11-06T16:14:02.905941+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.9	50013	198.23.227.212	32583	TCP
2024-11-06T16:14:04.392920+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.9	50014	198.23.227.212	32583	TCP
2024-11-06T16:14:05.857574+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.9	50015	198.23.227.212	32583	TCP
2024-11-06T16:14:07.287871+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.9	50016	198.23.227.212	32583	TCP
2024-11-06T16:14:08.682370+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.9	50017	198.23.227.212	32583	TCP
2024-11-06T16:14:10.053950+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.9	50018	198.23.227.212	32583	TCP
2024-11-06T16:14:11.397316+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.9	50019	198.23.227.212	32583	TCP
2024-11-06T16:14:12.730364+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.9	50020	198.23.227.212	32583	TCP
2024-11-06T16:14:14.020702+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.9	50021	198.23.227.212	32583	TCP
2024-11-06T16:14:15.288186+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.9	50022	198.23.227.212	32583	TCP
2024-11-06T16:14:16.516602+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.9	50023	198.23.227.212	32583	TCP
2024-11-06T16:14:17.989362+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.9	50024	198.23.227.212	32583	TCP
2024-11-06T16:14:19.211024+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.9	50025	198.23.227.212	32583	TCP
2024-11-06T16:14:20.408510+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.9	50026	198.23.227.212	32583	TCP
2024-11-06T16:14:21.564136+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.9	50027	198.23.227.212	32583	TCP
2024-11-06T16:14:22.712105+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.9	50028	198.23.227.212	32583	TCP
2024-11-06T16:14:23.990144+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.9	50029	198.23.227.212	32583	TCP
2024-11-06T16:14:25.070156+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.9	50030	198.23.227.212	32583	TCP
2024-11-06T16:14:26.266292+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.9	50031	198.23.227.212	32583	TCP
2024-11-06T16:14:27.328260+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.9	50032	198.23.227.212	32583	TCP
2024-11-06T16:14:28.571776+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.9	50033	198.23.227.212	32583	TCP
2024-11-06T16:14:29.708123+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.9	50034	198.23.227.212	32583	TCP
2024-11-06T16:14:30.725785+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.9	50035	198.23.227.212	32583	TCP
2024-11-06T16:14:31.911090+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.9	50036	198.23.227.212	32583	TCP
2024-11-06T16:14:32.902479+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.9	50037	198.23.227.212	32583	TCP
2024-11-06T16:14:33.944221+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.9	50038	198.23.227.212	32583	TCP
2024-11-06T16:14:35.266911+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.9	50039	198.23.227.212	32583	TCP
2024-11-06T16:14:36.197653+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.9	50040	198.23.227.212	32583	TCP
2024-11-06T16:14:37.483394+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.9	50041	198.23.227.212	32583	TCP
2024-11-06T16:14:38.396275+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.9	50042	198.23.227.212	32583	TCP
2024-11-06T16:14:39.302597+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.9	50043	198.23.227.212	32583	TCP
2024-11-06T16:14:40.492107+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.9	50044	198.23.227.212	32583	TCP
2024-11-06T16:14:41.349870+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.9	50045	198.23.227.212	32583	TCP
2024-11-06T16:14:42.234145+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.9	50046	198.23.227.212	32583	TCP
2024-11-06T16:14:43.582174+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.9	50047	198.23.227.212	32583	TCP
2024-11-06T16:14:44.444096+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.9	50048	198.23.227.212	32583	TCP
2024-11-06T16:14:45.798602+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.9	50049	198.23.227.212	32583	TCP
2024-11-06T16:14:46.708786+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.9	50050	198.23.227.212	32583	TCP
2024-11-06T16:14:47.592066+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.9	50051	198.23.227.212	32583	TCP
2024-11-06T16:14:48.430357+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.9	50052	198.23.227.212	32583	TCP
2024-11-06T16:14:49.804094+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.9	50053	198.23.227.212	32583	TCP
2024-11-06T16:14:50.808322+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.9	50054	198.23.227.212	32583	TCP
2024-11-06T16:14:52.025340+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.9	50055	198.23.227.212	32583	TCP
2024-11-06T16:14:52.884189+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.9	50056	198.23.227.212	32583	TCP
2024-11-06T16:14:53.657141+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.9	50057	198.23.227.212	32583	TCP
2024-11-06T16:14:55.194016+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.9	50058	198.23.227.212	32583	TCP
2024-11-06T16:14:56.072013+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.9	50059	198.23.227.212	32583	TCP
2024-11-06T16:14:57.350658+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.9	50060	198.23.227.212	32583	TCP
2024-11-06T16:14:58.200549+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.9	50061	198.23.227.212	32583	TCP
2024-11-06T16:14:59.207971+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.9	50062	198.23.227.212	32583	TCP
2024-11-06T16:15:00.367017+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.9	50063	198.23.227.212	32583	TCP
2024-11-06T16:15:01.251432+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.9	50064	198.23.227.212	32583	TCP
2024-11-06T16:15:02.632756+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.9	50065	198.23.227.212	32583	TCP
2024-11-06T16:15:03.484073+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.9	50066	198.23.227.212	32583	TCP
2024-11-06T16:15:04.356513+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.9	50067	198.23.227.212	32583	TCP
2024-11-06T16:15:05.244012+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.9	50068	198.23.227.212	32583	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 6, 2024 16:13:06.842705965 CET	49751	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:13:06.847616911 CET	32583	49751	198.23.227.212	192.168.2.9
Nov 6, 2024 16:13:06.847686052 CET	49751	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:13:07.348659992 CET	32583	49751	198.23.227.212	192.168.2.9
Nov 6, 2024 16:13:07.352312088 CET	49751	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:13:08.272324085 CET	49751	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:13:08.272387028 CET	49751	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:13:08.277362108 CET	32583	49751	198.23.227.212	192.168.2.9
Nov 6, 2024 16:13:08.277369976 CET	32583	49751	198.23.227.212	192.168.2.9
Nov 6, 2024 16:13:09.275280952 CET	49762	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:13:09.280158997 CET	32583	49762	198.23.227.212	192.168.2.9
Nov 6, 2024 16:13:09.280251980 CET	49762	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:13:09.283709049 CET	49762	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:13:09.288724899 CET	32583	49762	198.23.227.212	192.168.2.9
Nov 6, 2024 16:13:09.816755056 CET	32583	49762	198.23.227.212	192.168.2.9
Nov 6, 2024 16:13:09.816854954 CET	49762	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:13:10.802345037 CET	49762	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:13:10.979865074 CET	32583	49762	198.23.227.212	192.168.2.9
Nov 6, 2024 16:13:11.822551966 CET	49773	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:13:11.827510118 CET	32583	49773	198.23.227.212	192.168.2.9
Nov 6, 2024 16:13:11.827704906 CET	49773	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:13:11.831265926 CET	49773	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:13:11.836108923 CET	32583	49773	198.23.227.212	192.168.2.9
Nov 6, 2024 16:13:12.328577995 CET	32583	49773	198.23.227.212	192.168.2.9
Nov 6, 2024 16:13:12.328670979 CET	49773	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:13:12.919420004 CET	49773	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:13:12.924573898 CET	32583	49773	198.23.227.212	192.168.2.9
Nov 6, 2024 16:13:14.377028942 CET	49788	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:13:14.381839037 CET	32583	49788	198.23.227.212	192.168.2.9
Nov 6, 2024 16:13:14.381906033 CET	49788	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:13:14.387855053 CET	49788	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:13:14.392654896 CET	32583	49788	198.23.227.212	192.168.2.9
Nov 6, 2024 16:13:14.896203041 CET	32583	49788	198.23.227.212	192.168.2.9
Nov 6, 2024 16:13:14.896332979 CET	49788	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:13:15.323683023 CET	49788	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:13:15.399605989 CET	32583	49788	198.23.227.212	192.168.2.9
Nov 6, 2024 16:13:16.809329033 CET	49797	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:13:16.814234018 CET	32583	49797	198.23.227.212	192.168.2.9
Nov 6, 2024 16:13:16.814325094 CET	49797	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:13:16.818337917 CET	49797	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:13:16.823374987 CET	32583	49797	198.23.227.212	192.168.2.9
Nov 6, 2024 16:13:17.315691948 CET	32583	49797	198.23.227.212	192.168.2.9
Nov 6, 2024 16:13:17.315763950 CET	49797	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:13:17.381145954 CET	49797	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:13:17.386219025 CET	32583	49797	198.23.227.212	192.168.2.9
Nov 6, 2024 16:13:18.400190115 CET	49807	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:13:18.405114889 CET	32583	49807	198.23.227.212	192.168.2.9
Nov 6, 2024 16:13:18.405200958 CET	49807	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:13:18.408853054 CET	49807	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:13:18.413721085 CET	32583	49807	198.23.227.212	192.168.2.9
Nov 6, 2024 16:13:18.933134079 CET	32583	49807	198.23.227.212	192.168.2.9
Nov 6, 2024 16:13:18.933204889 CET	49807	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:13:19.334317923 CET	49807	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:13:19.625597000 CET	32583	49807	198.23.227.212	192.168.2.9
Nov 6, 2024 16:13:20.358015060 CET	49816	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:13:20.363756895 CET	32583	49816	198.23.227.212	192.168.2.9
Nov 6, 2024 16:13:20.363847017 CET	49816	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:13:20.368269920 CET	49816	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:13:20.373723984 CET	32583	49816	198.23.227.212	192.168.2.9
Nov 6, 2024 16:13:20.878431082 CET	32583	49816	198.23.227.212	192.168.2.9
Nov 6, 2024 16:13:20.878528118 CET	49816	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:13:20.878668070 CET	49816	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:13:20.883645058 CET	32583	49816	198.23.227.212	192.168.2.9
Nov 6, 2024 16:13:21.893315077 CET	49822	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:13:21.898178101 CET	32583	49822	198.23.227.212	192.168.2.9
Nov 6, 2024 16:13:21.898401022 CET	49822	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:13:21.942775965 CET	49822	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:13:21.947633028 CET	32583	49822	198.23.227.212	192.168.2.9
Nov 6, 2024 16:13:22.690489054 CET	32583	49822	198.23.227.212	192.168.2.9
Nov 6, 2024 16:13:22.690598965 CET	49822	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:13:22.690773010 CET	49822	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:13:22.692445040 CET	32583	49822	198.23.227.212	192.168.2.9
Nov 6, 2024 16:13:22.692502975 CET	49822	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:13:22.695590973 CET	32583	49822	198.23.227.212	192.168.2.9
Nov 6, 2024 16:13:23.697312117 CET	49833	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:13:23.702291012 CET	32583	49833	198.23.227.212	192.168.2.9
Nov 6, 2024 16:13:23.702364922 CET	49833	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:13:23.705756903 CET	49833	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:13:23.710608959 CET	32583	49833	198.23.227.212	192.168.2.9
Nov 6, 2024 16:13:24.212316036 CET	32583	49833	198.23.227.212	192.168.2.9
Nov 6, 2024 16:13:24.212374926 CET	49833	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:13:24.212582111 CET	49833	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:13:24.217708111 CET	32583	49833	198.23.227.212	192.168.2.9
Nov 6, 2024 16:13:25.228418112 CET	49844	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:13:25.233264923 CET	32583	49844	198.23.227.212	192.168.2.9
Nov 6, 2024 16:13:25.233365059 CET	49844	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:13:25.236871958 CET	49844	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:13:25.241660118 CET	32583	49844	198.23.227.212	192.168.2.9
Nov 6, 2024 16:13:25.739573956 CET	32583	49844	198.23.227.212	192.168.2.9
Nov 6, 2024 16:13:25.742825031 CET	49844	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:13:25.742971897 CET	49844	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:13:25.747720003 CET	32583	49844	198.23.227.212	192.168.2.9
Nov 6, 2024 16:13:26.744046926 CET	49852	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:13:27.005512953 CET	32583	49852	198.23.227.212	192.168.2.9
Nov 6, 2024 16:13:27.005614042 CET	49852	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:13:27.065048933 CET	49852	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:13:27.070036888 CET	32583	49852	198.23.227.212	192.168.2.9
Nov 6, 2024 16:13:27.519556046 CET	32583	49852	198.23.227.212	192.168.2.9
Nov 6, 2024 16:13:27.519666910 CET	49852	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:13:27.564455986 CET	49852	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:13:27.569595098 CET	32583	49852	198.23.227.212	192.168.2.9
Nov 6, 2024 16:13:28.572288990 CET	49861	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:13:28.577297926 CET	32583	49861	198.23.227.212	192.168.2.9
Nov 6, 2024 16:13:28.577406883 CET	49861	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:13:28.580924034 CET	49861	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:13:28.585813046 CET	32583	49861	198.23.227.212	192.168.2.9
Nov 6, 2024 16:13:29.090984106 CET	32583	49861	198.23.227.212	192.168.2.9
Nov 6, 2024 16:13:29.092252016 CET	49861	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:13:29.092394114 CET	49861	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:13:29.097286940 CET	32583	49861	198.23.227.212	192.168.2.9
Nov 6, 2024 16:13:30.113888025 CET	49871	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:13:30.785998106 CET	32583	49871	198.23.227.212	192.168.2.9
Nov 6, 2024 16:13:30.786145926 CET	49871	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:13:30.789860010 CET	49871	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:13:30.794624090 CET	32583	49871	198.23.227.212	192.168.2.9
Nov 6, 2024 16:13:31.318010092 CET	32583	49871	198.23.227.212	192.168.2.9
Nov 6, 2024 16:13:31.318077087 CET	49871	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:13:31.318176031 CET	49871	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:13:31.322957039 CET	32583	49871	198.23.227.212	192.168.2.9
Nov 6, 2024 16:13:32.322417974 CET	49882	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:13:32.327568054 CET	32583	49882	198.23.227.212	192.168.2.9
Nov 6, 2024 16:13:32.327634096 CET	49882	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:13:32.331773043 CET	49882	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:13:32.336643934 CET	32583	49882	198.23.227.212	192.168.2.9
Nov 6, 2024 16:13:32.846164942 CET	32583	49882	198.23.227.212	192.168.2.9
Nov 6, 2024 16:13:32.848203897 CET	49882	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:13:32.961635113 CET	49882	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:13:32.966887951 CET	32583	49882	198.23.227.212	192.168.2.9
Nov 6, 2024 16:13:33.994108915 CET	49891	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:13:33.999444962 CET	32583	49891	198.23.227.212	192.168.2.9
Nov 6, 2024 16:13:33.999535084 CET	49891	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:13:34.003098011 CET	49891	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:13:34.008900881 CET	32583	49891	198.23.227.212	192.168.2.9
Nov 6, 2024 16:13:34.530265093 CET	32583	49891	198.23.227.212	192.168.2.9
Nov 6, 2024 16:13:34.530339003 CET	49891	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:13:34.530500889 CET	49891	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:13:34.535435915 CET	32583	49891	198.23.227.212	192.168.2.9
Nov 6, 2024 16:13:35.580132008 CET	49900	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:13:35.585606098 CET	32583	49900	198.23.227.212	192.168.2.9
Nov 6, 2024 16:13:35.585681915 CET	49900	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:13:35.626456976 CET	49900	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:13:35.631427050 CET	32583	49900	198.23.227.212	192.168.2.9
Nov 6, 2024 16:13:36.093627930 CET	32583	49900	198.23.227.212	192.168.2.9
Nov 6, 2024 16:13:36.093696117 CET	49900	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:13:36.348067999 CET	49900	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:13:36.353367090 CET	32583	49900	198.23.227.212	192.168.2.9
Nov 6, 2024 16:13:37.369623899 CET	49911	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:13:37.374744892 CET	32583	49911	198.23.227.212	192.168.2.9
Nov 6, 2024 16:13:37.374820948 CET	49911	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:13:37.378593922 CET	49911	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:13:37.383505106 CET	32583	49911	198.23.227.212	192.168.2.9
Nov 6, 2024 16:13:37.885528088 CET	32583	49911	198.23.227.212	192.168.2.9
Nov 6, 2024 16:13:37.885597944 CET	49911	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:13:37.885751963 CET	49911	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:13:37.890850067 CET	32583	49911	198.23.227.212	192.168.2.9
Nov 6, 2024 16:13:38.901622057 CET	49921	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:13:38.906680107 CET	32583	49921	198.23.227.212	192.168.2.9
Nov 6, 2024 16:13:38.906780005 CET	49921	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:13:38.911705017 CET	49921	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:13:38.916551113 CET	32583	49921	198.23.227.212	192.168.2.9
Nov 6, 2024 16:13:39.420517921 CET	32583	49921	198.23.227.212	192.168.2.9
Nov 6, 2024 16:13:39.420587063 CET	49921	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:13:39.420737982 CET	49921	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:13:39.425581932 CET	32583	49921	198.23.227.212	192.168.2.9
Nov 6, 2024 16:13:40.431662083 CET	49927	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:13:40.436753988 CET	32583	49927	198.23.227.212	192.168.2.9
Nov 6, 2024 16:13:40.436872005 CET	49927	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:13:40.440824986 CET	49927	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:13:40.445646048 CET	32583	49927	198.23.227.212	192.168.2.9
Nov 6, 2024 16:13:40.951976061 CET	32583	49927	198.23.227.212	192.168.2.9
Nov 6, 2024 16:13:40.952141047 CET	49927	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:13:40.952208042 CET	49927	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:13:40.958653927 CET	32583	49927	198.23.227.212	192.168.2.9
Nov 6, 2024 16:13:41.962908030 CET	49938	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:13:41.968444109 CET	32583	49938	198.23.227.212	192.168.2.9
Nov 6, 2024 16:13:41.968534946 CET	49938	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:13:41.972282887 CET	49938	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:13:41.977811098 CET	32583	49938	198.23.227.212	192.168.2.9
Nov 6, 2024 16:13:42.476502895 CET	32583	49938	198.23.227.212	192.168.2.9
Nov 6, 2024 16:13:42.476588964 CET	49938	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:13:42.476748943 CET	49938	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:13:42.481534958 CET	32583	49938	198.23.227.212	192.168.2.9
Nov 6, 2024 16:13:43.500350952 CET	49947	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:13:43.505471945 CET	32583	49947	198.23.227.212	192.168.2.9
Nov 6, 2024 16:13:43.505585909 CET	49947	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:13:43.510385036 CET	49947	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:13:43.515336990 CET	32583	49947	198.23.227.212	192.168.2.9
Nov 6, 2024 16:13:44.014801979 CET	32583	49947	198.23.227.212	192.168.2.9
Nov 6, 2024 16:13:44.016249895 CET	49947	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:13:44.030354023 CET	49947	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:13:44.035265923 CET	32583	49947	198.23.227.212	192.168.2.9
Nov 6, 2024 16:13:45.040998936 CET	49955	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:13:45.046247959 CET	32583	49955	198.23.227.212	192.168.2.9
Nov 6, 2024 16:13:45.046345949 CET	49955	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:13:45.051204920 CET	49955	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:13:45.056061029 CET	32583	49955	198.23.227.212	192.168.2.9
Nov 6, 2024 16:13:45.554112911 CET	32583	49955	198.23.227.212	192.168.2.9
Nov 6, 2024 16:13:45.554179907 CET	49955	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:13:45.554326057 CET	49955	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:13:45.559710979 CET	32583	49955	198.23.227.212	192.168.2.9
Nov 6, 2024 16:13:46.557085991 CET	49965	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:13:46.565978050 CET	32583	49965	198.23.227.212	192.168.2.9
Nov 6, 2024 16:13:46.566066027 CET	49965	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:13:46.569819927 CET	49965	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:13:46.577023029 CET	32583	49965	198.23.227.212	192.168.2.9
Nov 6, 2024 16:13:47.077202082 CET	32583	49965	198.23.227.212	192.168.2.9
Nov 6, 2024 16:13:47.080203056 CET	49965	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:13:47.456578970 CET	49965	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:13:47.461568117 CET	32583	49965	198.23.227.212	192.168.2.9
Nov 6, 2024 16:13:48.478734970 CET	49975	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:13:48.483881950 CET	32583	49975	198.23.227.212	192.168.2.9
Nov 6, 2024 16:13:48.483952045 CET	49975	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:13:48.488877058 CET	49975	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:13:48.494472980 CET	32583	49975	198.23.227.212	192.168.2.9
Nov 6, 2024 16:13:48.997422934 CET	32583	49975	198.23.227.212	192.168.2.9
Nov 6, 2024 16:13:48.997525930 CET	49975	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:13:48.997733116 CET	49975	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:13:49.002851009 CET	32583	49975	198.23.227.212	192.168.2.9
Nov 6, 2024 16:13:50.009922028 CET	49984	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:13:50.014827013 CET	32583	49984	198.23.227.212	192.168.2.9
Nov 6, 2024 16:13:50.014897108 CET	49984	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:13:50.018580914 CET	49984	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:13:50.023493052 CET	32583	49984	198.23.227.212	192.168.2.9
Nov 6, 2024 16:13:50.516242981 CET	32583	49984	198.23.227.212	192.168.2.9
Nov 6, 2024 16:13:50.516345978 CET	49984	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:13:50.516485929 CET	49984	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:13:50.521332026 CET	32583	49984	198.23.227.212	192.168.2.9
Nov 6, 2024 16:13:51.526014090 CET	49993	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:13:51.530955076 CET	32583	49993	198.23.227.212	192.168.2.9
Nov 6, 2024 16:13:51.531024933 CET	49993	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:13:51.535221100 CET	49993	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:13:51.539969921 CET	32583	49993	198.23.227.212	192.168.2.9
Nov 6, 2024 16:13:52.063095093 CET	32583	49993	198.23.227.212	192.168.2.9
Nov 6, 2024 16:13:52.063169003 CET	49993	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:13:52.063380003 CET	49993	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:13:52.070343018 CET	32583	49993	198.23.227.212	192.168.2.9
Nov 6, 2024 16:13:53.072139025 CET	50005	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:13:53.076921940 CET	32583	50005	198.23.227.212	192.168.2.9
Nov 6, 2024 16:13:53.078238964 CET	50005	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:13:53.081764936 CET	50005	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:13:53.086595058 CET	32583	50005	198.23.227.212	192.168.2.9
Nov 6, 2024 16:13:53.603910923 CET	32583	50005	198.23.227.212	192.168.2.9
Nov 6, 2024 16:13:53.604000092 CET	50005	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:13:53.604162931 CET	50005	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:13:53.609056950 CET	32583	50005	198.23.227.212	192.168.2.9
Nov 6, 2024 16:13:54.619082928 CET	50008	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:13:54.623958111 CET	32583	50008	198.23.227.212	192.168.2.9
Nov 6, 2024 16:13:54.624054909 CET	50008	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:13:54.627562046 CET	50008	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:13:54.632355928 CET	32583	50008	198.23.227.212	192.168.2.9
Nov 6, 2024 16:13:55.157088041 CET	32583	50008	198.23.227.212	192.168.2.9
Nov 6, 2024 16:13:55.157165051 CET	50008	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:13:55.157383919 CET	50008	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:13:55.162264109 CET	32583	50008	198.23.227.212	192.168.2.9
Nov 6, 2024 16:13:56.165788889 CET	50009	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:13:56.170782089 CET	32583	50009	198.23.227.212	192.168.2.9
Nov 6, 2024 16:13:56.170893908 CET	50009	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:13:56.174427986 CET	50009	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:13:56.179337978 CET	32583	50009	198.23.227.212	192.168.2.9
Nov 6, 2024 16:13:56.702488899 CET	32583	50009	198.23.227.212	192.168.2.9
Nov 6, 2024 16:13:56.702594042 CET	50009	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:13:56.702785015 CET	50009	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:13:56.707748890 CET	32583	50009	198.23.227.212	192.168.2.9
Nov 6, 2024 16:13:57.712790012 CET	50010	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:13:57.717607975 CET	32583	50010	198.23.227.212	192.168.2.9
Nov 6, 2024 16:13:57.717670918 CET	50010	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:13:57.721208096 CET	50010	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:13:57.726030111 CET	32583	50010	198.23.227.212	192.168.2.9
Nov 6, 2024 16:13:58.251746893 CET	32583	50010	198.23.227.212	192.168.2.9
Nov 6, 2024 16:13:58.251867056 CET	50010	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:13:58.252012968 CET	50010	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:13:58.256939888 CET	32583	50010	198.23.227.212	192.168.2.9
Nov 6, 2024 16:13:59.259762049 CET	50011	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:13:59.364329100 CET	32583	50011	198.23.227.212	192.168.2.9
Nov 6, 2024 16:13:59.364458084 CET	50011	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:13:59.582709074 CET	50011	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:13:59.587543964 CET	32583	50011	198.23.227.212	192.168.2.9
Nov 6, 2024 16:13:59.866585016 CET	32583	50011	198.23.227.212	192.168.2.9
Nov 6, 2024 16:13:59.866697073 CET	50011	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:13:59.866734982 CET	50011	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:13:59.871944904 CET	32583	50011	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:00.869302988 CET	50012	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:00.874655008 CET	32583	50012	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:00.874757051 CET	50012	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:00.878669024 CET	50012	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:00.885279894 CET	32583	50012	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:01.381282091 CET	32583	50012	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:01.381367922 CET	50012	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:01.381501913 CET	50012	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:01.386492968 CET	32583	50012	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:02.392699003 CET	50013	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:02.397615910 CET	32583	50013	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:02.397690058 CET	50013	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:02.402131081 CET	50013	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:02.407022953 CET	32583	50013	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:02.905695915 CET	32583	50013	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:02.905941010 CET	50013	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:02.906080961 CET	50013	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:02.910896063 CET	32583	50013	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:03.885484934 CET	50014	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:03.890918970 CET	32583	50014	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:03.891007900 CET	50014	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:03.900660992 CET	50014	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:03.905579090 CET	32583	50014	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:04.392729044 CET	32583	50014	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:04.392920017 CET	50014	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:04.392970085 CET	50014	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:04.398380041 CET	32583	50014	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:05.337729931 CET	50015	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:05.342659950 CET	32583	50015	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:05.342753887 CET	50015	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:05.346232891 CET	50015	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:05.351161003 CET	32583	50015	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:05.857513905 CET	32583	50015	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:05.857573986 CET	50015	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:05.857691050 CET	50015	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:05.862832069 CET	32583	50015	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:06.775526047 CET	50016	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:06.780539036 CET	32583	50016	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:06.780606031 CET	50016	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:06.784295082 CET	50016	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:06.789216042 CET	32583	50016	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:07.287807941 CET	32583	50016	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:07.287870884 CET	50016	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:07.287980080 CET	50016	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:07.292707920 CET	32583	50016	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:08.165975094 CET	50017	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:08.173242092 CET	32583	50017	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:08.173342943 CET	50017	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:08.176834106 CET	50017	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:08.182132006 CET	32583	50017	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:08.682305098 CET	32583	50017	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:08.682369947 CET	50017	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:08.682481050 CET	50017	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:08.687380075 CET	32583	50017	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:09.540930986 CET	50018	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:09.546350002 CET	32583	50018	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:09.546447992 CET	50018	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:09.549947977 CET	50018	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:09.554800034 CET	32583	50018	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:10.053823948 CET	32583	50018	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:10.053950071 CET	50018	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:10.054097891 CET	50018	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:10.058981895 CET	32583	50018	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:10.884567022 CET	50019	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:10.889370918 CET	32583	50019	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:10.889468908 CET	50019	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:10.894054890 CET	50019	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:10.898978949 CET	32583	50019	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:11.397119999 CET	32583	50019	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:11.397315979 CET	50019	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:11.397563934 CET	50019	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:11.402456045 CET	32583	50019	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:12.197216988 CET	50020	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:12.202219009 CET	32583	50020	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:12.202336073 CET	50020	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:12.205888987 CET	50020	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:12.210761070 CET	32583	50020	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:12.730273008 CET	32583	50020	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:12.730364084 CET	50020	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:12.730551004 CET	50020	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:12.735348940 CET	32583	50020	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:13.494195938 CET	50021	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:13.501632929 CET	32583	50021	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:13.501717091 CET	50021	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:13.505215883 CET	50021	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:13.512970924 CET	32583	50021	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:14.020642042 CET	32583	50021	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:14.020701885 CET	50021	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:14.020822048 CET	50021	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:14.026537895 CET	32583	50021	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:14.773165941 CET	50022	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:14.778079033 CET	32583	50022	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:14.778171062 CET	50022	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:14.786477089 CET	50022	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:14.791467905 CET	32583	50022	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:15.288093090 CET	32583	50022	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:15.288186073 CET	50022	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:15.288363934 CET	50022	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:15.293164968 CET	32583	50022	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:16.009769917 CET	50023	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:16.014791965 CET	32583	50023	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:16.014898062 CET	50023	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:16.020617962 CET	50023	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:16.025819063 CET	32583	50023	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:16.516514063 CET	32583	50023	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:16.516602039 CET	50023	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:16.516732931 CET	50023	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:16.521612883 CET	32583	50023	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:17.452389002 CET	50024	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:17.457242966 CET	32583	50024	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:17.457334995 CET	50024	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:17.461375952 CET	50024	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:17.466391087 CET	32583	50024	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:17.989291906 CET	32583	50024	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:17.989362001 CET	50024	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:18.010885000 CET	50024	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:18.016096115 CET	32583	50024	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:18.697205067 CET	50025	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:18.702402115 CET	32583	50025	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:18.702466965 CET	50025	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:18.706870079 CET	50025	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:18.711781979 CET	32583	50025	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:19.210957050 CET	32583	50025	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:19.211024046 CET	50025	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:19.211216927 CET	50025	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:19.215995073 CET	32583	50025	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:19.869138956 CET	50026	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:19.874867916 CET	32583	50026	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:19.875046968 CET	50026	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:19.878624916 CET	50026	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:19.883814096 CET	32583	50026	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:20.408444881 CET	32583	50026	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:20.408509970 CET	50026	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:20.408792019 CET	50026	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:20.413649082 CET	32583	50026	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:21.040870905 CET	50027	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:21.045701027 CET	32583	50027	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:21.045928955 CET	50027	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:21.049534082 CET	50027	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:21.055088043 CET	32583	50027	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:21.560626030 CET	32583	50027	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:21.564136028 CET	50027	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:21.564308882 CET	50027	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:21.570622921 CET	32583	50027	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:22.188999891 CET	50028	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:22.193820953 CET	32583	50028	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:22.196119070 CET	50028	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:22.253668070 CET	50028	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:22.258685112 CET	32583	50028	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:22.710005045 CET	32583	50028	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:22.712105036 CET	50028	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:22.880151033 CET	50028	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:22.886734962 CET	32583	50028	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:23.478353977 CET	50029	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:23.483289957 CET	32583	50029	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:23.484112024 CET	50029	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:23.487534046 CET	50029	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:23.493021011 CET	32583	50029	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:23.990087986 CET	32583	50029	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:23.990144014 CET	50029	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:23.990345955 CET	50029	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:23.995338917 CET	32583	50029	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:24.556468964 CET	50030	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:24.561311960 CET	32583	50030	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:24.561408997 CET	50030	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:24.564765930 CET	50030	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:24.569947958 CET	32583	50030	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:25.067728996 CET	32583	50030	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:25.070156097 CET	50030	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:25.173042059 CET	50030	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:25.177947044 CET	32583	50030	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:25.749561071 CET	50031	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:25.754638910 CET	32583	50031	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:25.754703999 CET	50031	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:25.758569002 CET	50031	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:25.765008926 CET	32583	50031	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:26.266220093 CET	32583	50031	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:26.266292095 CET	50031	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:26.266472101 CET	50031	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:26.271357059 CET	32583	50031	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:26.806596041 CET	50032	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:26.811507940 CET	32583	50032	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:26.812170982 CET	50032	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:26.815896034 CET	50032	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:26.821099997 CET	32583	50032	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:27.327550888 CET	32583	50032	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:27.328259945 CET	50032	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:27.328533888 CET	50032	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:27.333511114 CET	32583	50032	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:28.060380936 CET	50033	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:28.065299988 CET	32583	50033	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:28.065419912 CET	50033	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:28.139213085 CET	50033	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:28.144184113 CET	32583	50033	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:28.571691990 CET	32583	50033	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:28.571775913 CET	50033	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:28.571949005 CET	50033	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:28.577383995 CET	32583	50033	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:29.072098017 CET	50034	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:29.202578068 CET	32583	50034	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:29.202745914 CET	50034	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:29.394196987 CET	50034	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:29.399080992 CET	32583	50034	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:29.705889940 CET	32583	50034	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:29.708122969 CET	50034	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:29.708681107 CET	50034	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:29.714128971 CET	32583	50034	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:30.197155952 CET	50035	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:30.204592943 CET	32583	50035	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:30.208096981 CET	50035	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:30.211338997 CET	50035	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:30.217628002 CET	32583	50035	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:30.725678921 CET	32583	50035	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:30.725785017 CET	50035	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:30.827292919 CET	50035	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:30.836406946 CET	32583	50035	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:31.387147903 CET	50036	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:31.393064022 CET	32583	50036	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:31.393151999 CET	50036	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:31.396503925 CET	50036	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:31.401690960 CET	32583	50036	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:31.911027908 CET	32583	50036	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:31.911089897 CET	50036	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:31.911216021 CET	50036	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:31.916057110 CET	32583	50036	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:32.369349957 CET	50037	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:32.374381065 CET	32583	50037	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:32.374460936 CET	50037	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:32.377886057 CET	50037	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:32.383223057 CET	32583	50037	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:32.902417898 CET	32583	50037	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:32.902478933 CET	50037	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:32.902682066 CET	50037	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:32.907812119 CET	32583	50037	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:33.384232998 CET	50038	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:33.389111996 CET	32583	50038	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:33.389305115 CET	50038	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:33.394834995 CET	50038	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:33.399729967 CET	32583	50038	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:33.944148064 CET	32583	50038	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:33.944221020 CET	50038	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:33.944410086 CET	50038	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:33.949242115 CET	32583	50038	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:34.744769096 CET	50039	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:34.749706030 CET	32583	50039	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:34.749774933 CET	50039	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:34.753395081 CET	50039	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:34.758435011 CET	32583	50039	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:35.266825914 CET	32583	50039	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:35.266911030 CET	50039	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:35.268579006 CET	50039	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:35.273494005 CET	32583	50039	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:35.681503057 CET	50040	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:35.687197924 CET	32583	50040	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:35.687283993 CET	50040	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:35.690645933 CET	50040	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:35.695616961 CET	32583	50040	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:36.197567940 CET	32583	50040	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:36.197653055 CET	50040	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:36.197778940 CET	50040	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:36.202708006 CET	32583	50040	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:36.967593908 CET	50041	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:36.972577095 CET	32583	50041	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:36.972640991 CET	50041	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:36.976147890 CET	50041	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:36.981880903 CET	32583	50041	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:37.483206987 CET	32583	50041	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:37.483393908 CET	50041	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:37.483653069 CET	50041	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:37.489222050 CET	32583	50041	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:37.869213104 CET	50042	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:37.874154091 CET	32583	50042	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:37.874228954 CET	50042	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:37.878163099 CET	50042	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:37.883059978 CET	32583	50042	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:38.396018028 CET	32583	50042	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:38.396275043 CET	50042	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:38.396341085 CET	50042	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:38.401227951 CET	32583	50042	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:38.759593010 CET	50043	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:38.764672995 CET	32583	50043	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:38.764832973 CET	50043	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:38.768347025 CET	50043	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:38.773392916 CET	32583	50043	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:39.300441980 CET	32583	50043	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:39.302597046 CET	50043	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:39.614468098 CET	50043	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:39.619620085 CET	32583	50043	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:39.984433889 CET	50044	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:39.989387989 CET	32583	50044	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:39.989500999 CET	50044	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:39.993067980 CET	50044	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:39.998574018 CET	32583	50044	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:40.490880966 CET	32583	50044	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:40.492106915 CET	50044	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:40.492317915 CET	50044	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:40.497155905 CET	32583	50044	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:40.837563992 CET	50045	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:40.842461109 CET	32583	50045	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:40.842529058 CET	50045	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:40.845901012 CET	50045	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:40.850953102 CET	32583	50045	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:41.349627972 CET	32583	50045	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:41.349869967 CET	50045	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:41.351361036 CET	50045	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:41.356318951 CET	32583	50045	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:41.719782114 CET	50046	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:41.724685907 CET	32583	50046	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:41.726077080 CET	50046	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:41.729567051 CET	50046	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:41.734447956 CET	32583	50046	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:42.232367039 CET	32583	50046	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:42.234144926 CET	50046	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:42.662204981 CET	50046	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:42.667349100 CET	32583	50046	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:43.049091101 CET	50047	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:43.054054022 CET	32583	50047	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:43.054143906 CET	50047	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:43.058427095 CET	50047	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:43.063250065 CET	32583	50047	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:43.582122087 CET	32583	50047	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:43.582174063 CET	50047	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:43.582429886 CET	50047	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:43.587152004 CET	32583	50047	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:43.937068939 CET	50048	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:43.942131042 CET	32583	50048	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:43.942260027 CET	50048	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:43.945825100 CET	50048	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:43.950694084 CET	32583	50048	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:44.443388939 CET	32583	50048	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:44.444096088 CET	50048	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:44.444297075 CET	50048	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:44.449074984 CET	32583	50048	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:45.261863947 CET	50049	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:45.266738892 CET	32583	50049	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:45.266813993 CET	50049	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:45.270920038 CET	50049	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:45.275692940 CET	32583	50049	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:45.798532009 CET	32583	50049	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:45.798602104 CET	50049	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:45.798746109 CET	50049	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:45.803738117 CET	32583	50049	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:46.188808918 CET	50050	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:46.193748951 CET	32583	50050	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:46.193825006 CET	50050	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:46.198510885 CET	50050	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:46.203407049 CET	32583	50050	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:46.708635092 CET	32583	50050	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:46.708786011 CET	50050	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:46.708987951 CET	50050	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:46.713772058 CET	32583	50050	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:47.060307980 CET	50051	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:47.065211058 CET	32583	50051	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:47.065320015 CET	50051	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:47.068886042 CET	50051	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:47.073715925 CET	32583	50051	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:47.591445923 CET	32583	50051	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:47.592066050 CET	50051	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:47.595498085 CET	50051	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:47.600466013 CET	32583	50051	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:47.910012007 CET	50052	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:47.915564060 CET	32583	50052	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:47.915662050 CET	50052	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:47.919095993 CET	50052	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:47.924348116 CET	32583	50052	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:48.430268049 CET	32583	50052	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:48.430356979 CET	50052	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:48.523336887 CET	50052	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:48.528291941 CET	32583	50052	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:49.260345936 CET	50053	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:49.265647888 CET	32583	50053	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:49.265727997 CET	50053	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:49.269210100 CET	50053	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:49.274137974 CET	32583	50053	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:49.800158024 CET	32583	50053	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:49.804094076 CET	50053	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:49.804306984 CET	50053	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:49.811084032 CET	32583	50053	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:50.234309912 CET	50054	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:50.239156008 CET	32583	50054	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:50.239253044 CET	50054	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:50.243999004 CET	50054	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:50.249017954 CET	32583	50054	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:50.808252096 CET	32583	50054	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:50.808321953 CET	50054	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:50.809649944 CET	50054	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:50.815491915 CET	32583	50054	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:51.509625912 CET	50055	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:51.514549017 CET	32583	50055	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:51.514621019 CET	50055	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:51.518512011 CET	50055	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:51.523386955 CET	32583	50055	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:52.025242090 CET	32583	50055	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:52.025340080 CET	50055	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:52.025517941 CET	50055	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:52.030344009 CET	32583	50055	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:52.371474981 CET	50056	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:52.376416922 CET	32583	50056	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:52.376486063 CET	50056	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:52.379935026 CET	50056	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:52.384958029 CET	32583	50056	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:52.884047985 CET	32583	50056	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:52.884188890 CET	50056	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:52.884773970 CET	50056	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:52.889621019 CET	32583	50056	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:53.150969982 CET	50057	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:53.156055927 CET	32583	50057	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:53.156131983 CET	50057	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:53.159710884 CET	50057	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:53.164539099 CET	32583	50057	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:53.657025099 CET	32583	50057	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:53.657140970 CET	50057	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:53.916867018 CET	50057	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:53.921678066 CET	32583	50057	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:54.680434942 CET	50058	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:54.685489893 CET	32583	50058	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:54.685612917 CET	50058	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:54.689124107 CET	50058	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:54.694222927 CET	32583	50058	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:55.193948030 CET	32583	50058	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:55.194015980 CET	50058	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:55.194250107 CET	50058	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:55.201195955 CET	32583	50058	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:55.557451963 CET	50059	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:55.562529087 CET	32583	50059	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:55.564054012 CET	50059	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:55.567547083 CET	50059	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:55.572405100 CET	32583	50059	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:56.071855068 CET	32583	50059	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:56.072012901 CET	50059	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:56.469587088 CET	50059	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:56.474515915 CET	32583	50059	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:56.837438107 CET	50060	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:56.842346907 CET	32583	50060	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:56.842427015 CET	50060	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:56.845870018 CET	50060	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:56.850657940 CET	32583	50060	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:57.350526094 CET	32583	50060	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:57.350657940 CET	50060	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:57.350934029 CET	50060	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:57.355729103 CET	32583	50060	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:57.686969042 CET	50061	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:57.692082882 CET	32583	50061	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:57.692189932 CET	50061	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:57.695796013 CET	50061	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:57.700805902 CET	32583	50061	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:58.200301886 CET	32583	50061	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:58.200548887 CET	50061	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:58.200733900 CET	50061	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:58.205583096 CET	32583	50061	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:58.620302916 CET	50062	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:58.625399113 CET	32583	50062	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:58.625696898 CET	50062	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:58.633105040 CET	50062	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:58.638236046 CET	32583	50062	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:59.207906008 CET	32583	50062	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:59.207971096 CET	50062	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:59.208420038 CET	50062	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:59.216890097 CET	32583	50062	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:59.845670938 CET	50063	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:59.851084948 CET	32583	50063	198.23.227.212	192.168.2.9
Nov 6, 2024 16:14:59.851172924 CET	50063	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:59.854706049 CET	50063	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:14:59.859699965 CET	32583	50063	198.23.227.212	192.168.2.9
Nov 6, 2024 16:15:00.366837025 CET	32583	50063	198.23.227.212	192.168.2.9
Nov 6, 2024 16:15:00.367017031 CET	50063	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:15:00.367120028 CET	50063	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:15:00.371993065 CET	32583	50063	198.23.227.212	192.168.2.9
Nov 6, 2024 16:15:00.739875078 CET	50064	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:15:00.744899035 CET	32583	50064	198.23.227.212	192.168.2.9
Nov 6, 2024 16:15:00.744965076 CET	50064	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:15:00.764987946 CET	50064	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:15:00.770224094 CET	32583	50064	198.23.227.212	192.168.2.9
Nov 6, 2024 16:15:01.251362085 CET	32583	50064	198.23.227.212	192.168.2.9
Nov 6, 2024 16:15:01.251431942 CET	50064	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:15:01.251569986 CET	50064	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:15:01.256398916 CET	32583	50064	198.23.227.212	192.168.2.9
Nov 6, 2024 16:15:02.120491982 CET	50065	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:15:02.125488043 CET	32583	50065	198.23.227.212	192.168.2.9
Nov 6, 2024 16:15:02.125557899 CET	50065	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:15:02.129394054 CET	50065	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:15:02.134363890 CET	32583	50065	198.23.227.212	192.168.2.9
Nov 6, 2024 16:15:02.632705927 CET	32583	50065	198.23.227.212	192.168.2.9
Nov 6, 2024 16:15:02.632755995 CET	50065	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:15:02.632900953 CET	50065	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:15:02.639044046 CET	32583	50065	198.23.227.212	192.168.2.9
Nov 6, 2024 16:15:02.969309092 CET	50066	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:15:02.974407911 CET	32583	50066	198.23.227.212	192.168.2.9
Nov 6, 2024 16:15:02.974504948 CET	50066	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:15:02.978024006 CET	50066	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:15:02.983063936 CET	32583	50066	198.23.227.212	192.168.2.9
Nov 6, 2024 16:15:03.483925104 CET	32583	50066	198.23.227.212	192.168.2.9
Nov 6, 2024 16:15:03.484072924 CET	50066	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:15:03.484294891 CET	50066	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:15:03.489634991 CET	32583	50066	198.23.227.212	192.168.2.9
Nov 6, 2024 16:15:03.840723038 CET	50067	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:15:03.845618963 CET	32583	50067	198.23.227.212	192.168.2.9
Nov 6, 2024 16:15:03.847345114 CET	50067	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:15:03.850924969 CET	50067	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:15:03.855844021 CET	32583	50067	198.23.227.212	192.168.2.9
Nov 6, 2024 16:15:04.356448889 CET	32583	50067	198.23.227.212	192.168.2.9
Nov 6, 2024 16:15:04.356513023 CET	50067	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:15:04.356724024 CET	50067	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:15:04.361572027 CET	32583	50067	198.23.227.212	192.168.2.9
Nov 6, 2024 16:15:04.722619057 CET	50068	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:15:04.727509022 CET	32583	50068	198.23.227.212	192.168.2.9
Nov 6, 2024 16:15:04.727583885 CET	50068	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:15:04.731071949 CET	50068	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:15:04.735847950 CET	32583	50068	198.23.227.212	192.168.2.9
Nov 6, 2024 16:15:05.243626118 CET	32583	50068	198.23.227.212	192.168.2.9
Nov 6, 2024 16:15:05.244012117 CET	50068	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:15:05.365453959 CET	50068	32583	192.168.2.9	198.23.227.212
Nov 6, 2024 16:15:05.370750904 CET	32583	50068	198.23.227.212	192.168.2.9

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 6, 2024 16:12:54.064246893 CET	1.1.1.1	192.168.2.9	0x4c2	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 6, 2024 16:12:54.064246893 CET	1.1.1.1	192.168.2.9	0x4c2	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false

Target ID:	0
Start time:	10:12:56
Start date:	06/11/2024
Path:	C:\Users\user\Desktop\YESOHDKMIm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\YESOHDKMIm.exe"
Imagebase:	0x400000
File size:	507'904 bytes
MD5 hash:	F9294A439C591BBA283F7C6D9ED5AA37
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000000.00000002.1496727546.0000000002110000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000000.00000002.1496387665.0000000000694000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000000.00000002.1496784989.0000000002160000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000000.00000002.1496784989.0000000002160000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000000.00000002.1496784989.0000000002160000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000000.00000002.1496784989.0000000002160000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000000.00000002.1496784989.0000000002160000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000000.00000003.1352037586.00000000021E0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000000.00000003.1352037586.00000000021E0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000000.00000003.1352037586.00000000021E0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000000.00000003.1352037586.00000000021E0000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: REMCOS_RAT_variants, Description: unknown, Source: 00000000.00000003.1352037586.00000000021E0000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM, Description: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003), Source: 00000000.00000003.1352037586.00000000021E0000.00000004.00001000.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000000.00000002.1496029203.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000000.00000002.1496029203.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000000.00000002.1496029203.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000000.00000002.1496029203.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Author: unknown Rule: REMCOS_RAT_variants, Description: unknown, Source: 00000000.00000002.1496029203.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Author: unknown Rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM, Description: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003), Source: 00000000.00000002.1496029203.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	true

Target ID:	4
Start time:	10:12:58
Start date:	06/11/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 2804 -s 992
Imagebase:	0xf30000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	6
Start time:	10:12:59
Start date:	06/11/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 2804 -s 1132
Imagebase:	0xf30000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	8
Start time:	10:12:59
Start date:	06/11/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 2804 -s 1128
Imagebase:	0xf30000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	10
Start time:	10:13:00
Start date:	06/11/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 2804 -s 1156
Imagebase:	0xf30000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	12
Start time:	10:13:01
Start date:	06/11/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 2804 -s 1156
Imagebase:	0xf30000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	14
Start time:	10:13:02
Start date:	06/11/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 2804 -s 1136
Imagebase:	0xf30000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	15
Start time:	10:13:03
Start date:	06/11/2024
Path:	C:\Users\user\AppData\Roaming\yavascript.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\yavascript.exe"
Imagebase:	0x400000
File size:	507'904 bytes
MD5 hash:	F9294A439C591BBA283F7C6D9ED5AA37
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 0000000F.00000002.2618326835.0000000000814000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 0000000F.00000002.2617952063.0000000000760000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 0000000F.00000002.2617261877.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 0000000F.00000002.2617261877.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 0000000F.00000002.2617261877.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 0000000F.00000002.2617261877.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Author: unknown Rule: REMCOS_RAT_variants, Description: unknown, Source: 0000000F.00000002.2617261877.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Author: unknown Rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM, Description: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003), Source: 0000000F.00000002.2617261877.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Author: ditekSHen Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 0000000F.00000003.1433585955.0000000002280000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 0000000F.00000003.1433585955.0000000002280000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 0000000F.00000003.1433585955.0000000002280000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 0000000F.00000003.1433585955.0000000002280000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: REMCOS_RAT_variants, Description: unknown, Source: 0000000F.00000003.1433585955.0000000002280000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM, Description: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003), Source: 0000000F.00000003.1433585955.0000000002280000.00000004.00001000.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 0000000F.00000002.2618536470.0000000002090000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 0000000F.00000002.2618536470.0000000002090000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 0000000F.00000002.2618536470.0000000002090000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 0000000F.00000002.2618536470.0000000002090000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 0000000F.00000002.2618536470.0000000002090000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Antivirus matches:	Detection: 61%, ReversingLabs
Reputation:	low
Has exited:	false

Target ID:	17
Start time:	10:13:04
Start date:	06/11/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 2804 -s 968
Imagebase:	0xf30000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	20
Start time:	10:13:05
Start date:	06/11/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7148 -s 680
Imagebase:	0xf30000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	22
Start time:	10:13:06
Start date:	06/11/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7148 -s 708
Imagebase:	0xf30000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	24
Start time:	10:13:07
Start date:	06/11/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7148 -s 688
Imagebase:	0xf30000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	25
Start time:	10:13:07
Start date:	06/11/2024
Path:	C:\Users\user\AppData\Roaming\yavascript.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\yavascript.exe"
Imagebase:	0x400000
File size:	507'904 bytes
MD5 hash:	F9294A439C591BBA283F7C6D9ED5AA37
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000019.00000002.1539850016.0000000000750000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000019.00000002.1539911339.00000000007BA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000019.00000003.1473498633.0000000002210000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000019.00000003.1473498633.0000000002210000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000019.00000003.1473498633.0000000002210000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000019.00000003.1473498633.0000000002210000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: REMCOS_RAT_variants, Description: unknown, Source: 00000019.00000003.1473498633.0000000002210000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM, Description: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003), Source: 00000019.00000003.1473498633.0000000002210000.00000004.00001000.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000019.00000002.1539311942.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000019.00000002.1539311942.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000019.00000002.1539311942.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000019.00000002.1539311942.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Author: unknown Rule: REMCOS_RAT_variants, Description: unknown, Source: 00000019.00000002.1539311942.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Author: unknown Rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM, Description: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003), Source: 00000019.00000002.1539311942.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Author: ditekSHen Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000019.00000002.1540122253.0000000002190000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000019.00000002.1540122253.0000000002190000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000019.00000002.1540122253.0000000002190000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000019.00000002.1540122253.0000000002190000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000019.00000002.1540122253.0000000002190000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Has exited:	true

Target ID:	27
Start time:	10:13:08
Start date:	06/11/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7148 -s 680
Imagebase:	0xf30000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	30
Start time:	10:13:09
Start date:	06/11/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 3236 -s 584
Imagebase:	0xf30000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	31
Start time:	10:13:10
Start date:	06/11/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7148 -s 732
Imagebase:	0xf30000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	34
Start time:	10:13:11
Start date:	06/11/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7148 -s 728
Imagebase:	0xf30000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	36
Start time:	10:13:12
Start date:	06/11/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7148 -s 736
Imagebase:	0xf30000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	38
Start time:	10:13:13
Start date:	06/11/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7148 -s 732
Imagebase:	0xf30000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true