Windows Analysis Report
E84Ddy7gSh.exe

AI detected suspicious sample

Source: Yara match	File source: 16.3.yava_vd.exe.2fc0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.2.yava_vd.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.E84Ddy7gSh.exe.4820e67.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.yava_vd.exe.2c40e67.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.2.yava_vd.exe.2d20e67.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.E84Ddy7gSh.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.2.yava_vd.exe.2d20e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.E84Ddy7gSh.exe.48a0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.yava_vd.exe.2c40e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.yava_vd.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.yava_vd.exe.2e50e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.yava_vd.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.yava_vd.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.E84Ddy7gSh.exe.4820e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.3.yava_vd.exe.3110000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.yava_vd.exe.2e50e67.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.yava_vd.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.E84Ddy7gSh.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.3.yava_vd.exe.4940000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.2.yava_vd.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.3.yava_vd.exe.3110000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.E84Ddy7gSh.exe.48a0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.3.yava_vd.exe.4940000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.3.yava_vd.exe.2fc0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000021.00000002.2367590433.0000000002E1F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.2340121187.0000000002F6F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000003.2171817670.0000000004940000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2314578868.0000000002D4B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.4401297367.0000000002D4C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.2338776222.0000000000400000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000003.2101181064.0000000002FC0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000002.2367461787.0000000002D20000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.4399861671.0000000000400000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1977291270.00000000048A0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.4401153670.0000000002C40000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.2340023233.0000000002E50000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000002.2366150598.0000000000400000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2313081255.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2314933519.0000000004820000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000003.2264223239.0000000003110000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: E84Ddy7gSh.exe PID: 1544, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: yava_vd.exe PID: 3520, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: yava_vd.exe PID: 6308, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: yava_vd.exe PID: 2564, type: MEMORYSTR

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: E84Ddy7gSh.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Code function: 0_2_004338C8 CryptAcquireContextA,CryptGenRandom,CryptReleaseContext,	0_2_004338C8
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Code function: 0_2_04853B2F CryptAcquireContextA,CryptGenRandom,CryptReleaseContext,	0_2_04853B2F
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 16_2_004338C8 CryptAcquireContextA,CryptGenRandom,CryptReleaseContext,	16_2_004338C8
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 16_2_02C73B2F CryptAcquireContextA,CryptGenRandom,CryptReleaseContext,	16_2_02C73B2F
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 21_2_004338C8 CryptAcquireContextA,CryptGenRandom,CryptReleaseContext,	21_2_004338C8
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 21_2_02E83B2F CryptAcquireContextA,CryptGenRandom,CryptReleaseContext,	21_2_02E83B2F

Source: E84Ddy7gSh.exe

Binary or memory string: -----BEGIN PUBLIC KEY-----

Exploits

Yara detected UAC Bypass using CMSTP

Source: Yara match	File source: 16.3.yava_vd.exe.2fc0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.2.yava_vd.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.E84Ddy7gSh.exe.4820e67.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.yava_vd.exe.2c40e67.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.2.yava_vd.exe.2d20e67.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.E84Ddy7gSh.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.2.yava_vd.exe.2d20e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.E84Ddy7gSh.exe.48a0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.yava_vd.exe.2c40e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.yava_vd.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.yava_vd.exe.2e50e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.yava_vd.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.yava_vd.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.E84Ddy7gSh.exe.4820e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.3.yava_vd.exe.3110000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.yava_vd.exe.2e50e67.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.yava_vd.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.E84Ddy7gSh.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.3.yava_vd.exe.4940000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.2.yava_vd.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.3.yava_vd.exe.3110000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.E84Ddy7gSh.exe.48a0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.3.yava_vd.exe.4940000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.3.yava_vd.exe.2fc0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000015.00000003.2171817670.0000000004940000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.2338776222.0000000000400000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000003.2101181064.0000000002FC0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000002.2367461787.0000000002D20000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.4399861671.0000000000400000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1977291270.00000000048A0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.4401153670.0000000002C40000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.2340023233.0000000002E50000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000002.2366150598.0000000000400000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2313081255.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2314933519.0000000004820000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000003.2264223239.0000000003110000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: E84Ddy7gSh.exe PID: 1544, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: yava_vd.exe PID: 3520, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: yava_vd.exe PID: 6308, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: yava_vd.exe PID: 2564, type: MEMORYSTR

Privilege Escalation

Contains functionality to bypass UAC (CMSTPLUA)

Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Code function: 0_2_00407538 _wcslen,CoGetObject,	0_2_00407538
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 16_2_00407538 _wcslen,CoGetObject,	16_2_00407538
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 21_2_00407538 _wcslen,CoGetObject,	21_2_00407538

Source: E84Ddy7gSh.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\E84Ddy7gSh.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Suricata IDS alerts for network traffic

Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Code function: 0_2_0040928E __EH_prolog,__CxxThrowException@8,FindFirstFileW,FindNextFileW,FindClose,FindClose,	0_2_0040928E
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Code function: 0_2_0041C322 FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,RemoveDirectoryW,FindClose,	0_2_0041C322
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Code function: 0_2_0040C388 FindFirstFileW,PathFileExistsW,FindNextFileW,FindClose,FindClose,	0_2_0040C388
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Code function: 0_2_004096A0 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,	0_2_004096A0
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Code function: 0_2_00408847 __EH_prolog,FindFirstFileW,__CxxThrowException@8,FindNextFileW,FindClose,	0_2_00408847
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Code function: 0_2_00407877 FindFirstFileW,FindNextFileW,	0_2_00407877
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Code function: 0_2_0040BB6B FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,	0_2_0040BB6B
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Code function: 0_2_00419B86 FindFirstFileW,FindNextFileW,FindNextFileW,	0_2_00419B86
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Code function: 0_2_0040BD72 FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,	0_2_0040BD72
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Code function: 0_2_0483C589 FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,RemoveDirectoryW,FindClose,	0_2_0483C589
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Code function: 0_2_0482C5EF FindFirstFileW,PathFileExistsW,FindNextFileW,FindClose,FindClose,	0_2_0482C5EF
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Code function: 0_2_0482BDD2 FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,	0_2_0482BDD2
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Code function: 0_2_04839DED FindFirstFileW,	0_2_04839DED
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Code function: 0_2_04829907 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,	0_2_04829907
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Code function: 0_2_04828AAE __EH_prolog,FindFirstFileW,__CxxThrowException@8,FindNextFileW,FindClose,	0_2_04828AAE
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Code function: 0_2_04827ADE FindFirstFileW,FindNextFileW,	0_2_04827ADE
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 16_2_0040928E __EH_prolog,__CxxThrowException@8,FindFirstFileW,FindNextFileW,FindClose,FindClose,	16_2_0040928E
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 16_2_0041C322 FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,RemoveDirectoryW,FindClose,	16_2_0041C322
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 16_2_0040C388 FindFirstFileW,PathFileExistsW,FindNextFileW,FindClose,FindClose,	16_2_0040C388
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 16_2_004096A0 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,	16_2_004096A0
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 16_2_00408847 __EH_prolog,FindFirstFileW,__CxxThrowException@8,FindNextFileW,FindClose,	16_2_00408847
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 16_2_00407877 FindFirstFileW,FindNextFileW,	16_2_00407877
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 16_2_0040BB6B FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,	16_2_0040BB6B
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 16_2_00419B86 FindFirstFileW,FindNextFileW,FindNextFileW,	16_2_00419B86
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 16_2_0040BD72 FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,	16_2_0040BD72
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 16_2_02C4C5EF FindFirstFileW,PathFileExistsW,FindNextFileW,FindClose,FindClose,	16_2_02C4C5EF
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 16_2_02C5C589 FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,RemoveDirectoryW,FindClose,	16_2_02C5C589
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 16_2_02C47ADE FindFirstFileW,FindNextFileW,	16_2_02C47ADE
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 16_2_02C48AAE __EH_prolog,FindFirstFileW,__CxxThrowException@8,FindNextFileW,FindClose,	16_2_02C48AAE
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 16_2_02C49907 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,	16_2_02C49907
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 16_2_02C4BDD2 FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,	16_2_02C4BDD2
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 16_2_02C59DED FindFirstFileW,	16_2_02C59DED
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 21_2_0040928E __EH_prolog,__CxxThrowException@8,FindFirstFileW,FindNextFileW,FindClose,FindClose,	21_2_0040928E
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 21_2_0041C322 FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,RemoveDirectoryW,FindClose,	21_2_0041C322
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 21_2_0040C388 FindFirstFileW,PathFileExistsW,FindNextFileW,FindClose,FindClose,	21_2_0040C388
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 21_2_004096A0 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,	21_2_004096A0
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 21_2_00408847 __EH_prolog,FindFirstFileW,__CxxThrowException@8,FindNextFileW,FindClose,	21_2_00408847
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 21_2_00407877 FindFirstFileW,FindNextFileW,	21_2_00407877
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 21_2_0040BB6B FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,	21_2_0040BB6B
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 21_2_00419B86 FindFirstFileW,FindNextFileW,FindNextFileW,	21_2_00419B86
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 21_2_0040BD72 FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,	21_2_0040BD72
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 21_2_02E5C5EF FindFirstFileW,PathFileExistsW,FindNextFileW,FindClose,FindClose,	21_2_02E5C5EF
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 21_2_02E6C589 FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,RemoveDirectoryW,FindClose,	21_2_02E6C589
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 21_2_02E57ADE FindFirstFileW,FindNextFileW,	21_2_02E57ADE
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 21_2_02E58AAE __EH_prolog,FindFirstFileW,__CxxThrowException@8,FindNextFileW,FindClose,	21_2_02E58AAE
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 21_2_02E59907 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,	21_2_02E59907
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 21_2_02E69DED FindFirstFileW,	21_2_02E69DED
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 21_2_02E5BDD2 FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,	21_2_02E5BDD2

Source: C:\Users\user\Desktop\E84Ddy7gSh.exe

Code function: 0_2_00407CD2 SetEvent,GetFileAttributesW,DeleteFileW,ShellExecuteW,GetLogicalDriveStringsA,SetFileAttributesW,DeleteFileA,Sleep,StrToIntA,CreateDirectoryW,

0_2_00407CD2

Networking

Source: Network traffic

Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.4:49734 -> 198.23.227.212:32583

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: 27.212

Source: global traffic

TCP traffic: 192.168.2.4:49734 -> 198.23.227.212:32583

Source: global traffic

HTTP traffic detected: GET /json.gp HTTP/1.1Host: geoplugin.netCache-Control: no-cache

Source: Joe Sandbox View	IP Address: 198.23.227.212 198.23.227.212
Source: Joe Sandbox View	IP Address: 178.237.33.50 178.237.33.50

Source: Joe Sandbox View

ASN Name: AS-COLOCROSSINGUS AS-COLOCROSSINGUS

Source: Network traffic

Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.4:49752 -> 178.237.33.50:80

Source: unknown	TCP traffic detected without corresponding DNS query: 198.23.227.212
Source: unknown	TCP traffic detected without corresponding DNS query: 198.23.227.212
Source: unknown	TCP traffic detected without corresponding DNS query: 198.23.227.212
Source: unknown	TCP traffic detected without corresponding DNS query: 198.23.227.212
Source: unknown	TCP traffic detected without corresponding DNS query: 198.23.227.212
Source: unknown	TCP traffic detected without corresponding DNS query: 198.23.227.212
Source: unknown	TCP traffic detected without corresponding DNS query: 198.23.227.212
Source: unknown	TCP traffic detected without corresponding DNS query: 198.23.227.212
Source: unknown	TCP traffic detected without corresponding DNS query: 198.23.227.212
Source: unknown	TCP traffic detected without corresponding DNS query: 198.23.227.212
Source: unknown	TCP traffic detected without corresponding DNS query: 198.23.227.212
Source: unknown	TCP traffic detected without corresponding DNS query: 198.23.227.212
Source: unknown	TCP traffic detected without corresponding DNS query: 198.23.227.212
Source: unknown	TCP traffic detected without corresponding DNS query: 198.23.227.212
Source: unknown	TCP traffic detected without corresponding DNS query: 198.23.227.212
Source: unknown	TCP traffic detected without corresponding DNS query: 198.23.227.212
Source: unknown	TCP traffic detected without corresponding DNS query: 198.23.227.212
Source: unknown	TCP traffic detected without corresponding DNS query: 198.23.227.212
Source: unknown	TCP traffic detected without corresponding DNS query: 198.23.227.212
Source: unknown	TCP traffic detected without corresponding DNS query: 198.23.227.212
Source: unknown	TCP traffic detected without corresponding DNS query: 198.23.227.212
Source: unknown	TCP traffic detected without corresponding DNS query: 198.23.227.212
Source: unknown	TCP traffic detected without corresponding DNS query: 198.23.227.212
Source: unknown	TCP traffic detected without corresponding DNS query: 198.23.227.212
Source: unknown	TCP traffic detected without corresponding DNS query: 198.23.227.212
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\E84Ddy7gSh.exe

Code function: 0_2_0041B411 InternetOpenW,InternetOpenUrlW,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

0_2_0041B411

Source: global traffic

HTTP traffic detected: GET /json.gp HTTP/1.1Host: geoplugin.netCache-Control: no-cache

Source: global traffic

DNS traffic detected: DNS query: geoplugin.net

Source: yava_vd.exe, 00000010.00000003.2314673167.0000000002DA0000.00000004.00000020.00020000.00000000.sdmp, yava_vd.exe, 00000010.00000003.2314858832.0000000002DB0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/
Source: yava_vd.exe	String found in binary or memory: http://geoplugin.net/json.gp
Source: yava_vd.exe, 00000010.00000003.2314673167.0000000002D7F000.00000004.00000020.00020000.00000000.sdmp, yava_vd.exe, 00000010.00000002.4401297367.0000000002D7F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/json.gp#
Source: yava_vd.exe, 00000010.00000003.2314673167.0000000002D7F000.00000004.00000020.00020000.00000000.sdmp, yava_vd.exe, 00000010.00000002.4401297367.0000000002D7F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/json.gp&
Source: E84Ddy7gSh.exe, 00000000.00000003.1977291270.00000000048A0000.00000004.00001000.00020000.00000000.sdmp, E84Ddy7gSh.exe, 00000000.00000002.2314933519.0000000004820000.00000040.00001000.00020000.00000000.sdmp, E84Ddy7gSh.exe, 00000000.00000002.2313081255.0000000000400000.00000040.00000001.01000000.00000003.sdmp, yava_vd.exe, 00000010.00000002.4399861671.0000000000400000.00000040.00000001.01000000.00000007.sdmp, yava_vd.exe, 00000010.00000003.2101181064.0000000002FC0000.00000004.00001000.00020000.00000000.sdmp, yava_vd.exe, 00000010.00000002.4401153670.0000000002C40000.00000040.00001000.00020000.00000000.sdmp, yava_vd.exe, 00000015.00000003.2171817670.0000000004940000.00000004.00001000.00020000.00000000.sdmp, yava_vd.exe, 00000015.00000002.2338776222.0000000000400000.00000040.00000001.01000000.00000007.sdmp, yava_vd.exe, 00000015.00000002.2340023233.0000000002E50000.00000040.00001000.00020000.00000000.sdmp, yava_vd.exe, 00000021.00000002.2367461787.0000000002D20000.00000040.00001000.00020000.00000000.sdmp, yava_vd.exe, 00000021.00000003.2264223239.0000000003110000.00000004.00001000.00020000.00000000.sdmp, yava_vd.exe, 00000021.00000002.2366150598.0000000000400000.00000040.00000001.01000000.00000007.sdmp	String found in binary or memory: http://geoplugin.net/json.gp/C
Source: yava_vd.exe, 00000010.00000003.2314673167.0000000002D7F000.00000004.00000020.00020000.00000000.sdmp, yava_vd.exe, 00000010.00000002.4401297367.0000000002D7F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/json.gp7
Source: yava_vd.exe, 00000010.00000003.2314673167.0000000002D7F000.00000004.00000020.00020000.00000000.sdmp, yava_vd.exe, 00000010.00000002.4401297367.0000000002D7F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/json.gp=
Source: yava_vd.exe, 00000010.00000002.4401297367.0000000002D4C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/json.gpSystem32
Source: Amcache.hve.3.dr	String found in binary or memory: http://upx.sf.net

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to register a low level keyboard hook

Source: C:\Users\user\Desktop\E84Ddy7gSh.exe

Code function: 0_2_0040A2F3 SetWindowsHookExA 0000000D,0040A2DF,00000000

0_2_0040A2F3

Source: C:\Users\user\Desktop\E84Ddy7gSh.exe

Code function: 0_2_0040B749 OpenClipboard,GetClipboardData,CloseClipboard,

0_2_0040B749

Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Code function: 0_2_004168FC OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,SetClipboardData,CloseClipboard,OpenClipboard,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,	0_2_004168FC
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 16_2_004168FC OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,SetClipboardData,CloseClipboard,OpenClipboard,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,	16_2_004168FC
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 21_2_004168FC OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,SetClipboardData,CloseClipboard,OpenClipboard,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,	21_2_004168FC

Source: C:\Users\user\Desktop\E84Ddy7gSh.exe

Code function: 0_2_0040B749 OpenClipboard,GetClipboardData,CloseClipboard,

0_2_0040B749

Source: C:\Users\user\Desktop\E84Ddy7gSh.exe

Code function: 0_2_0040A41B GetForegroundWindow,GetWindowThreadProcessId,GetKeyboardLayout,GetKeyState,GetKeyboardState,ToUnicodeEx,ToUnicodeEx,ToUnicodeEx,ToUnicodeEx,

0_2_0040A41B

Source: Yara match	File source: 16.3.yava_vd.exe.2fc0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.2.yava_vd.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.E84Ddy7gSh.exe.4820e67.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.yava_vd.exe.2c40e67.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.2.yava_vd.exe.2d20e67.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.E84Ddy7gSh.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.2.yava_vd.exe.2d20e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.E84Ddy7gSh.exe.48a0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.yava_vd.exe.2c40e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.yava_vd.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.yava_vd.exe.2e50e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.yava_vd.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.yava_vd.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.E84Ddy7gSh.exe.4820e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.3.yava_vd.exe.3110000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.yava_vd.exe.2e50e67.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.yava_vd.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.E84Ddy7gSh.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.3.yava_vd.exe.4940000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.2.yava_vd.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.3.yava_vd.exe.3110000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.E84Ddy7gSh.exe.48a0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.3.yava_vd.exe.4940000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.3.yava_vd.exe.2fc0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000015.00000003.2171817670.0000000004940000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.2338776222.0000000000400000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000003.2101181064.0000000002FC0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000002.2367461787.0000000002D20000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.4399861671.0000000000400000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1977291270.00000000048A0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.4401153670.0000000002C40000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.2340023233.0000000002E50000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000002.2366150598.0000000000400000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2313081255.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2314933519.0000000004820000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000003.2264223239.0000000003110000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: E84Ddy7gSh.exe PID: 1544, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: yava_vd.exe PID: 3520, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: yava_vd.exe PID: 6308, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: yava_vd.exe PID: 2564, type: MEMORYSTR

E-Banking Fraud

Contains functionalty to change the wallpaper

Source: Yara match	File source: 16.3.yava_vd.exe.2fc0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.2.yava_vd.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.E84Ddy7gSh.exe.4820e67.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.yava_vd.exe.2c40e67.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.2.yava_vd.exe.2d20e67.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.E84Ddy7gSh.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.2.yava_vd.exe.2d20e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.E84Ddy7gSh.exe.48a0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.yava_vd.exe.2c40e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.yava_vd.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.yava_vd.exe.2e50e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.yava_vd.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.yava_vd.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.E84Ddy7gSh.exe.4820e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.3.yava_vd.exe.3110000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.yava_vd.exe.2e50e67.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.yava_vd.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.E84Ddy7gSh.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.3.yava_vd.exe.4940000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.2.yava_vd.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.3.yava_vd.exe.3110000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.E84Ddy7gSh.exe.48a0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.3.yava_vd.exe.4940000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.3.yava_vd.exe.2fc0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000021.00000002.2367590433.0000000002E1F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.2340121187.0000000002F6F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000003.2171817670.0000000004940000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2314578868.0000000002D4B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.4401297367.0000000002D4C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.2338776222.0000000000400000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000003.2101181064.0000000002FC0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000002.2367461787.0000000002D20000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.4399861671.0000000000400000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1977291270.00000000048A0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.4401153670.0000000002C40000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.2340023233.0000000002E50000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000002.2366150598.0000000000400000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2313081255.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2314933519.0000000004820000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000003.2264223239.0000000003110000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: E84Ddy7gSh.exe PID: 1544, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: yava_vd.exe PID: 3520, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: yava_vd.exe PID: 6308, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: yava_vd.exe PID: 2564, type: MEMORYSTR

Spam, unwanted Advertisements and Ransom Demands

Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Code function: 0_2_0041CA6D SystemParametersInfoW,	0_2_0041CA6D
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Code function: 0_2_0041CA73 SystemParametersInfoW,	0_2_0041CA73
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Code function: 0_2_0483CCD4 SystemParametersInfoW,	0_2_0483CCD4
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Code function: 0_2_0483CCDA SystemParametersInfoW,	0_2_0483CCDA
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 16_2_0041CA6D SystemParametersInfoW,	16_2_0041CA6D
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 16_2_0041CA73 SystemParametersInfoW,	16_2_0041CA73
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 16_2_02C5CCD4 SystemParametersInfoW,	16_2_02C5CCD4
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 16_2_02C5CCDA SystemParametersInfoW,	16_2_02C5CCDA
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 21_2_0041CA6D SystemParametersInfoW,	21_2_0041CA6D
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 21_2_0041CA73 SystemParametersInfoW,	21_2_0041CA73
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 21_2_02E6CCD4 SystemParametersInfoW,	21_2_02E6CCD4
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 21_2_02E6CCDA SystemParametersInfoW,	21_2_02E6CCDA

System Summary

Malicious sample detected (through community Yara rule)

Source: 16.3.yava_vd.exe.2fc0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 16.3.yava_vd.exe.2fc0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 16.3.yava_vd.exe.2fc0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 33.2.yava_vd.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 33.2.yava_vd.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 33.2.yava_vd.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 0.2.E84Ddy7gSh.exe.4820e67.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 0.2.E84Ddy7gSh.exe.4820e67.1.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 0.2.E84Ddy7gSh.exe.4820e67.1.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 16.2.yava_vd.exe.2c40e67.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 16.2.yava_vd.exe.2c40e67.1.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 16.2.yava_vd.exe.2c40e67.1.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 33.2.yava_vd.exe.2d20e67.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 33.2.yava_vd.exe.2d20e67.1.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 33.2.yava_vd.exe.2d20e67.1.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 0.2.E84Ddy7gSh.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 0.2.E84Ddy7gSh.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 0.2.E84Ddy7gSh.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 33.2.yava_vd.exe.2d20e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 33.2.yava_vd.exe.2d20e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 33.2.yava_vd.exe.2d20e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 0.3.E84Ddy7gSh.exe.48a0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 0.3.E84Ddy7gSh.exe.48a0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 0.3.E84Ddy7gSh.exe.48a0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 16.2.yava_vd.exe.2c40e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 16.2.yava_vd.exe.2c40e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 16.2.yava_vd.exe.2c40e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 21.2.yava_vd.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 21.2.yava_vd.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 21.2.yava_vd.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 21.2.yava_vd.exe.2e50e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 21.2.yava_vd.exe.2e50e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 21.2.yava_vd.exe.2e50e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 21.2.yava_vd.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 21.2.yava_vd.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 21.2.yava_vd.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 16.2.yava_vd.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 16.2.yava_vd.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 16.2.yava_vd.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 0.2.E84Ddy7gSh.exe.4820e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 0.2.E84Ddy7gSh.exe.4820e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 0.2.E84Ddy7gSh.exe.4820e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 33.3.yava_vd.exe.3110000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 33.3.yava_vd.exe.3110000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 33.3.yava_vd.exe.3110000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 21.2.yava_vd.exe.2e50e67.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 21.2.yava_vd.exe.2e50e67.1.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 21.2.yava_vd.exe.2e50e67.1.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 16.2.yava_vd.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 16.2.yava_vd.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 16.2.yava_vd.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 0.2.E84Ddy7gSh.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 0.2.E84Ddy7gSh.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 0.2.E84Ddy7gSh.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 21.3.yava_vd.exe.4940000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 21.3.yava_vd.exe.4940000.0.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 21.3.yava_vd.exe.4940000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 33.2.yava_vd.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 33.2.yava_vd.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 33.2.yava_vd.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 33.3.yava_vd.exe.3110000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 33.3.yava_vd.exe.3110000.0.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 33.3.yava_vd.exe.3110000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 0.3.E84Ddy7gSh.exe.48a0000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 0.3.E84Ddy7gSh.exe.48a0000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 0.3.E84Ddy7gSh.exe.48a0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 21.3.yava_vd.exe.4940000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 21.3.yava_vd.exe.4940000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 21.3.yava_vd.exe.4940000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 16.3.yava_vd.exe.2fc0000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 16.3.yava_vd.exe.2fc0000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 16.3.yava_vd.exe.2fc0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 00000021.00000002.2367559880.0000000002DDA000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000000.00000002.2314536540.0000000002D07000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000010.00000002.4401266733.0000000002D07000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000015.00000003.2171817670.0000000004940000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 00000015.00000003.2171817670.0000000004940000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 00000015.00000003.2171817670.0000000004940000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 00000015.00000002.2340091843.0000000002F2A000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000015.00000002.2338776222.0000000000400000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 00000015.00000002.2338776222.0000000000400000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 00000015.00000002.2338776222.0000000000400000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 00000010.00000003.2101181064.0000000002FC0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 00000010.00000003.2101181064.0000000002FC0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 00000010.00000003.2101181064.0000000002FC0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 00000021.00000002.2367461787.0000000002D20000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 00000021.00000002.2367461787.0000000002D20000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000010.00000002.4399861671.0000000000400000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 00000010.00000002.4399861671.0000000000400000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 00000010.00000002.4399861671.0000000000400000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 00000000.00000003.1977291270.00000000048A0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 00000000.00000003.1977291270.00000000048A0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 00000000.00000003.1977291270.00000000048A0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 00000010.00000002.4401153670.0000000002C40000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 00000010.00000002.4401153670.0000000002C40000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000015.00000002.2340023233.0000000002E50000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 00000015.00000002.2340023233.0000000002E50000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000021.00000002.2366150598.0000000000400000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 00000000.00000002.2313081255.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 00000021.00000002.2366150598.0000000000400000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 00000000.00000002.2313081255.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 00000000.00000002.2313081255.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 00000021.00000002.2366150598.0000000000400000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 00000000.00000002.2314933519.0000000004820000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 00000000.00000002.2314933519.0000000004820000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000021.00000003.2264223239.0000000003110000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 00000021.00000003.2264223239.0000000003110000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 00000021.00000003.2264223239.0000000003110000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: Process Memory Space: E84Ddy7gSh.exe PID: 1544, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: Process Memory Space: yava_vd.exe PID: 3520, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: Process Memory Space: yava_vd.exe PID: 6308, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: Process Memory Space: yava_vd.exe PID: 2564, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown

Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Code function: 0_2_0041330D OpenProcess,NtQueryInformationProcess,GetCurrentProcess,DuplicateHandle,GetFinalPathNameByHandleW,CloseHandle,CreateFileMappingW,MapViewOfFile,GetFileSize,UnmapViewOfFile,CloseHandle,CloseHandle,CloseHandle,	0_2_0041330D
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Code function: 0_2_0041D620 NtdllDefWindowProc_A,GetCursorPos,SetForegroundWindow,TrackPopupMenu,IsWindowVisible,ShowWindow,ShowWindow,SetForegroundWindow,Shell_NotifyIcon,ExitProcess,CreatePopupMenu,AppendMenuA,	0_2_0041D620
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Code function: 0_2_0041BBC6 OpenProcess,NtResumeProcess,CloseHandle,	0_2_0041BBC6
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Code function: 0_2_0041BB9A OpenProcess,NtSuspendProcess,CloseHandle,	0_2_0041BB9A
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Code function: 0_2_04833574 OpenProcess,NtQueryInformationProcess,GetCurrentProcess,DuplicateHandle,GetFinalPathNameByHandleW,CloseHandle,CreateFileMappingW,MapViewOfFile,GetFileSize,UnmapViewOfFile,	0_2_04833574
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Code function: 0_2_0483BE01 OpenProcess,NtSuspendProcess,CloseHandle,	0_2_0483BE01
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Code function: 0_2_0483BE2D OpenProcess,NtResumeProcess,CloseHandle,	0_2_0483BE2D
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Code function: 0_2_0483D887 NtdllDefWindowProc_A,GetCursorPos,SetForegroundWindow,TrackPopupMenu,IsWindowVisible,ShowWindow,ShowWindow,SetForegroundWindow,Shell_NotifyIcon,ExitProcess,CreatePopupMenu,AppendMenuA,	0_2_0483D887
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 16_2_0041330D OpenProcess,NtQueryInformationProcess,GetCurrentProcess,DuplicateHandle,GetFinalPathNameByHandleW,CloseHandle,CreateFileMappingW,MapViewOfFile,GetFileSize,UnmapViewOfFile,CloseHandle,CloseHandle,CloseHandle,	16_2_0041330D
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 16_2_0041D620 NtdllDefWindowProc_A,GetCursorPos,SetForegroundWindow,TrackPopupMenu,IsWindowVisible,ShowWindow,ShowWindow,SetForegroundWindow,Shell_NotifyIcon,ExitProcess,CreatePopupMenu,AppendMenuA,	16_2_0041D620
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 16_2_0041BBC6 OpenProcess,NtResumeProcess,CloseHandle,	16_2_0041BBC6
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 16_2_0041BB9A OpenProcess,NtSuspendProcess,CloseHandle,	16_2_0041BB9A
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 16_2_02C53574 OpenProcess,NtQueryInformationProcess,GetCurrentProcess,DuplicateHandle,GetFinalPathNameByHandleW,CloseHandle,CreateFileMappingW,MapViewOfFile,GetFileSize,UnmapViewOfFile,	16_2_02C53574
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 16_2_02C5D887 NtdllDefWindowProc_A,GetCursorPos,SetForegroundWindow,TrackPopupMenu,IsWindowVisible,ShowWindow,ShowWindow,SetForegroundWindow,Shell_NotifyIcon,ExitProcess,CreatePopupMenu,AppendMenuA,	16_2_02C5D887
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 16_2_02C5BE01 OpenProcess,NtSuspendProcess,CloseHandle,	16_2_02C5BE01
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 16_2_02C5BE2D OpenProcess,NtResumeProcess,CloseHandle,	16_2_02C5BE2D
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 21_2_0041330D OpenProcess,NtQueryInformationProcess,GetCurrentProcess,DuplicateHandle,GetFinalPathNameByHandleW,CloseHandle,CreateFileMappingW,MapViewOfFile,GetFileSize,UnmapViewOfFile,CloseHandle,CloseHandle,CloseHandle,	21_2_0041330D
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 21_2_0041D620 NtdllDefWindowProc_A,GetCursorPos,SetForegroundWindow,TrackPopupMenu,IsWindowVisible,ShowWindow,ShowWindow,SetForegroundWindow,Shell_NotifyIcon,ExitProcess,CreatePopupMenu,AppendMenuA,	21_2_0041D620
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 21_2_0041BBC6 OpenProcess,NtResumeProcess,CloseHandle,	21_2_0041BBC6
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 21_2_0041BB9A OpenProcess,NtSuspendProcess,CloseHandle,	21_2_0041BB9A
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 21_2_02E63574 OpenProcess,NtQueryInformationProcess,GetCurrentProcess,DuplicateHandle,GetFinalPathNameByHandleW,CloseHandle,CreateFileMappingW,MapViewOfFile,GetFileSize,UnmapViewOfFile,	21_2_02E63574
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 21_2_02E6D887 NtdllDefWindowProc_A,GetCursorPos,SetForegroundWindow,TrackPopupMenu,IsWindowVisible,ShowWindow,ShowWindow,SetForegroundWindow,Shell_NotifyIcon,ExitProcess,CreatePopupMenu,AppendMenuA,	21_2_02E6D887
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 21_2_02E6BE2D OpenProcess,NtResumeProcess,CloseHandle,	21_2_02E6BE2D
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 21_2_02E6BE01 OpenProcess,NtSuspendProcess,CloseHandle,	21_2_02E6BE01

Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Code function: 0_2_004167EF ExitWindowsEx,LoadLibraryA,GetProcAddress,	0_2_004167EF
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Code function: 0_2_04836A5B ExitWindowsEx,LoadLibraryA,GetProcAddress,	0_2_04836A5B
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 16_2_004167EF ExitWindowsEx,LoadLibraryA,GetProcAddress,	16_2_004167EF
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 16_2_02C56A5B ExitWindowsEx,LoadLibraryA,GetProcAddress,	16_2_02C56A5B
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 21_2_004167EF ExitWindowsEx,LoadLibraryA,GetProcAddress,	21_2_004167EF
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 21_2_02E66A5B ExitWindowsEx,LoadLibraryA,GetProcAddress,	21_2_02E66A5B

Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Code function: 0_2_0043706A	0_2_0043706A
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Code function: 0_2_00414005	0_2_00414005
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Code function: 0_2_0043E11C	0_2_0043E11C
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Code function: 0_2_004541D9	0_2_004541D9
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Code function: 0_2_004381E8	0_2_004381E8
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Code function: 0_2_0041F18B	0_2_0041F18B
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Code function: 0_2_00446270	0_2_00446270
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Code function: 0_2_0043E34B	0_2_0043E34B
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Code function: 0_2_004533AB	0_2_004533AB
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Code function: 0_2_0042742E	0_2_0042742E
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Code function: 0_2_00437566	0_2_00437566
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Code function: 0_2_0043E5A8	0_2_0043E5A8
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Code function: 0_2_004387F0	0_2_004387F0
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Code function: 0_2_0043797E	0_2_0043797E
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Code function: 0_2_004339D7	0_2_004339D7
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Code function: 0_2_0044DA49	0_2_0044DA49
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Code function: 0_2_00427AD7	0_2_00427AD7
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Code function: 0_2_0041DBF3	0_2_0041DBF3
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Code function: 0_2_00427C40	0_2_00427C40
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Code function: 0_2_00437DB3	0_2_00437DB3
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Code function: 0_2_00435EEB	0_2_00435EEB
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Code function: 0_2_0043DEED	0_2_0043DEED
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Code function: 0_2_00426E9F	0_2_00426E9F
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Code function: 0_2_048664D7	0_2_048664D7
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Code function: 0_2_0485E5B2	0_2_0485E5B2
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Code function: 0_2_04847695	0_2_04847695
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Code function: 0_2_04873612	0_2_04873612
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Code function: 0_2_04847106	0_2_04847106
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Code function: 0_2_0485E154	0_2_0485E154
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Code function: 0_2_048572D1	0_2_048572D1
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Code function: 0_2_0485E383	0_2_0485E383
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Code function: 0_2_0483F3F2	0_2_0483F3F2
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Code function: 0_2_04853C3E	0_2_04853C3E
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Code function: 0_2_04847D3E	0_2_04847D3E
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Code function: 0_2_04847EA7	0_2_04847EA7
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Code function: 0_2_0483DE5A	0_2_0483DE5A
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Code function: 0_2_0485E80F	0_2_0485E80F
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Code function: 0_2_04858A57	0_2_04858A57
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 16_2_0043706A	16_2_0043706A
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 16_2_00414005	16_2_00414005
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 16_2_0043E11C	16_2_0043E11C
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 16_2_004541D9	16_2_004541D9
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 16_2_004381E8	16_2_004381E8
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 16_2_0041F18B	16_2_0041F18B
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 16_2_00446270	16_2_00446270
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 16_2_0043E34B	16_2_0043E34B
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 16_2_004533AB	16_2_004533AB
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 16_2_0042742E	16_2_0042742E
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 16_2_00437566	16_2_00437566
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 16_2_0043E5A8	16_2_0043E5A8
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 16_2_004387F0	16_2_004387F0
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 16_2_0043797E	16_2_0043797E
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 16_2_004339D7	16_2_004339D7
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 16_2_0044DA49	16_2_0044DA49
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 16_2_00427AD7	16_2_00427AD7
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 16_2_0041DBF3	16_2_0041DBF3
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 16_2_00427C40	16_2_00427C40
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 16_2_00437DB3	16_2_00437DB3
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 16_2_00435EEB	16_2_00435EEB
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 16_2_0043DEED	16_2_0043DEED
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 16_2_00426E9F	16_2_00426E9F
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 16_2_02C772D1	16_2_02C772D1
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 16_2_02C5F3F2	16_2_02C5F3F2
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 16_2_02C7E383	16_2_02C7E383
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 16_2_02C7E154	16_2_02C7E154
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 16_2_02C67106	16_2_02C67106
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 16_2_02C67695	16_2_02C67695
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 16_2_02C93612	16_2_02C93612
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 16_2_02C864D7	16_2_02C864D7
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 16_2_02C7E5B2	16_2_02C7E5B2
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 16_2_02C78A57	16_2_02C78A57
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 16_2_02C7E80F	16_2_02C7E80F
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 16_2_02C67EA7	16_2_02C67EA7
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 16_2_02C5DE5A	16_2_02C5DE5A
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 16_2_02C73C3E	16_2_02C73C3E
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 16_2_02C67D3E	16_2_02C67D3E
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 21_2_0043706A	21_2_0043706A
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 21_2_00414005	21_2_00414005
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 21_2_0043E11C	21_2_0043E11C
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 21_2_004541D9	21_2_004541D9
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 21_2_004381E8	21_2_004381E8
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 21_2_0041F18B	21_2_0041F18B
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 21_2_00446270	21_2_00446270
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 21_2_0043E34B	21_2_0043E34B
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 21_2_004533AB	21_2_004533AB
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 21_2_0042742E	21_2_0042742E
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 21_2_00437566	21_2_00437566
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 21_2_0043E5A8	21_2_0043E5A8
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 21_2_004387F0	21_2_004387F0
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 21_2_0043797E	21_2_0043797E
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 21_2_004339D7	21_2_004339D7
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 21_2_0044DA49	21_2_0044DA49
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 21_2_00427AD7	21_2_00427AD7
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 21_2_0041DBF3	21_2_0041DBF3
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 21_2_00427C40	21_2_00427C40
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 21_2_00437DB3	21_2_00437DB3
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 21_2_00435EEB	21_2_00435EEB
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 21_2_0043DEED	21_2_0043DEED
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 21_2_00426E9F	21_2_00426E9F
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 21_2_02E872D1	21_2_02E872D1
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 21_2_02E6F3F2	21_2_02E6F3F2
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 21_2_02E8E383	21_2_02E8E383
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 21_2_02E8E154	21_2_02E8E154
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 21_2_02E77106	21_2_02E77106
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 21_2_02E77695	21_2_02E77695
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 21_2_02EA3612	21_2_02EA3612
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 21_2_02E964D7	21_2_02E964D7
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 21_2_02E8E5B2	21_2_02E8E5B2
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 21_2_02E88A57	21_2_02E88A57
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 21_2_02E8E80F	21_2_02E8E80F
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 21_2_02E77EA7	21_2_02E77EA7
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 21_2_02E6DE5A	21_2_02E6DE5A
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 21_2_02E83C3E	21_2_02E83C3E
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 21_2_02E77D3E	21_2_02E77D3E

Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Code function: String function: 048550D7 appears 45 times
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Code function: String function: 00402093 appears 50 times
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Code function: String function: 00434801 appears 41 times
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Code function: String function: 04854A68 appears 41 times
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Code function: String function: 00401E65 appears 35 times
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Code function: String function: 00434E70 appears 54 times
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: String function: 0040417E appears 46 times
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: String function: 00434801 appears 82 times
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: String function: 00457AA8 appears 34 times
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: String function: 02E84A68 appears 41 times
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: String function: 00445951 appears 56 times
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: String function: 00402213 appears 38 times
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: String function: 004052FD appears 32 times
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: String function: 00434E70 appears 108 times
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: String function: 00401FAB appears 39 times
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: String function: 02C750D7 appears 45 times
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: String function: 00411FA2 appears 32 times
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: String function: 02C74A68 appears 41 times
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: String function: 00402093 appears 100 times
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: String function: 004020DF appears 40 times
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: String function: 004046F7 appears 34 times
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: String function: 00401E65 appears 69 times
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: String function: 0044854A appears 36 times
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: String function: 02E850D7 appears 45 times

Source: C:\Users\user\Desktop\E84Ddy7gSh.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 1544 -s 1072

Source: E84Ddy7gSh.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 16.3.yava_vd.exe.2fc0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 16.3.yava_vd.exe.2fc0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 16.3.yava_vd.exe.2fc0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 33.2.yava_vd.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 33.2.yava_vd.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 33.2.yava_vd.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 0.2.E84Ddy7gSh.exe.4820e67.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 0.2.E84Ddy7gSh.exe.4820e67.1.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 0.2.E84Ddy7gSh.exe.4820e67.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 16.2.yava_vd.exe.2c40e67.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 16.2.yava_vd.exe.2c40e67.1.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 16.2.yava_vd.exe.2c40e67.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 33.2.yava_vd.exe.2d20e67.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 33.2.yava_vd.exe.2d20e67.1.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 33.2.yava_vd.exe.2d20e67.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 0.2.E84Ddy7gSh.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 0.2.E84Ddy7gSh.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 0.2.E84Ddy7gSh.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 33.2.yava_vd.exe.2d20e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 33.2.yava_vd.exe.2d20e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 33.2.yava_vd.exe.2d20e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 0.3.E84Ddy7gSh.exe.48a0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 0.3.E84Ddy7gSh.exe.48a0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 0.3.E84Ddy7gSh.exe.48a0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 16.2.yava_vd.exe.2c40e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 16.2.yava_vd.exe.2c40e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 16.2.yava_vd.exe.2c40e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 21.2.yava_vd.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 21.2.yava_vd.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 21.2.yava_vd.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 21.2.yava_vd.exe.2e50e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 21.2.yava_vd.exe.2e50e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 21.2.yava_vd.exe.2e50e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 21.2.yava_vd.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 21.2.yava_vd.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 21.2.yava_vd.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 16.2.yava_vd.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 16.2.yava_vd.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 16.2.yava_vd.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 0.2.E84Ddy7gSh.exe.4820e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 0.2.E84Ddy7gSh.exe.4820e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 0.2.E84Ddy7gSh.exe.4820e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 33.3.yava_vd.exe.3110000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 33.3.yava_vd.exe.3110000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 33.3.yava_vd.exe.3110000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 21.2.yava_vd.exe.2e50e67.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 21.2.yava_vd.exe.2e50e67.1.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 21.2.yava_vd.exe.2e50e67.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 16.2.yava_vd.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 16.2.yava_vd.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 16.2.yava_vd.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 0.2.E84Ddy7gSh.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 0.2.E84Ddy7gSh.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 0.2.E84Ddy7gSh.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 21.3.yava_vd.exe.4940000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 21.3.yava_vd.exe.4940000.0.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 21.3.yava_vd.exe.4940000.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 33.2.yava_vd.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 33.2.yava_vd.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 33.2.yava_vd.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 33.3.yava_vd.exe.3110000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 33.3.yava_vd.exe.3110000.0.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 33.3.yava_vd.exe.3110000.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 0.3.E84Ddy7gSh.exe.48a0000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 0.3.E84Ddy7gSh.exe.48a0000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 0.3.E84Ddy7gSh.exe.48a0000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 21.3.yava_vd.exe.4940000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 21.3.yava_vd.exe.4940000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 21.3.yava_vd.exe.4940000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 16.3.yava_vd.exe.2fc0000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 16.3.yava_vd.exe.2fc0000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 16.3.yava_vd.exe.2fc0000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 00000021.00000002.2367559880.0000000002DDA000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000000.00000002.2314536540.0000000002D07000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000010.00000002.4401266733.0000000002D07000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000015.00000003.2171817670.0000000004940000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 00000015.00000003.2171817670.0000000004940000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 00000015.00000003.2171817670.0000000004940000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 00000015.00000002.2340091843.0000000002F2A000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000015.00000002.2338776222.0000000000400000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 00000015.00000002.2338776222.0000000000400000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 00000015.00000002.2338776222.0000000000400000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 00000010.00000003.2101181064.0000000002FC0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 00000010.00000003.2101181064.0000000002FC0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 00000010.00000003.2101181064.0000000002FC0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 00000021.00000002.2367461787.0000000002D20000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 00000021.00000002.2367461787.0000000002D20000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000010.00000002.4399861671.0000000000400000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 00000010.00000002.4399861671.0000000000400000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 00000010.00000002.4399861671.0000000000400000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 00000000.00000003.1977291270.00000000048A0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 00000000.00000003.1977291270.00000000048A0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 00000000.00000003.1977291270.00000000048A0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 00000010.00000002.4401153670.0000000002C40000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 00000010.00000002.4401153670.0000000002C40000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000015.00000002.2340023233.0000000002E50000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 00000015.00000002.2340023233.0000000002E50000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000021.00000002.2366150598.0000000000400000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 00000000.00000002.2313081255.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 00000021.00000002.2366150598.0000000000400000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 00000000.00000002.2313081255.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 00000000.00000002.2313081255.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 00000021.00000002.2366150598.0000000000400000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 00000000.00000002.2314933519.0000000004820000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 00000000.00000002.2314933519.0000000004820000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000021.00000003.2264223239.0000000003110000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 00000021.00000003.2264223239.0000000003110000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 00000021.00000003.2264223239.0000000003110000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: Process Memory Space: E84Ddy7gSh.exe PID: 1544, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: Process Memory Space: yava_vd.exe PID: 3520, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: Process Memory Space: yava_vd.exe PID: 6308, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: Process Memory Space: yava_vd.exe PID: 2564, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23

Source: E84Ddy7gSh.exe	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: yava_vd.exe.0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winEXE@21/72@1/2

Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Code function: 0_2_0041798D GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,	0_2_0041798D
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Code function: 0_2_04837BF4 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,	0_2_04837BF4
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 16_2_0041798D GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,	16_2_0041798D
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 16_2_02C57BF4 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,	16_2_02C57BF4
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 21_2_0041798D GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,	21_2_0041798D
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 21_2_02E67BF4 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,	21_2_02E67BF4

Source: C:\Users\user\Desktop\E84Ddy7gSh.exe

Code function: 0_2_0040F4AF GetModuleFileNameW,CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,CloseHandle,

0_2_0040F4AF

Source: C:\Users\user\Desktop\E84Ddy7gSh.exe

Code function: 0_2_0041B539 FindResourceA,LoadResource,LockResource,SizeofResource,

0_2_0041B539

Source: C:\Users\user\Desktop\E84Ddy7gSh.exe

Code function: 0_2_0041AADB OpenSCManagerW,OpenServiceW,CloseServiceHandle,StartServiceW,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,

0_2_0041AADB

Source: C:\Users\user\Desktop\E84Ddy7gSh.exe

File created: C:\Users\user\AppData\Roaming\yava

Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6308
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Mutant created: \Sessions\1\BaseNamedObjects\Rmc-D7NPY6
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess3520
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess1544

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\4b9b3d54-a5f5-4a1b-80ae-189355b0f7a3

Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Command line argument: PG	0_2_0040EA00
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Command line argument: PG	0_2_0040EA00
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Command line argument: Software\	0_2_0040EA00
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Command line argument: Rmc-D7NPY6	0_2_0040EA00
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Command line argument: Exe	0_2_0040EA00
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Command line argument: Exe	0_2_0040EA00
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Command line argument: Rmc-D7NPY6	0_2_0040EA00
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Command line argument: Inj	0_2_0040EA00
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Command line argument: Inj	0_2_0040EA00
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Command line argument: PG	0_2_0040EA00
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Command line argument: PG	0_2_0040EA00
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Command line argument: PG	0_2_0040EA00
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Command line argument: 8SG	0_2_0040EA00
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Command line argument: exepath	0_2_0040EA00
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Command line argument: PG	0_2_0040EA00
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Command line argument: 8SG	0_2_0040EA00
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Command line argument: exepath	0_2_0040EA00
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Command line argument: PG	0_2_0040EA00
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Command line argument: licence	0_2_0040EA00
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Command line argument: PG	0_2_0040EA00
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Command line argument: PG	0_2_0040EA00
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Command line argument: PG	0_2_0040EA00
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Command line argument: PG	0_2_0040EA00
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Command line argument: PG	0_2_0040EA00
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Command line argument: PG	0_2_0040EA00
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Command line argument: dMG	0_2_0040EA00
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Command line argument: PG	0_2_0040EA00
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Command line argument: PG	0_2_0040EA00
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Command line argument: PSG	0_2_0040EA00
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Command line argument: Administrator	0_2_0040EA00
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Command line argument: User	0_2_0040EA00
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Command line argument: del	0_2_0040EA00
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Command line argument: del	0_2_0040EA00
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Command line argument: del	0_2_0040EA00
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Command line argument: PG	16_2_0040EA00
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Command line argument: PG	16_2_0040EA00
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Command line argument: Software\	16_2_0040EA00
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Command line argument: Rmc-D7NPY6	16_2_0040EA00
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Command line argument: Exe	16_2_0040EA00
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Command line argument: Exe	16_2_0040EA00
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Command line argument: Rmc-D7NPY6	16_2_0040EA00
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Command line argument: Inj	16_2_0040EA00
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Command line argument: Inj	16_2_0040EA00
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Command line argument: PG	16_2_0040EA00
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Command line argument: PG	16_2_0040EA00
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Command line argument: PG	16_2_0040EA00
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Command line argument: 8SG	16_2_0040EA00
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Command line argument: exepath	16_2_0040EA00
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Command line argument: PG	16_2_0040EA00
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Command line argument: 8SG	16_2_0040EA00
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Command line argument: exepath	16_2_0040EA00
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Command line argument: PG	16_2_0040EA00
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Command line argument: licence	16_2_0040EA00
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Command line argument: PG	16_2_0040EA00
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Command line argument: PG	16_2_0040EA00
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Command line argument: PG	16_2_0040EA00
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Command line argument: PG	16_2_0040EA00
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Command line argument: PG	16_2_0040EA00
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Command line argument: PG	16_2_0040EA00
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Command line argument: dMG	16_2_0040EA00
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Command line argument: PG	16_2_0040EA00
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Command line argument: PG	16_2_0040EA00
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Command line argument: PSG	16_2_0040EA00
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Command line argument: Administrator	16_2_0040EA00
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Command line argument: User	16_2_0040EA00
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Command line argument: del	16_2_0040EA00
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Command line argument: del	16_2_0040EA00
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Command line argument: del	16_2_0040EA00
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Command line argument: PG	21_2_0040EA00
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Command line argument: PG	21_2_0040EA00
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Command line argument: Software\	21_2_0040EA00
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Command line argument: Exe	21_2_0040EA00
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Command line argument: Inj	21_2_0040EA00
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Command line argument: Inj	21_2_0040EA00
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Command line argument: PG	21_2_0040EA00
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Command line argument: PG	21_2_0040EA00
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Command line argument: PG	21_2_0040EA00
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Command line argument: 8SG	21_2_0040EA00
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Command line argument: exepath	21_2_0040EA00
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Command line argument: PG	21_2_0040EA00
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Command line argument: 8SG	21_2_0040EA00
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Command line argument: exepath	21_2_0040EA00
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Command line argument: PG	21_2_0040EA00
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Command line argument: licence	21_2_0040EA00
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Command line argument: PG	21_2_0040EA00
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Command line argument: PG	21_2_0040EA00
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Command line argument: PG	21_2_0040EA00
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Command line argument: PG	21_2_0040EA00
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Command line argument: PG	21_2_0040EA00
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Command line argument: PG	21_2_0040EA00
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Command line argument: dMG	21_2_0040EA00
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Command line argument: PG	21_2_0040EA00
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Command line argument: PG	21_2_0040EA00
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Command line argument: PSG	21_2_0040EA00
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Command line argument: Administrator	21_2_0040EA00
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Command line argument: User	21_2_0040EA00
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Command line argument: del	21_2_0040EA00
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Command line argument: del	21_2_0040EA00
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Command line argument: del	21_2_0040EA00

Source: E84Ddy7gSh.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\E84Ddy7gSh.exe

File read: C:\Users\user\Desktop\desktop.ini

Source: C:\Users\user\Desktop\E84Ddy7gSh.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: E84Ddy7gSh.exe

ReversingLabs: Detection: 68%

Source: C:\Users\user\Desktop\E84Ddy7gSh.exe

File read: C:\Users\user\Desktop\E84Ddy7gSh.exe

Source: unknown	Process created: C:\Users\user\Desktop\E84Ddy7gSh.exe "C:\Users\user\Desktop\E84Ddy7gSh.exe"
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 1544 -s 1072
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 1544 -s 1080
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 1544 -s 1132
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 1544 -s 1140
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 1544 -s 1176
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 1544 -s 1204
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Process created: C:\Users\user\AppData\Roaming\yava\yava_vd.exe "C:\Users\user\AppData\Roaming\yava\yava_vd.exe"
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 1544 -s 972
Source: unknown	Process created: C:\Users\user\AppData\Roaming\yava\yava_vd.exe "C:\Users\user\AppData\Roaming\yava\yava_vd.exe"
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 3520 -s 704
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 3520 -s 740
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 3520 -s 728
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6308 -s 524
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 3520 -s 796
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 3520 -s 804
Source: unknown	Process created: C:\Users\user\AppData\Roaming\yava\yava_vd.exe "C:\Users\user\AppData\Roaming\yava\yava_vd.exe"
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 3520 -s 760
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 3520 -s 744
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 3520 -s 744
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Process created: C:\Users\user\AppData\Roaming\yava\yava_vd.exe "C:\Users\user\AppData\Roaming\yava\yava_vd.exe"	Jump to behavior

Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Section loaded: msimg32.dll
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Section loaded: msvcr100.dll
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Section loaded: msimg32.dll
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Section loaded: msvcr100.dll
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Section loaded: msimg32.dll
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Section loaded: msvcr100.dll
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Section loaded: kernel.appcore.dll

Source: C:\Users\user\Desktop\E84Ddy7gSh.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Source: C:\Users\user\Desktop\E84Ddy7gSh.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Detected unpacking (changes PE section rights)

Data Obfuscation

Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Unpacked PE file: 0.2.E84Ddy7gSh.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.voguxu:W;.tls:W;.duhasid:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.tls:W;.gfids:R;.rsrc:R;.reloc:R;
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Unpacked PE file: 16.2.yava_vd.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.voguxu:W;.tls:W;.duhasid:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.tls:W;.gfids:R;.rsrc:R;.reloc:R;
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Unpacked PE file: 21.2.yava_vd.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.voguxu:W;.tls:W;.duhasid:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.tls:W;.gfids:R;.rsrc:R;.reloc:R;
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Unpacked PE file: 33.2.yava_vd.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.voguxu:W;.tls:W;.duhasid:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.tls:W;.gfids:R;.rsrc:R;.reloc:R;

Source: C:\Users\user\Desktop\E84Ddy7gSh.exe

Code function: 0_2_0041CBE1 LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetModuleHandleA,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,

0_2_0041CBE1

Source: E84Ddy7gSh.exe	Static PE information: section name: .voguxu
Source: E84Ddy7gSh.exe	Static PE information: section name: .duhasid
Source: yava_vd.exe.0.dr	Static PE information: section name: .voguxu
Source: yava_vd.exe.0.dr	Static PE information: section name: .duhasid

Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Code function: 0_2_00457186 push ecx; ret	0_2_00457199
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Code function: 0_2_0041C7F3 push eax; retf	0_2_0041C7FD
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Code function: 0_2_00457AA8 push eax; ret	0_2_00457AC6
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Code function: 0_2_00434EB6 push ecx; ret	0_2_00434EC9
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Code function: 0_2_02D0B2B4 push FFFFFFF6h; retf	0_2_02D0B2B6
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Code function: 0_2_02D0C06E push 016C66B2h; iretd	0_2_02D0C0F1
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Code function: 0_2_02D09781 push cs; ret	0_2_02D09784
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Code function: 0_2_02D0A84D push eax; retf	0_2_02D0A84F
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Code function: 0_2_02D0BF9E push 016C66B2h; iretd	0_2_02D0C0F1
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Code function: 0_2_0485511D push ecx; ret	0_2_04855130
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Code function: 0_2_048773ED push ecx; ret	0_2_04877400
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Code function: 0_2_04877D0F push eax; ret	0_2_04877D2D
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Code function: 0_2_0483CA5A push eax; retf	0_2_0483CA64
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 16_2_00457186 push ecx; ret	16_2_00457199
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 16_2_0041C7F3 push eax; retf	16_2_0041C7FD
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 16_2_00457AA8 push eax; ret	16_2_00457AC6
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 16_2_00434EB6 push ecx; ret	16_2_00434EC9
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 16_2_02C973ED push ecx; ret	16_2_02C97400
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 16_2_02C7511D push ecx; ret	16_2_02C75130
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 16_2_02C5CA5A push eax; retf	16_2_02C5CA64
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 16_2_02C97D0F push eax; ret	16_2_02C97D2D
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 16_2_02D0B7DC push FFFFFFF6h; retf	16_2_02D0B7DE
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 16_2_02D0C4C6 push 016C66B2h; iretd	16_2_02D0C619
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 16_2_02D0C596 push 016C66B2h; iretd	16_2_02D0C619
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 16_2_02D09CA9 push cs; ret	16_2_02D09CAC
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 16_2_02D0AD75 push eax; retf	16_2_02D0AD77
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 21_2_00457186 push ecx; ret	21_2_00457199
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 21_2_0041C7F3 push eax; retf	21_2_0041C7FD
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 21_2_00457AA8 push eax; ret	21_2_00457AC6
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 21_2_00434EB6 push ecx; ret	21_2_00434EC9
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 21_2_02EA73ED push ecx; ret	21_2_02EA7400

Source: E84Ddy7gSh.exe	Static PE information: section name: .text entropy: 7.936561536852126
Source: yava_vd.exe.0.dr	Static PE information: section name: .text entropy: 7.936561536852126

Source: C:\Users\user\Desktop\E84Ddy7gSh.exe

Code function: 0_2_00406EEB ShellExecuteW,URLDownloadToFileW,

0_2_00406EEB

Source: C:\Users\user\Desktop\E84Ddy7gSh.exe

File created: C:\Users\user\AppData\Roaming\yava\yava_vd.exe

Jump to dropped file

Boot Survival

Creates autostart registry keys with suspicious names

Source: C:\Users\user\Desktop\E84Ddy7gSh.exe

Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Rmc-D7NPY6

Delayed program exit found

Source: C:\Users\user\Desktop\E84Ddy7gSh.exe

Code function: 0_2_0041AADB OpenSCManagerW,OpenServiceW,CloseServiceHandle,StartServiceW,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,

0_2_0041AADB

Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Rmc-D7NPY6			Jump to behavior
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Rmc-D7NPY6			Jump to behavior

Source: C:\Users\user\Desktop\E84Ddy7gSh.exe

0_2_0041CBE1

Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX

Malware Analysis System Evasion

Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Code function: 0_2_0040F7E2 Sleep,ExitProcess,	0_2_0040F7E2
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Code function: 0_2_0482FA49 Sleep,ExitProcess,	0_2_0482FA49
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 16_2_0040F7E2 Sleep,ExitProcess,	16_2_0040F7E2
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 16_2_02C4FA49 Sleep,ExitProcess,	16_2_02C4FA49
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 21_2_0040F7E2 Sleep,ExitProcess,	21_2_0040F7E2
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 21_2_02E5FA49 Sleep,ExitProcess,	21_2_02E5FA49

Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Code function: OpenSCManagerA,EnumServicesStatusW,GetLastError,EnumServicesStatusW,OpenServiceW,QueryServiceConfigW,GetLastError,QueryServiceConfigW,CloseServiceHandle,CloseServiceHandle,	0_2_0041A7D9
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Code function: OpenSCManagerA,EnumServicesStatusW,GetLastError,EnumServicesStatusW,OpenServiceW,QueryServiceConfigW,GetLastError,QueryServiceConfigW,CloseServiceHandle,CloseServiceHandle,	0_2_0483AA40
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: OpenSCManagerA,EnumServicesStatusW,GetLastError,EnumServicesStatusW,OpenServiceW,QueryServiceConfigW,GetLastError,QueryServiceConfigW,CloseServiceHandle,CloseServiceHandle,	16_2_0041A7D9
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: OpenSCManagerA,EnumServicesStatusW,GetLastError,EnumServicesStatusW,OpenServiceW,QueryServiceConfigW,GetLastError,QueryServiceConfigW,CloseServiceHandle,CloseServiceHandle,	16_2_02C5AA40
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: OpenSCManagerA,EnumServicesStatusW,GetLastError,EnumServicesStatusW,OpenServiceW,QueryServiceConfigW,GetLastError,QueryServiceConfigW,CloseServiceHandle,CloseServiceHandle,	21_2_0041A7D9
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: OpenSCManagerA,EnumServicesStatusW,GetLastError,EnumServicesStatusW,OpenServiceW,QueryServiceConfigW,GetLastError,QueryServiceConfigW,CloseServiceHandle,CloseServiceHandle,	21_2_02E6AA40

Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe

Window / User API: threadDelayed 9734

Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Evaded block: after key decision			graph_0-85921
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Evaded block: after key decision			graph_0-85948

Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	API coverage: 4.1 %
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	API coverage: 6.6 %
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	API coverage: 3.7 %

Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe TID: 6776	Thread sleep count: 256 > 30
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe TID: 6776	Thread sleep time: -768000s >= -30000s
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe TID: 6776	Thread sleep count: 9734 > 30
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe TID: 6776	Thread sleep time: -29202000s >= -30000s

Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Code function: 0_2_0040928E __EH_prolog,__CxxThrowException@8,FindFirstFileW,FindNextFileW,FindClose,FindClose,	0_2_0040928E
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Code function: 0_2_0041C322 FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,RemoveDirectoryW,FindClose,	0_2_0041C322
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Code function: 0_2_0040C388 FindFirstFileW,PathFileExistsW,FindNextFileW,FindClose,FindClose,	0_2_0040C388
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Code function: 0_2_004096A0 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,	0_2_004096A0
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Code function: 0_2_00408847 __EH_prolog,FindFirstFileW,__CxxThrowException@8,FindNextFileW,FindClose,	0_2_00408847
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Code function: 0_2_00407877 FindFirstFileW,FindNextFileW,	0_2_00407877
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Code function: 0_2_0040BB6B FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,	0_2_0040BB6B
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Code function: 0_2_00419B86 FindFirstFileW,FindNextFileW,FindNextFileW,	0_2_00419B86
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Code function: 0_2_0040BD72 FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,	0_2_0040BD72
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Code function: 0_2_0483C589 FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,RemoveDirectoryW,FindClose,	0_2_0483C589
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Code function: 0_2_0482C5EF FindFirstFileW,PathFileExistsW,FindNextFileW,FindClose,FindClose,	0_2_0482C5EF
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Code function: 0_2_0482BDD2 FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,	0_2_0482BDD2
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Code function: 0_2_04839DED FindFirstFileW,	0_2_04839DED
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Code function: 0_2_04829907 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,	0_2_04829907
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Code function: 0_2_04828AAE __EH_prolog,FindFirstFileW,__CxxThrowException@8,FindNextFileW,FindClose,	0_2_04828AAE
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Code function: 0_2_04827ADE FindFirstFileW,FindNextFileW,	0_2_04827ADE
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 16_2_0040928E __EH_prolog,__CxxThrowException@8,FindFirstFileW,FindNextFileW,FindClose,FindClose,	16_2_0040928E
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 16_2_0041C322 FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,RemoveDirectoryW,FindClose,	16_2_0041C322
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 16_2_0040C388 FindFirstFileW,PathFileExistsW,FindNextFileW,FindClose,FindClose,	16_2_0040C388
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 16_2_004096A0 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,	16_2_004096A0
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 16_2_00408847 __EH_prolog,FindFirstFileW,__CxxThrowException@8,FindNextFileW,FindClose,	16_2_00408847
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 16_2_00407877 FindFirstFileW,FindNextFileW,	16_2_00407877
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 16_2_0040BB6B FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,	16_2_0040BB6B
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 16_2_00419B86 FindFirstFileW,FindNextFileW,FindNextFileW,	16_2_00419B86
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 16_2_0040BD72 FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,	16_2_0040BD72
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 16_2_02C4C5EF FindFirstFileW,PathFileExistsW,FindNextFileW,FindClose,FindClose,	16_2_02C4C5EF
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 16_2_02C5C589 FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,RemoveDirectoryW,FindClose,	16_2_02C5C589
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 16_2_02C47ADE FindFirstFileW,FindNextFileW,	16_2_02C47ADE
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 16_2_02C48AAE __EH_prolog,FindFirstFileW,__CxxThrowException@8,FindNextFileW,FindClose,	16_2_02C48AAE
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 16_2_02C49907 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,	16_2_02C49907
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 16_2_02C4BDD2 FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,	16_2_02C4BDD2
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 16_2_02C59DED FindFirstFileW,	16_2_02C59DED
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 21_2_0040928E __EH_prolog,__CxxThrowException@8,FindFirstFileW,FindNextFileW,FindClose,FindClose,	21_2_0040928E
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 21_2_0041C322 FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,RemoveDirectoryW,FindClose,	21_2_0041C322
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 21_2_0040C388 FindFirstFileW,PathFileExistsW,FindNextFileW,FindClose,FindClose,	21_2_0040C388
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 21_2_004096A0 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,	21_2_004096A0
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 21_2_00408847 __EH_prolog,FindFirstFileW,__CxxThrowException@8,FindNextFileW,FindClose,	21_2_00408847
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 21_2_00407877 FindFirstFileW,FindNextFileW,	21_2_00407877
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 21_2_0040BB6B FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,	21_2_0040BB6B
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 21_2_00419B86 FindFirstFileW,FindNextFileW,FindNextFileW,	21_2_00419B86
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 21_2_0040BD72 FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,	21_2_0040BD72
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 21_2_02E5C5EF FindFirstFileW,PathFileExistsW,FindNextFileW,FindClose,FindClose,	21_2_02E5C5EF
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 21_2_02E6C589 FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,RemoveDirectoryW,FindClose,	21_2_02E6C589
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 21_2_02E57ADE FindFirstFileW,FindNextFileW,	21_2_02E57ADE
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 21_2_02E58AAE __EH_prolog,FindFirstFileW,__CxxThrowException@8,FindNextFileW,FindClose,	21_2_02E58AAE
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 21_2_02E59907 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,	21_2_02E59907
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 21_2_02E69DED FindFirstFileW,	21_2_02E69DED
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 21_2_02E5BDD2 FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,	21_2_02E5BDD2

Source: C:\Users\user\Desktop\E84Ddy7gSh.exe

Code function: 0_2_00407CD2 SetEvent,GetFileAttributesW,DeleteFileW,ShellExecuteW,GetLogicalDriveStringsA,SetFileAttributesW,DeleteFileA,Sleep,StrToIntA,CreateDirectoryW,

0_2_00407CD2

Source: Amcache.hve.3.dr	Binary or memory string: VMware
Source: Amcache.hve.3.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.3.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.3.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.3.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.3.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.3.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.3.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: yava_vd.exe, 00000010.00000003.2314858832.0000000002DC4000.00000004.00000020.00020000.00000000.sdmp, yava_vd.exe, 00000010.00000002.4401365489.0000000002DC4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Amcache.hve.3.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.3.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.3.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.3.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.3.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.3.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.3.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.3.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.3.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: yava_vd.exe, 00000010.00000002.4401297367.0000000002D4C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWXm
Source: Amcache.hve.3.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.3.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.3.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.3.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.3.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.3.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.3.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.3.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.3.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.3.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.3.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.3.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe

API call chain: ExitProcess graph end node

Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Process queried: DebugPort

Source: C:\Users\user\Desktop\E84Ddy7gSh.exe

Code function: 0_2_00402888 LdrInitializeThunk,

0_2_00402888

Source: C:\Users\user\Desktop\E84Ddy7gSh.exe

Code function: 0_2_00434A8A IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00434A8A

Source: C:\Users\user\Desktop\E84Ddy7gSh.exe

0_2_0041CBE1

Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Code function: 0_2_00443355 mov eax, dword ptr fs:[00000030h]	0_2_00443355
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Code function: 0_2_02D0768B push dword ptr fs:[00000030h]	0_2_02D0768B
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Code function: 0_2_048635BC mov eax, dword ptr fs:[00000030h]	0_2_048635BC
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Code function: 0_2_04820D90 mov eax, dword ptr fs:[00000030h]	0_2_04820D90
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Code function: 0_2_0482092B mov eax, dword ptr fs:[00000030h]	0_2_0482092B
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 16_2_00443355 mov eax, dword ptr fs:[00000030h]	16_2_00443355
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 16_2_02C835BC mov eax, dword ptr fs:[00000030h]	16_2_02C835BC
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 16_2_02C4092B mov eax, dword ptr fs:[00000030h]	16_2_02C4092B
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 16_2_02C40D90 mov eax, dword ptr fs:[00000030h]	16_2_02C40D90
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 16_2_02D07BB3 push dword ptr fs:[00000030h]	16_2_02D07BB3
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 21_2_00443355 mov eax, dword ptr fs:[00000030h]	21_2_00443355
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 21_2_02E935BC mov eax, dword ptr fs:[00000030h]	21_2_02E935BC
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 21_2_02E5092B mov eax, dword ptr fs:[00000030h]	21_2_02E5092B
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 21_2_02E50D90 mov eax, dword ptr fs:[00000030h]	21_2_02E50D90
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 21_2_02F2B033 push dword ptr fs:[00000030h]	21_2_02F2B033

Source: C:\Users\user\Desktop\E84Ddy7gSh.exe

Code function: 0_2_004120B2 GetProcessHeap,HeapFree,

0_2_004120B2

Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Code function: 0_2_0043503C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_0043503C
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Code function: 0_2_00434A8A IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00434A8A
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Code function: 0_2_0043BB71 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_0043BB71
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Code function: 0_2_00434BD8 SetUnhandledExceptionFilter,	0_2_00434BD8
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Code function: 0_2_048552A3 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_048552A3
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Code function: 0_2_04854CF1 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_04854CF1
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Code function: 0_2_0485BDD8 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_0485BDD8
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 16_2_0043503C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	16_2_0043503C
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 16_2_00434A8A IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	16_2_00434A8A
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 16_2_0043BB71 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	16_2_0043BB71
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 16_2_00434BD8 SetUnhandledExceptionFilter,	16_2_00434BD8
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 16_2_02C752A3 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	16_2_02C752A3
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 16_2_02C74CF1 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	16_2_02C74CF1
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 16_2_02C7BDD8 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	16_2_02C7BDD8
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 21_2_0043503C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	21_2_0043503C
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 21_2_00434A8A IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	21_2_00434A8A
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 21_2_0043BB71 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	21_2_0043BB71
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 21_2_00434BD8 SetUnhandledExceptionFilter,	21_2_00434BD8
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 21_2_02E852A3 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	21_2_02E852A3
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 21_2_02E84CF1 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	21_2_02E84CF1
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: 21_2_02E8BDD8 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	21_2_02E8BDD8

Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Code function: GetCurrentProcessId,OpenMutexA,CloseHandle,CreateThread,CloseHandle,Sleep,OpenProcess, svchost.exe	0_2_00412132
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: GetCurrentProcessId,OpenMutexA,CloseHandle,CreateThread,CloseHandle,Sleep,OpenProcess, svchost.exe	16_2_00412132
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: GetCurrentProcessId,OpenMutexA,CloseHandle,CreateThread,CloseHandle,Sleep,OpenProcess, svchost.exe	21_2_00412132

Source: C:\Users\user\Desktop\E84Ddy7gSh.exe

Code function: 0_2_00419662 mouse_event,

0_2_00419662

Source: C:\Users\user\Desktop\E84Ddy7gSh.exe

Process created: C:\Users\user\AppData\Roaming\yava\yava_vd.exe "C:\Users\user\AppData\Roaming\yava\yava_vd.exe"

Source: yava_vd.exe, 00000010.00000002.4401297367.0000000002D7F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: yava_vd.exe, 00000010.00000002.4401297367.0000000002D7F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager!
Source: yava_vd.exe, 00000010.00000002.4401297367.0000000002D7F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager2
Source: yava_vd.exe, 00000010.00000002.4401297367.0000000002D7F000.00000004.00000020.00020000.00000000.sdmp, yava_vd.exe, 00000010.00000002.4401297367.0000000002D4C000.00000004.00000020.00020000.00000000.sdmp, yava_vd.exe, 00000010.00000002.4401297367.0000000002DA0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \|Program Manager\|

Source: C:\Users\user\Desktop\E84Ddy7gSh.exe

Code function: 0_2_00434CB6 cpuid

0_2_00434CB6

Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Code function: EnumSystemLocalesW,	0_2_0045201B
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Code function: EnumSystemLocalesW,	0_2_004520B6
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	0_2_00452143
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Code function: GetLocaleInfoW,	0_2_00452393
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Code function: EnumSystemLocalesW,	0_2_00448484
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_004524BC
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Code function: GetLocaleInfoW,	0_2_004525C3
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_00452690
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Code function: GetLocaleInfoW,	0_2_0044896D
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Code function: GetLocaleInfoA,	0_2_0040F90C
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Code function: IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,	0_2_00451D58
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Code function: EnumSystemLocalesW,	0_2_00451FD0
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Code function: GetLocaleInfoW,	0_2_048725FA
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Code function: EnumSystemLocalesW,	0_2_048686EB
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_04872723
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Code function: EnumSystemLocalesW,	0_2_04872282
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Code function: EnumSystemLocalesW,	0_2_04872237
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Code function: EnumSystemLocalesW,	0_2_0487231D
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Code function: IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,	0_2_04871FBF
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_048728F7
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Code function: GetLocaleInfoW,	0_2_0487282A
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Code function: GetLocaleInfoW,	0_2_04868BD4
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Code function: GetLocaleInfoA,	0_2_0482FB73
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: GetLocaleInfoA,	16_2_0040F90C
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: EnumSystemLocalesW,	16_2_0045201B
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: EnumSystemLocalesW,	16_2_004520B6
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	16_2_00452143
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: GetLocaleInfoW,	16_2_00452393
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: EnumSystemLocalesW,	16_2_00448484
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	16_2_004524BC
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: GetLocaleInfoW,	16_2_004525C3
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	16_2_00452690
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: GetLocaleInfoW,	16_2_0044896D
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,	16_2_00451D58
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: EnumSystemLocalesW,	16_2_00451FD0
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: EnumSystemLocalesW,	16_2_02C92282
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: EnumSystemLocalesW,	16_2_02C92237
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: EnumSystemLocalesW,	16_2_02C9231D
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: EnumSystemLocalesW,	16_2_02C886EB
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	16_2_02C92723
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: GetLocaleInfoW,	16_2_02C925FA
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: GetLocaleInfoW,	16_2_02C88BD4
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: GetLocaleInfoA,	16_2_02C4FB73
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	16_2_02C928F7
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: GetLocaleInfoW,	16_2_02C9282A
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,	16_2_02C91FBF
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: EnumSystemLocalesW,	21_2_0045201B
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: EnumSystemLocalesW,	21_2_004520B6
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	21_2_00452143
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: GetLocaleInfoW,	21_2_00452393
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: EnumSystemLocalesW,	21_2_00448484
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	21_2_004524BC
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: GetLocaleInfoW,	21_2_004525C3
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	21_2_00452690
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: GetLocaleInfoW,	21_2_0044896D
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: GetLocaleInfoA,	21_2_0040F90C
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,	21_2_00451D58
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: EnumSystemLocalesW,	21_2_00451FD0
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: EnumSystemLocalesW,	21_2_02EA2282
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: EnumSystemLocalesW,	21_2_02EA2237
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: EnumSystemLocalesW,	21_2_02EA231D
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: EnumSystemLocalesW,	21_2_02E986EB
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	21_2_02EA2723
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: GetLocaleInfoW,	21_2_02EA25FA
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: GetLocaleInfoW,	21_2_02E98BD4
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: GetLocaleInfoA,	21_2_02E5FB73
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	21_2_02EA28F7
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: GetLocaleInfoW,	21_2_02EA282A
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,	21_2_02EA1FBF

Source: C:\Users\user\Desktop\E84Ddy7gSh.exe

Code function: 0_2_0041A045 __EH_prolog,734B5D90,CreateDirectoryW,Sleep,Sleep,GetLocalTime,Sleep,

0_2_0041A045

Source: C:\Users\user\Desktop\E84Ddy7gSh.exe

Code function: 0_2_0041B69E GetComputerNameExW,GetUserNameW,

0_2_0041B69E

Source: C:\Users\user\Desktop\E84Ddy7gSh.exe

Code function: 0_2_0044942D _free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

0_2_0044942D

Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Source: Amcache.hve.3.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.3.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.3.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.3.dr	Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information

Contains functionality to steal Chrome passwords or cookies

Source: Yara match	File source: 16.3.yava_vd.exe.2fc0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.2.yava_vd.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.E84Ddy7gSh.exe.4820e67.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.yava_vd.exe.2c40e67.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.2.yava_vd.exe.2d20e67.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.E84Ddy7gSh.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.2.yava_vd.exe.2d20e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.E84Ddy7gSh.exe.48a0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.yava_vd.exe.2c40e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.yava_vd.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.yava_vd.exe.2e50e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.yava_vd.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.yava_vd.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.E84Ddy7gSh.exe.4820e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.3.yava_vd.exe.3110000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.yava_vd.exe.2e50e67.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.yava_vd.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.E84Ddy7gSh.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.3.yava_vd.exe.4940000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.2.yava_vd.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.3.yava_vd.exe.3110000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.E84Ddy7gSh.exe.48a0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.3.yava_vd.exe.4940000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.3.yava_vd.exe.2fc0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000021.00000002.2367590433.0000000002E1F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.2340121187.0000000002F6F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000003.2171817670.0000000004940000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2314578868.0000000002D4B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.4401297367.0000000002D4C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.2338776222.0000000000400000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000003.2101181064.0000000002FC0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000002.2367461787.0000000002D20000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.4399861671.0000000000400000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1977291270.00000000048A0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.4401153670.0000000002C40000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.2340023233.0000000002E50000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000002.2366150598.0000000000400000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2313081255.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2314933519.0000000004820000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000003.2264223239.0000000003110000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: E84Ddy7gSh.exe PID: 1544, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: yava_vd.exe PID: 3520, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: yava_vd.exe PID: 6308, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: yava_vd.exe PID: 2564, type: MEMORYSTR

Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Code function: \AppData\Local\Google\Chrome\User Data\Default\Login Data	0_2_0040BA4D
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: \AppData\Local\Google\Chrome\User Data\Default\Login Data	16_2_0040BA4D
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: \AppData\Local\Google\Chrome\User Data\Default\Login Data	21_2_0040BA4D

Contains functionality to steal Firefox passwords or cookies

Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Code function: \AppData\Roaming\Mozilla\Firefox\Profiles\	0_2_0040BB6B
Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Code function: \key3.db	0_2_0040BB6B
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: \AppData\Roaming\Mozilla\Firefox\Profiles\	16_2_0040BB6B
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: \key3.db	16_2_0040BB6B
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: \AppData\Roaming\Mozilla\Firefox\Profiles\	21_2_0040BB6B
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: \key3.db	21_2_0040BB6B

Remote Access Functionality

Detected Remcos RAT

Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Mutex created: \Sessions\1\BaseNamedObjects\Rmc-D7NPY6	Jump to behavior
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Mutex created: \Sessions\1\BaseNamedObjects\Rmc-D7NPY6
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Mutex created: \Sessions\1\BaseNamedObjects\Rmc-D7NPY6
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Mutex created: \Sessions\1\BaseNamedObjects\Rmc-D7NPY6

Source: Yara match	File source: 16.3.yava_vd.exe.2fc0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.2.yava_vd.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.E84Ddy7gSh.exe.4820e67.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.yava_vd.exe.2c40e67.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.2.yava_vd.exe.2d20e67.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.E84Ddy7gSh.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.2.yava_vd.exe.2d20e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.E84Ddy7gSh.exe.48a0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.yava_vd.exe.2c40e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.yava_vd.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.yava_vd.exe.2e50e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.yava_vd.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.yava_vd.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.E84Ddy7gSh.exe.4820e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.3.yava_vd.exe.3110000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.yava_vd.exe.2e50e67.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.yava_vd.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.E84Ddy7gSh.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.3.yava_vd.exe.4940000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.2.yava_vd.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.3.yava_vd.exe.3110000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.E84Ddy7gSh.exe.48a0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.3.yava_vd.exe.4940000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.3.yava_vd.exe.2fc0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000021.00000002.2367590433.0000000002E1F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.2340121187.0000000002F6F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000003.2171817670.0000000004940000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2314578868.0000000002D4B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.4401297367.0000000002D4C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.2338776222.0000000000400000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000003.2101181064.0000000002FC0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000002.2367461787.0000000002D20000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.4399861671.0000000000400000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1977291270.00000000048A0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.4401153670.0000000002C40000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.2340023233.0000000002E50000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000002.2366150598.0000000000400000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2313081255.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2314933519.0000000004820000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000003.2264223239.0000000003110000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: E84Ddy7gSh.exe PID: 1544, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: yava_vd.exe PID: 3520, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: yava_vd.exe PID: 6308, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: yava_vd.exe PID: 2564, type: MEMORYSTR

Source: C:\Users\user\Desktop\E84Ddy7gSh.exe	Code function: cmd.exe	0_2_0040569A
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: cmd.exe	16_2_0040569A
Source: C:\Users\user\AppData\Roaming\yava\yava_vd.exe	Code function: cmd.exe	21_2_0040569A

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	1 OS Credential Dumping	2 System Time Discovery	Remote Services	11 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	12 Command and Scripting Interpreter	1 Windows Service	1 Bypass User Account Control	3 Obfuscated Files or Information	111 Input Capture	1 Account Discovery	Remote Desktop Protocol	111 Input Capture	2 Encrypted Channel	Exfiltration Over Bluetooth	1 Defacement
Email Addresses	DNS Server	Domain Accounts	2 Service Execution	11 Registry Run Keys / Startup Folder	1 Access Token Manipulation	12 Software Packing	2 Credentials In Files	1 System Service Discovery	SMB/Windows Admin Shares	3 Clipboard Data	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 Windows Service	1 DLL Side-Loading	NTDS	3 File and Directory Discovery	Distributed Component Object Model	Input Capture	1 Remote Access Software	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	22 Process Injection	1 Bypass User Account Control	LSA Secrets	23 System Information Discovery	SSH	Keylogging	2 Non-Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	11 Registry Run Keys / Startup Folder	1 Masquerading	Cached Domain Credentials	141 Security Software Discovery	VNC	GUI Input Capture	12 Application Layer Protocol	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	2 Virtualization/Sandbox Evasion	DCSync	2 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Access Token Manipulation	Proc Filesystem	2 Process Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	22 Process Injection	/etc/passwd and /etc/shadow	1 Application Window Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	Dynamic API Resolution	Network Sniffing	1 System Owner/User Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label
E84Ddy7gSh.exe	68%	ReversingLabs	Win32.Rootkit.BootkitX
E84Ddy7gSh.exe	100%	Avira	TR/AD.Remcos.eaidn
E84Ddy7gSh.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\yava\yava_vd.exe	68%	ReversingLabs	Win32.Rootkit.BootkitX

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
27.212	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
geoplugin.net	178.237.33.50	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://geoplugin.net/json.gp	false		high
27.212	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
http://geoplugin.net/json.gp#	yava_vd.exe, 00000010.00000003.2314673167.0000000002D7F000.00000004.00000020.00020000.00000000.sdmp, yava_vd.exe, 00000010.00000002.4401297367.0000000002D7F000.00000004.00000020.00020000.00000000.sdmp	false	high
http://upx.sf.net	Amcache.hve.3.dr	false	high
http://geoplugin.net/json.gp7	yava_vd.exe, 00000010.00000003.2314673167.0000000002D7F000.00000004.00000020.00020000.00000000.sdmp, yava_vd.exe, 00000010.00000002.4401297367.0000000002D7F000.00000004.00000020.00020000.00000000.sdmp	false	high
http://geoplugin.net/json.gp&	yava_vd.exe, 00000010.00000003.2314673167.0000000002D7F000.00000004.00000020.00020000.00000000.sdmp, yava_vd.exe, 00000010.00000002.4401297367.0000000002D7F000.00000004.00000020.00020000.00000000.sdmp	false	high
http://geoplugin.net/	yava_vd.exe, 00000010.00000003.2314673167.0000000002DA0000.00000004.00000020.00020000.00000000.sdmp, yava_vd.exe, 00000010.00000003.2314858832.0000000002DB0000.00000004.00000020.00020000.00000000.sdmp	false	high
http://geoplugin.net/json.gp/C	E84Ddy7gSh.exe, 00000000.00000003.1977291270.00000000048A0000.00000004.00001000.00020000.00000000.sdmp, E84Ddy7gSh.exe, 00000000.00000002.2314933519.0000000004820000.00000040.00001000.00020000.00000000.sdmp, E84Ddy7gSh.exe, 00000000.00000002.2313081255.0000000000400000.00000040.00000001.01000000.00000003.sdmp, yava_vd.exe, 00000010.00000002.4399861671.0000000000400000.00000040.00000001.01000000.00000007.sdmp, yava_vd.exe, 00000010.00000003.2101181064.0000000002FC0000.00000004.00001000.00020000.00000000.sdmp, yava_vd.exe, 00000010.00000002.4401153670.0000000002C40000.00000040.00001000.00020000.00000000.sdmp, yava_vd.exe, 00000015.00000003.2171817670.0000000004940000.00000004.00001000.00020000.00000000.sdmp, yava_vd.exe, 00000015.00000002.2338776222.0000000000400000.00000040.00000001.01000000.00000007.sdmp, yava_vd.exe, 00000015.00000002.2340023233.0000000002E50000.00000040.00001000.00020000.00000000.sdmp, yava_vd.exe, 00000021.00000002.2367461787.0000000002D20000.00000040.00001000.00020000.00000000.sdmp, yava_vd.exe, 00000021.00000003.2264223239.0000000003110000.00000004.00001000.00020000.00000000.sdmp, yava_vd.exe, 00000021.00000002.2366150598.0000000000400000.00000040.00000001.01000000.00000007.sdmp	false	high
http://geoplugin.net/json.gpSystem32	yava_vd.exe, 00000010.00000002.4401297367.0000000002D4C000.00000004.00000020.00020000.00000000.sdmp	false	high
http://geoplugin.net/json.gp=	yava_vd.exe, 00000010.00000003.2314673167.0000000002D7F000.00000004.00000020.00020000.00000000.sdmp, yava_vd.exe, 00000010.00000002.4401297367.0000000002D7F000.00000004.00000020.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
198.23.227.212	unknown	United States		36352	AS-COLOCROSSINGUS	true
178.237.33.50	geoplugin.net	Netherlands		8455	ATOM86-ASATOM86NL	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1567509
Start date and time:	2024-12-03 16:26:53 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 11m 17s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	40
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	E84Ddy7gSh.exe renamed because original name is a hash value
Original Sample Name:	7fce076ae6458c561dcb1e5cd6a1de47aa114d5758dc791f0a94402ac4a9f2ee.exe
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winEXE@21/72@1/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 97% Number of executed functions: 14 Number of non-executed functions: 399
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): WerFault.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 20.42.65.92
Excluded domains from analysis (whitelisted): onedsblobprdeus17.eastus.cloudapp.azure.com, ocsp.digicert.com, login.live.com, slscr.update.microsoft.com, otelrules.azureedge.net, blobcollector.events.data.trafficmanager.net, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: E84Ddy7gSh.exe

Simulations

Behavior and APIs

Time	Type	Description
10:28:49	API Interceptor	2x Sleep call for process: WerFault.exe modified
10:29:09	API Interceptor	3820056x Sleep call for process: yava_vd.exe modified
15:28:20	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run Rmc-D7NPY6 "C:\Users\user\AppData\Roaming\yava\yava_vd.exe"
15:28:30	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run Rmc-D7NPY6 "C:\Users\user\AppData\Roaming\yava\yava_vd.exe"

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
198.23.227.212	advancePayment-pdf.exe	Get hash	malicious	Remcos	Browse
	YESOHDKMIm.exe	Get hash	malicious	Remcos	Browse
	NujUXO42Rg.exe	Get hash	malicious	Remcos	Browse
	ZeaS4nUxg4.exe	Get hash	malicious	Remcos	Browse
	documents-pdf.exe	Get hash	malicious	Remcos	Browse
	1kZ9olJiaG.exe	Get hash	malicious	Remcos	Browse
	ltlbVjClX9.exe	Get hash	malicious	Remcos	Browse
178.237.33.50	z49FACTURA-0987678.exe	Get hash	malicious	Remcos	Browse	geoplugin.net/json.gp
	LBzGgy6rnu.doc	Get hash	malicious	Remcos	Browse	geoplugin.net/json.gp
	EIuz8Bk9kGav2ix.exe	Get hash	malicious	Remcos	Browse	geoplugin.net/json.gp
	0200011080.xls	Get hash	malicious	Remcos, HTMLPhisher	Browse	geoplugin.net/json.gp
	1099833039444.pdf.js	Get hash	malicious	Remcos	Browse	geoplugin.net/json.gp
	RFQ-24-10104-PO X241104754-007.exe	Get hash	malicious	Remcos	Browse	geoplugin.net/json.gp
	FAT6789098700900.scr.exe	Get hash	malicious	Remcos	Browse	geoplugin.net/json.gp
	ISF (TWN24110458 - Invoice & Packing List PO POUS120000241, POUS120000771.scr.exe	Get hash	malicious	Remcos	Browse	geoplugin.net/json.gp
	173317191746333e83fd715fcd29456f316941f504021238a7f0f8ba4a89827b03f83d6aba395.dat-decoded.exe	Get hash	malicious	Remcos	Browse	geoplugin.net/json.gp
	INTECH RFQ EN241813.exe	Get hash	malicious	Remcos	Browse	geoplugin.net/json.gp

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
geoplugin.net	z49FACTURA-0987678.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	LBzGgy6rnu.doc	Get hash	malicious	Remcos	Browse	178.237.33.50
	EIuz8Bk9kGav2ix.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	0200011080.xls	Get hash	malicious	Remcos, HTMLPhisher	Browse	178.237.33.50
	1099833039444.pdf.js	Get hash	malicious	Remcos	Browse	178.237.33.50
	RFQ-24-10104-PO X241104754-007.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	FAT6789098700900.scr.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	ISF (TWN24110458 - Invoice & Packing List PO POUS120000241, POUS120000771.scr.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	173317191746333e83fd715fcd29456f316941f504021238a7f0f8ba4a89827b03f83d6aba395.dat-decoded.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	INTECH RFQ EN241813.exe	Get hash	malicious	Remcos	Browse	178.237.33.50

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AS-COLOCROSSINGUS	lxnFs9LHSe.exe	Get hash	malicious	Unknown	Browse	104.168.28.10
	z49FACTURA-0987678.exe	Get hash	malicious	Remcos	Browse	192.210.150.26
	EIuz8Bk9kGav2ix.exe	Get hash	malicious	Remcos	Browse	192.3.64.152
	a-r.m-6.SNOOPY.elf	Get hash	malicious	Gafgyt	Browse	192.3.179.33
	FAT6789098700900.scr.exe	Get hash	malicious	Remcos	Browse	192.210.150.26
	INTECH RFQ EN241813.exe	Get hash	malicious	Remcos	Browse	104.168.7.16
	https://a.rs6.net/1/pc?ep=e4f2f4ad2c30fbb2SK2ZyQxbsE02cV3UOfuPD-JxSRgUD6Y86mFtUF3WRqjeuMrz9o3Xbb320wCTDsWWUHuFG0qWroCiniptiREBdHyyzdrPc45m6t-HBEB7SZ8gZX4dYr4o80JwDUJz1eSGQlrcb9as_P_3jZu-t-DrRTdQARm9vPjp5IAqdyzm4bLxpaVnP8_0eRiLoUggvzge&c=$%7bContact.encryptedContactId%7d	Get hash	malicious	HTMLPhisher	Browse	206.217.129.92
	seemebestgoodluckthings.hta	Get hash	malicious	Cobalt Strike, FormBook, HTMLPhisher	Browse	172.245.123.12
	PI-02911202409#.xla.xlsx	Get hash	malicious	FormBook, HTMLPhisher	Browse	172.245.123.12
	la.bot.mips.elf	Get hash	malicious	Mirai	Browse	107.175.186.126
ATOM86-ASATOM86NL	z49FACTURA-0987678.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	LBzGgy6rnu.doc	Get hash	malicious	Remcos	Browse	178.237.33.50
	EIuz8Bk9kGav2ix.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	0200011080.xls	Get hash	malicious	Remcos, HTMLPhisher	Browse	178.237.33.50
	1099833039444.pdf.js	Get hash	malicious	Remcos	Browse	178.237.33.50
	RFQ-24-10104-PO X241104754-007.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	FAT6789098700900.scr.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	ISF (TWN24110458 - Invoice & Packing List PO POUS120000241, POUS120000771.scr.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	173317191746333e83fd715fcd29456f316941f504021238a7f0f8ba4a89827b03f83d6aba395.dat-decoded.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	INTECH RFQ EN241813.exe	Get hash	malicious	Remcos	Browse	178.237.33.50

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_E84Ddy7gSh.exe_3bbdd7b2631149a9c1d5348da92758aba99bb2c_4cca82d9_1351380b-7458-4d81-af17-0c3ef8a64010\Report.wer

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9515242074566659
Encrypted:	false
SSDEEP:	96:Sg8YcdsGhqdoA7JfPQXIDcQnc6rCcEhcw3rb+HbHg/opAnQPxVg7TFOy4tZrXOn7:Zcd26056rQjxPZrx4zuiFGZ24IO8fx
MD5:	1B543B87714F845D9A6F647D2E68C7DA
SHA1:	BC0099750B051B598CEE694420CA7B358A00F441
SHA-256:	99DE722FEAA88F076946A662A565D58959A797600D0FB1E30B436D7C6556A32B
SHA-512:	C3673D9930DA23B487C6B52BD19E2FCC3D9FF286479D6482CEA6A840D03EEC6CE0DB0F5348BC2931686B82C5DFC8BC4C06F871182747AE4605EEBB7E2039D2E0
Malicious:	true
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.7.7.1.3.3.0.0.9.1.3.9.4.1.1.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.1.3.5.1.3.8.0.b.-.7.4.5.8.-.4.d.8.1.-.a.f.1.7.-.0.c.3.e.f.8.a.6.4.0.1.0.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.e.d.d.4.1.4.6.4.-.6.d.a.f.-.4.4.1.8.-.9.5.d.c.-.7.2.2.7.7.b.1.b.4.a.2.5.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.E.8.4.D.d.y.7.g.S.h...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.6.0.8.-.0.0.0.1.-.0.0.1.4.-.4.5.0.d.-.0.4.f.7.9.7.4.5.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.5.a.3.b.1.8.a.e.7.a.9.0.a.e.f.b.f.3.4.e.0.6.8.e.f.8.a.9.5.8.d.1.0.0.0.0.f.f.f.f.!.0.0.0.0.f.8.e.7.7.3.f.1.0.4.f.c.f.d.6.d.f.4.8.e.e.2.1.5.9.1.c.e.8.8.9.0.f.d.8.9.4.2.c.5.!.E.8.4.D.d.y.7.g.S.h...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.0.9././.2.3.:.1.4.:.5.0.:.4.9.!.0.!.E.8.4.D.d.y.7.g.S.h...e.x.e.....B.o.o.t.I.d.=.4.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_E84Ddy7gSh.exe_3bbdd7b2631149a9c1d5348da92758aba99bb2c_4cca82d9_54734a71-632f-4881-acec-6ff5ef723591\Report.wer

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.944534868670405
Encrypted:	false
SSDEEP:	96:bpoYcSsGhqdoA7JfPQXIDcQnc6rCcEhcw3rb+HbHg/opAnQPxVg7TFOy4tZrXOn5:3cS26056rQjxPZrxyzuiFGZ24IO8fx
MD5:	6F14A52C306377635BCDA8D5B5ADF071
SHA1:	5A55C3B8C05DA60A6900F7002CAB77F5C85BCD46
SHA-256:	D03428F46C32E964A85AF2D719BD38628872A7573FF28E754B89973B7E848758
SHA-512:	F61B81A4E05BB8D4D62B663AAD8F499C8FE25FAB349E8D0E5FD0A24F2FCCF8C16F879B6294BFAE6D6C6A9534C60AB0B61646BA8186AE45195CB78603A71E5E59
Malicious:	true
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.7.7.1.3.2.9.8.9.7.3.5.9.3.5.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.5.4.7.3.4.a.7.1.-.6.3.2.f.-.4.8.8.1.-.a.c.e.c.-.6.f.f.5.e.f.7.2.3.5.9.1.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.5.d.6.6.3.6.b.5.-.e.2.1.9.-.4.b.6.2.-.b.8.8.9.-.4.5.2.2.a.8.2.5.1.a.c.6.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.E.8.4.D.d.y.7.g.S.h...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.6.0.8.-.0.0.0.1.-.0.0.1.4.-.4.5.0.d.-.0.4.f.7.9.7.4.5.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.5.a.3.b.1.8.a.e.7.a.9.0.a.e.f.b.f.3.4.e.0.6.8.e.f.8.a.9.5.8.d.1.0.0.0.0.f.f.f.f.!.0.0.0.0.f.8.e.7.7.3.f.1.0.4.f.c.f.d.6.d.f.4.8.e.e.2.1.5.9.1.c.e.8.8.9.0.f.d.8.9.4.2.c.5.!.E.8.4.D.d.y.7.g.S.h...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.0.9././.2.3.:.1.4.:.5.0.:.4.9.!.0.!.E.8.4.D.d.y.7.g.S.h...e.x.e.....B.o.o.t.I.d.=.4.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_E84Ddy7gSh.exe_3bbdd7b2631149a9c1d5348da92758aba99bb2c_4cca82d9_99c07b9b-5b66-44c6-8841-c0d1e0d06c12\Report.wer

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.951544202122989
Encrypted:	false
SSDEEP:	96:nXYc1HsGhqdoA7JfPQXIDcQnc6rCcEhcw3rb+HbHg/opAnQPxVg7TFOy4tZrXOn7:oct26056rQjxPZrx4zuiFGZ24IO8fx
MD5:	D47809F90DD913910F726C8F6D78556D
SHA1:	81250088E91B72C0A617E7562B8C96DA35AEBE5A
SHA-256:	12B4315D9293A3B497C14FD7B2D538CC4AE097BD4228C1A45CD1DD25B824FCA6
SHA-512:	9E08A5D438EB81B22D9C617FEA8FCEB0AAAEA8F3F417A31AAF5D1DBD8FE32D7BEF947E96B9D8E1DA08F83E2B12B3EDAF95A51A01561A2B5DD5671E80EF3E7193
Malicious:	true
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.7.7.1.3.3.0.2.7.2.8.3.5.8.2.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.9.9.c.0.7.b.9.b.-.5.b.6.6.-.4.4.c.6.-.8.8.4.1.-.c.0.d.1.e.0.d.0.6.c.1.2.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.9.3.4.c.1.8.a.1.-.b.3.2.2.-.4.2.1.7.-.8.a.3.c.-.3.b.7.1.2.8.0.9.5.6.2.1.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.E.8.4.D.d.y.7.g.S.h...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.6.0.8.-.0.0.0.1.-.0.0.1.4.-.4.5.0.d.-.0.4.f.7.9.7.4.5.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.5.a.3.b.1.8.a.e.7.a.9.0.a.e.f.b.f.3.4.e.0.6.8.e.f.8.a.9.5.8.d.1.0.0.0.0.f.f.f.f.!.0.0.0.0.f.8.e.7.7.3.f.1.0.4.f.c.f.d.6.d.f.4.8.e.e.2.1.5.9.1.c.e.8.8.9.0.f.d.8.9.4.2.c.5.!.E.8.4.D.d.y.7.g.S.h...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.0.9././.2.3.:.1.4.:.5.0.:.4.9.!.0.!.E.8.4.D.d.y.7.g.S.h...e.x.e.....B.o.o.t.I.d.=.4.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_E84Ddy7gSh.exe_3bbdd7b2631149a9c1d5348da92758aba99bb2c_4cca82d9_bc10f416-227a-4d0b-adba-def6792398e4\Report.wer

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9444127976438875
Encrypted:	false
SSDEEP:	96:MzDcoWYcisGhqdoA7JfPQXIDcQnc6rCcEhcw3rb+HbHg/opAnQPxVg7TFOy4tZrh:PCci26056rQjxPZrxyzuiFhZ24IO8fx
MD5:	D46C46E1DA7134B52A102F275AE6DB24
SHA1:	C08CDD190CC0D0C0D26AAA5A57CCA2208CDE4C45
SHA-256:	19C6BED5D243689463EDB736D8911CEAC17ED544C3A007EC0178225407E11297
SHA-512:	B4FCB65BBD4ACBE7DE5F47DD6538368F91682223DF461650E173332744492AF4FA4E2D89363F366F8BB3DF24F662EB45D8E6634B9A2FC21483546D6F9E855642
Malicious:	true
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.7.7.1.3.2.9.6.8.6.3.7.2.0.6.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.b.c.1.0.f.4.1.6.-.2.2.7.a.-.4.d.0.b.-.a.d.b.a.-.d.e.f.6.7.9.2.3.9.8.e.4.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.9.0.3.7.e.1.b.1.-.b.5.f.9.-.4.9.c.5.-.8.1.2.8.-.d.5.e.6.0.c.2.a.c.5.5.4.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.E.8.4.D.d.y.7.g.S.h...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.6.0.8.-.0.0.0.1.-.0.0.1.4.-.4.5.0.d.-.0.4.f.7.9.7.4.5.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.5.a.3.b.1.8.a.e.7.a.9.0.a.e.f.b.f.3.4.e.0.6.8.e.f.8.a.9.5.8.d.1.0.0.0.0.f.f.f.f.!.0.0.0.0.f.8.e.7.7.3.f.1.0.4.f.c.f.d.6.d.f.4.8.e.e.2.1.5.9.1.c.e.8.8.9.0.f.d.8.9.4.2.c.5.!.E.8.4.D.d.y.7.g.S.h...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.0.9././.2.3.:.1.4.:.5.0.:.4.9.!.0.!.E.8.4.D.d.y.7.g.S.h...e.x.e.....B.o.o.t.I.d.=.4.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_E84Ddy7gSh.exe_3bbdd7b2631149a9c1d5348da92758aba99bb2c_4cca82d9_cddedab1-4e7f-44c0-bc0a-61689b0c50b2\Report.wer

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	modified
Size (bytes):	65536
Entropy (8bit):	0.9513634608408535
Encrypted:	false
SSDEEP:	96:FHYcosGhqdoA7JfPQXIDcQnc6rCcEhcw3rb+HbHg/opAnQPxVg7TFOy4tZrXOnmS:+co26056rQjxPZrx4zuiFGZ24IO8fx
MD5:	825546EC9B53E6DF0CDB9D6DF0B12F2E
SHA1:	1C7BD77C06BBEA6CAE49810C08CF51B2E89EAF55
SHA-256:	BFA9DE11111C84574658DF9710D72633661084D2A7EF55EA331E94C471FD6BE9
SHA-512:	51AE2B3059B6B6DB1D92DEA1D59427187AF3AFFF9BB7D1E8914FB217DCB694A62E24F180FC0E659BF482D6C25C54A0089E2A28F2DC11030E3A80B130BBFDCBCB
Malicious:	true
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.7.7.1.3.3.0.1.7.1.3.5.3.4.7.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.c.d.d.e.d.a.b.1.-.4.e.7.f.-.4.4.c.0.-.b.c.0.a.-.6.1.6.8.9.b.0.c.5.0.b.2.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.8.2.c.a.4.6.f.8.-.1.f.d.c.-.4.4.b.2.-.b.1.6.6.-.0.3.f.b.7.a.1.d.0.3.8.d.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.E.8.4.D.d.y.7.g.S.h...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.6.0.8.-.0.0.0.1.-.0.0.1.4.-.4.5.0.d.-.0.4.f.7.9.7.4.5.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.5.a.3.b.1.8.a.e.7.a.9.0.a.e.f.b.f.3.4.e.0.6.8.e.f.8.a.9.5.8.d.1.0.0.0.0.f.f.f.f.!.0.0.0.0.f.8.e.7.7.3.f.1.0.4.f.c.f.d.6.d.f.4.8.e.e.2.1.5.9.1.c.e.8.8.9.0.f.d.8.9.4.2.c.5.!.E.8.4.D.d.y.7.g.S.h...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.0.9././.2.3.:.1.4.:.5.0.:.4.9.!.0.!.E.8.4.D.d.y.7.g.S.h...e.x.e.....B.o.o.t.I.d.=.4.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_E84Ddy7gSh.exe_3bbdd7b2631149a9c1d5348da92758aba99bb2c_4cca82d9_d199426c-ebd0-4321-ba3a-eba26822ba82\Report.wer

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9508365492510269
Encrypted:	false
SSDEEP:	192:pzHcX26056rQjxPZrx4zuiFGZ24IO8fx:N8X2B56rQj6zuiFGY4IO8fx
MD5:	4C827FFE6EB5E2EF5743BEA6869D3AA6
SHA1:	D538BE16A31F026980AA42095BE76C43ECE7E35D
SHA-256:	D57E52C79164D7C76946BE777D7E5001CB38A3430F8F376A1E6EBE9EDF617966
SHA-512:	BE3EAC1EC11FC1EBC8F62EF422F6A25DAAB089D89B8311AFA3D835F6E6172A64024D07B1DC2377F41E92838A28968732A532F04D730888B9C5E8E2A242767F93
Malicious:	true
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.7.7.1.3.3.0.4.0.9.4.4.5.3.3.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.d.1.9.9.4.2.6.c.-.e.b.d.0.-.4.3.2.1.-.b.a.3.a.-.e.b.a.2.6.8.2.2.b.a.8.2.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.4.f.d.2.c.4.0.2.-.c.1.0.3.-.4.a.d.8.-.9.b.6.d.-.7.d.c.5.f.1.0.d.3.5.1.e.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.E.8.4.D.d.y.7.g.S.h...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.6.0.8.-.0.0.0.1.-.0.0.1.4.-.4.5.0.d.-.0.4.f.7.9.7.4.5.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.5.a.3.b.1.8.a.e.7.a.9.0.a.e.f.b.f.3.4.e.0.6.8.e.f.8.a.9.5.8.d.1.0.0.0.0.f.f.f.f.!.0.0.0.0.f.8.e.7.7.3.f.1.0.4.f.c.f.d.6.d.f.4.8.e.e.2.1.5.9.1.c.e.8.8.9.0.f.d.8.9.4.2.c.5.!.E.8.4.D.d.y.7.g.S.h...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.0.9././.2.3.:.1.4.:.5.0.:.4.9.!.0.!.E.8.4.D.d.y.7.g.S.h...e.x.e.....B.o.o.t.I.d.=.4.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_E84Ddy7gSh.exe_3bbdd7b2631149a9c1d5348da92758aba99bb2c_4cca82d9_dd740563-c0b3-47e2-a234-12f5e5e12ae2\Report.wer

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9514666735502504
Encrypted:	false
SSDEEP:	192:WBz5cD26056rQjxPZrx4zuiFGZ24IO8fx:WoD2B56rQj6zuiFGY4IO8fx
MD5:	78F883E51B9FF59BEF31718E4673A675
SHA1:	BB59399A16BD75449BE75E4492EA4A906A3427F3
SHA-256:	0873B9D99F012A323008763B67D5EB749A5C01BA772A9C200D714CAC7D021520
SHA-512:	DD97F0D811518CCAD5AD2AD8F33B7E8AFAF599F93304026483755B9B167A72EA8967D772AB521996846A82AB4DE7F0C85934C38302309AB0E333DB3FF87F1993
Malicious:	true
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.7.7.1.3.2.9.9.6.8.3.1.5.4.2.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.d.d.7.4.0.5.6.3.-.c.0.b.3.-.4.7.e.2.-.a.2.3.4.-.1.2.f.5.e.5.e.1.2.a.e.2.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.8.7.5.9.d.f.7.5.-.6.7.0.6.-.4.0.e.2.-.b.3.e.9.-.d.e.f.a.3.7.5.b.8.b.7.c.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.E.8.4.D.d.y.7.g.S.h...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.6.0.8.-.0.0.0.1.-.0.0.1.4.-.4.5.0.d.-.0.4.f.7.9.7.4.5.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.5.a.3.b.1.8.a.e.7.a.9.0.a.e.f.b.f.3.4.e.0.6.8.e.f.8.a.9.5.8.d.1.0.0.0.0.f.f.f.f.!.0.0.0.0.f.8.e.7.7.3.f.1.0.4.f.c.f.d.6.d.f.4.8.e.e.2.1.5.9.1.c.e.8.8.9.0.f.d.8.9.4.2.c.5.!.E.8.4.D.d.y.7.g.S.h...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.0.9././.2.3.:.1.4.:.5.0.:.4.9.!.0.!.E.8.4.D.d.y.7.g.S.h...e.x.e.....B.o.o.t.I.d.=.4.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_E84Ddy7gSh.exe_60a05b9c42c3b9b011b818ffe7e9fa69eb543b8b_4cca82d9_afe92a54-62ad-448b-91c2-f2420e68d374\Report.wer

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.0275233349976944
Encrypted:	false
SSDEEP:	192:Ioc/25e0ENeUjxPZrxBRdzuiFGZ24IO8fx:U/25FENeUjPzuiFGY4IO8fx
MD5:	9D07224CB1423F0D9A25AD47FC0D7A72
SHA1:	D0D9AF56BEF5F91AD84D1BE7B4D6DE1D4B19ABDF
SHA-256:	D605A5D348DFED04EAC6951DC1A75830EED00FCB415812FC5FC30344737D8F72
SHA-512:	4B3AC28CFA674A8845545581998D9B5B6B361B2CC7BDE8F3FD54CA28C562D90CC8F9594C7A6ECB055B70D4A819BD11991BF8D24B47B2A1160DC2D398F6818217
Malicious:	true
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.7.7.1.3.3.0.5.4.2.7.7.3.3.9.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.7.7.1.3.3.0.6.6.1.5.2.4.4.0.....R.e.p.o.r.t.S.t.a.t.u.s.=.6.5.5.4.5.6.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.a.f.e.9.2.a.5.4.-.6.2.a.d.-.4.4.8.b.-.9.1.c.2.-.f.2.4.2.0.e.6.8.d.3.7.4.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.e.1.8.e.0.0.4.8.-.b.b.1.9.-.4.1.6.a.-.b.b.7.9.-.9.3.b.7.0.2.5.8.a.d.a.0.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.E.8.4.D.d.y.7.g.S.h...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.6.0.8.-.0.0.0.1.-.0.0.1.4.-.4.5.0.d.-.0.4.f.7.9.7.4.5.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.5.a.3.b.1.8.a.e.7.a.9.0.a.e.f.b.f.3.4.e.0.6.8.e.f.8.a.9.5.8.d.1.0.0.0.0.f.f.f.f.!.0.0.0.0.f.8.e.7.7.3.f.1.0.4.f.c.f.d.6.d.f.4.8.e.e.2.1.5.9.1.c.e.8.8.9.0.f.d.8.9.4.2.c.5.!.E.8.4.D.d.y.7.g.S.h...e.x.e.....T.a.r.g.e.t.A.p.p.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_yava_vd.exe_694973ef58b9b1d13dd50cbc967377ff8c65dd8_24266d0a_67d2101f-045a-49a7-a4ce-c200f041e0b7\Report.wer

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8801162019260602
Encrypted:	false
SSDEEP:	192:9p3g1ueZue0y8egsjTMZrQzuiFGZ24IO8S:0ueZuFylgsj/zuiFGY4IO8S
MD5:	6F85D9A16EF2367E5D9AD004425F9B25
SHA1:	9E0C8EBF49C5C438E2252D2598A177C8B8B319E1
SHA-256:	3675312DEC3162E2268C9F00FD44F3E3D83124A3F6D3C52409ED6A8A1B69C49E
SHA-512:	5AA9B33AD0FF349457D6E0ACBFC602EC2CCAD41B0D1C655973F6D1FABE84D443247A4CB7B1E6AD853C99C54213E96307A7EAAE51E9B04FCCEC4455C8B37A9700
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.7.7.1.3.3.1.6.5.9.0.4.5.8.2.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.7.7.1.3.3.1.7.1.2.1.7.1.1.6.....R.e.p.o.r.t.S.t.a.t.u.s.=.6.5.5.4.5.6.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.6.7.d.2.1.0.1.f.-.0.4.5.a.-.4.9.a.7.-.a.4.c.e.-.c.2.0.0.f.0.4.1.e.0.b.7.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.2.9.9.b.e.c.4.c.-.9.5.1.9.-.4.0.0.9.-.a.a.b.2.-.a.3.3.4.e.e.9.e.5.4.6.2.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.y.a.v.a._.v.d...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.8.a.4.-.0.0.0.1.-.0.0.1.4.-.e.c.b.f.-.4.2.0.1.9.8.4.5.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.9.b.0.7.8.b.f.6.4.5.c.5.8.1.7.f.e.a.9.5.0.8.e.2.5.1.e.f.7.e.5.4.0.0.0.0.f.f.f.f.!.0.0.0.0.f.8.e.7.7.3.f.1.0.4.f.c.f.d.6.d.f.4.8.e.e.2.1.5.9.1.c.e.8.8.9.0.f.d.8.9.4.2.c.5.!.y.a.v.a._.v.d...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_yava_vd.exe_6f219a76e5d1154d5faad29dbabe4df3f93d5d0_24266d0a_0b9642d3-2314-4cb9-92d0-cb85c9e42be7\Report.wer

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9532316736597112
Encrypted:	false
SSDEEP:	96:kpV1Y4s3hqdoA7JfPQXIDcQnc6rCcEhcw3r7+HbHg/opAnQPxVg7TFOy4tZrXOni:u1vZ6056rQjxPZr3GzuiFGZ24IO8S
MD5:	F858409CD046C0AE8AC6ADABD24CA2CB
SHA1:	FD15A0624E432971A98D9878B2E7BFF45B2110B8
SHA-256:	D7CFBE0E01A0219FD4F4BAB02B12CBCD6726CC6582346114F712732DF116A813
SHA-512:	51B1CA6F05E313918CFAFEE9FDBA013512F82D91FDA42B8668FF376B11E51589DDF6B9CC7BBC61EBF27AC118009AE21DD5D166EF5DB5E97EB918B82105AA4EBD
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.7.7.1.3.3.2.1.7.0.3.9.3.6.3.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.0.b.9.6.4.2.d.3.-.2.3.1.4.-.4.c.b.9.-.9.2.d.0.-.c.b.8.5.c.9.e.4.2.b.e.7.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.f.8.6.4.7.4.5.7.-.6.3.7.a.-.4.5.d.7.-.a.c.f.2.-.7.7.9.0.4.9.e.d.9.6.f.9.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.y.a.v.a._.v.d...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.d.c.0.-.0.0.0.1.-.0.0.1.4.-.1.8.4.2.-.6.d.f.e.9.7.4.5.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.9.b.0.7.8.b.f.6.4.5.c.5.8.1.7.f.e.a.9.5.0.8.e.2.5.1.e.f.7.e.5.4.0.0.0.0.f.f.f.f.!.0.0.0.0.f.8.e.7.7.3.f.1.0.4.f.c.f.d.6.d.f.4.8.e.e.2.1.5.9.1.c.e.8.8.9.0.f.d.8.9.4.2.c.5.!.y.a.v.a._.v.d...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.0.9././.2.3.:.1.4.:.5.0.:.4.9.!.0.!.y.a.v.a._.v.d...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.9.6.7.2.9.5.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_yava_vd.exe_6f219a76e5d1154d5faad29dbabe4df3f93d5d0_24266d0a_5cb77c84-9740-4664-b3e5-b18f29e0cc7d\Report.wer

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	modified
Size (bytes):	65536
Entropy (8bit):	0.9534282691660222
Encrypted:	false
SSDEEP:	96:oiuX1us3hqdoA7JfPQXIDcQnc6rCcEhcw3r7+HbHg/opAnQPxVg7TFOy4tZrXOni:ot1uZ6056rQjxPZr3GzuiFGZ24IO8S
MD5:	E520A5BA4042A0F5D5D35240917F4072
SHA1:	2587133E2FFFF7B229A185C6A1CC5C536CC1E773
SHA-256:	3E678E9DCE3B8AD221242E68BE3DB886BA5008A643C015FF06F070F983A72E4C
SHA-512:	648DFC6191B22DE5A847323CBCA88FB81EE642037DFE7221B49466E451EDEE9AAC362EF4591184027D3ADE7147B500A638A75D0BDC33702384D5FD08FAFE52C2
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.7.7.1.3.3.2.4.3.2.6.2.8.7.0.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.5.c.b.7.7.c.8.4.-.9.7.4.0.-.4.6.6.4.-.b.3.e.5.-.b.1.8.f.2.9.e.0.c.c.7.d.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.6.1.0.c.1.0.0.0.-.2.6.0.7.-.4.2.b.e.-.8.c.0.a.-.1.f.c.c.6.c.a.4.7.b.4.f.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.y.a.v.a._.v.d...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.d.c.0.-.0.0.0.1.-.0.0.1.4.-.1.8.4.2.-.6.d.f.e.9.7.4.5.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.9.b.0.7.8.b.f.6.4.5.c.5.8.1.7.f.e.a.9.5.0.8.e.2.5.1.e.f.7.e.5.4.0.0.0.0.f.f.f.f.!.0.0.0.0.f.8.e.7.7.3.f.1.0.4.f.c.f.d.6.d.f.4.8.e.e.2.1.5.9.1.c.e.8.8.9.0.f.d.8.9.4.2.c.5.!.y.a.v.a._.v.d...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.0.9././.2.3.:.1.4.:.5.0.:.4.9.!.0.!.y.a.v.a._.v.d...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.9.6.7.2.9.5.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_yava_vd.exe_6f219a76e5d1154d5faad29dbabe4df3f93d5d0_24266d0a_6009132a-da41-49ae-8e1a-01ae2214b039\Report.wer

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8971323285090123
Encrypted:	false
SSDEEP:	96:Ztq1xs3hqdoA7JfPQXIDcQnc6rCcEhcw3r7+HbHg/opAnQPxVg7TFOy4tZrXOnmf:e1xZ6056rQjxPZr3CzuiFGZ24IO8S
MD5:	6889AC38014CE1E361007440476011F3
SHA1:	AC846015BBD083A3736A849057F0A4F7C5DCAB3C
SHA-256:	C3066EC40C4E42063B4EA6B46D2B71C6F46036BF83A62309E1B7019061371A38
SHA-512:	9ABFE37FC745EE4D418566CF500B22CCCE88152506309D706D7065B90CB4A595DB1C6899C59E3874DB1DD3FF325C9CAE0BD424C50A08D33727D6F7E10EE2DDCD
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.7.7.1.3.3.1.0.9.6.3.7.3.4.0.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.6.0.0.9.1.3.2.a.-.d.a.4.1.-.4.9.a.e.-.8.e.1.a.-.0.1.a.e.2.2.1.4.b.0.3.9.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.5.4.7.b.9.0.9.c.-.f.6.7.e.-.4.1.7.d.-.9.4.a.b.-.4.d.f.5.b.9.2.4.5.1.0.9.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.y.a.v.a._.v.d...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.d.c.0.-.0.0.0.1.-.0.0.1.4.-.1.8.4.2.-.6.d.f.e.9.7.4.5.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.9.b.0.7.8.b.f.6.4.5.c.5.8.1.7.f.e.a.9.5.0.8.e.2.5.1.e.f.7.e.5.4.0.0.0.0.f.f.f.f.!.0.0.0.0.f.8.e.7.7.3.f.1.0.4.f.c.f.d.6.d.f.4.8.e.e.2.1.5.9.1.c.e.8.8.9.0.f.d.8.9.4.2.c.5.!.y.a.v.a._.v.d...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.0.9././.2.3.:.1.4.:.5.0.:.4.9.!.0.!.y.a.v.a._.v.d...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.9.6.7.2.9.5.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_yava_vd.exe_6f219a76e5d1154d5faad29dbabe4df3f93d5d0_24266d0a_d38e2909-d631-43db-bdd3-6da9fd90e3aa\Report.wer

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9178904190232203
Encrypted:	false
SSDEEP:	96:IfbH1Ks3hqdoA7JfPQXIDcQnc6rCcEhcw3r7+HbHg/opAnQPxVg7TFOy4tZrXOna:uj1KZ6056rQjxPZr3uzuiFGZ24IO8S
MD5:	F7ABE5824C000D64CE737E792D481D10
SHA1:	CCC8D0CC91A583964533A0F669FD255518D8A21C
SHA-256:	063CDC7835E24B7104B993260F1E0734FA7D686EAA4DBC3A98C5EE6AE2B5DD96
SHA-512:	1DF30CCCC78BFDB67F281EE04D482CB06622E0B82C9375881551390A4FAE4A217DABC068FFB0E2E766E894E10E7FDF00C837CF470EA1EBB6FBF9B6746E2C068B
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.7.7.1.3.3.1.9.1.0.4.1.1.7.6.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.d.3.8.e.2.9.0.9.-.d.6.3.1.-.4.3.d.b.-.b.d.d.3.-.6.d.a.9.f.d.9.0.e.3.a.a.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.3.4.1.4.c.7.8.b.-.f.8.5.8.-.4.b.f.6.-.a.f.b.5.-.d.2.f.f.b.f.c.9.e.3.0.9.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.y.a.v.a._.v.d...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.d.c.0.-.0.0.0.1.-.0.0.1.4.-.1.8.4.2.-.6.d.f.e.9.7.4.5.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.9.b.0.7.8.b.f.6.4.5.c.5.8.1.7.f.e.a.9.5.0.8.e.2.5.1.e.f.7.e.5.4.0.0.0.0.f.f.f.f.!.0.0.0.0.f.8.e.7.7.3.f.1.0.4.f.c.f.d.6.d.f.4.8.e.e.2.1.5.9.1.c.e.8.8.9.0.f.d.8.9.4.2.c.5.!.y.a.v.a._.v.d...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.0.9././.2.3.:.1.4.:.5.0.:.4.9.!.0.!.y.a.v.a._.v.d...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.9.6.7.2.9.5.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_yava_vd.exe_6f219a76e5d1154d5faad29dbabe4df3f93d5d0_24266d0a_dc05c398-0638-475c-bcb2-e1a1ee6f34da\Report.wer

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9177299738256227
Encrypted:	false
SSDEEP:	192:CKQ11PZ6056rQjxPZr3uzuiFGZ24IO8S:2PZB56rQjazuiFGY4IO8S
MD5:	6B3115CAB8B0CFD5BB0DCD3BB66219C2
SHA1:	256CFF12ACAE35AE90828F083D3890DEA0B7036E
SHA-256:	F4B554AA0F45A357096D7D5608497A2D9497035D79CA0DEE20F36A9D6C730D11
SHA-512:	E90EEF42690038E3B05BECB4AFB09F70BDA997389731579553CF6069DA76DB9B5B94CDA7B927D0410D92508A79064D3615AD86734A714B26433D1D0B7AC61CA4
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.7.7.1.3.3.1.6.0.2.2.9.0.5.2.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.d.c.0.5.c.3.9.8.-.0.6.3.8.-.4.7.5.c.-.b.c.b.2.-.e.1.a.1.e.e.6.f.3.4.d.a.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.f.f.6.0.c.b.b.9.-.f.5.8.2.-.4.5.3.1.-.b.1.2.f.-.c.7.c.0.b.a.9.b.c.d.c.2.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.y.a.v.a._.v.d...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.d.c.0.-.0.0.0.1.-.0.0.1.4.-.1.8.4.2.-.6.d.f.e.9.7.4.5.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.9.b.0.7.8.b.f.6.4.5.c.5.8.1.7.f.e.a.9.5.0.8.e.2.5.1.e.f.7.e.5.4.0.0.0.0.f.f.f.f.!.0.0.0.0.f.8.e.7.7.3.f.1.0.4.f.c.f.d.6.d.f.4.8.e.e.2.1.5.9.1.c.e.8.8.9.0.f.d.8.9.4.2.c.5.!.y.a.v.a._.v.d...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.0.9././.2.3.:.1.4.:.5.0.:.4.9.!.0.!.y.a.v.a._.v.d...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.9.6.7.2.9.5.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_yava_vd.exe_6f219a76e5d1154d5faad29dbabe4df3f93d5d0_24266d0a_e7e0f08b-d378-4280-b57e-9ec63d87ffd1\Report.wer

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9529667716229318
Encrypted:	false
SSDEEP:	96:qzg1is3hqdoA7JfPQXIDcQnc6rCcEhcw3r7+HbHg/opAnQPxVg7TFOy4tZrXOnmL:z1iZ6056rQjxPZr3GzuiFGZ24IO8S
MD5:	8E624C502206133886F585967C0705F9
SHA1:	053A198C8E0577EA12B6DD2FD162557492E81408
SHA-256:	22227FE2533A48F0D2D1A2F31BA6A22AFE0FDDF70524E6181732F66C34F3A43E
SHA-512:	4F29D33086B0D297A7F57958D13DD3DB274F8E790193D2C518E2370B22E0B986DEA01A0E30B8261407EEE72CB836EDB676278C892610D8BAB79BC3A97E5459BC
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.7.7.1.3.3.2.0.1.6.0.0.7.6.2.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.e.7.e.0.f.0.8.b.-.d.3.7.8.-.4.2.8.0.-.b.5.7.e.-.9.e.c.6.3.d.8.7.f.f.d.1.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.e.2.f.0.4.0.c.a.-.b.2.1.0.-.4.6.a.1.-.b.3.f.7.-.c.9.1.f.1.9.9.c.a.e.6.a.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.y.a.v.a._.v.d...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.d.c.0.-.0.0.0.1.-.0.0.1.4.-.1.8.4.2.-.6.d.f.e.9.7.4.5.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.9.b.0.7.8.b.f.6.4.5.c.5.8.1.7.f.e.a.9.5.0.8.e.2.5.1.e.f.7.e.5.4.0.0.0.0.f.f.f.f.!.0.0.0.0.f.8.e.7.7.3.f.1.0.4.f.c.f.d.6.d.f.4.8.e.e.2.1.5.9.1.c.e.8.8.9.0.f.d.8.9.4.2.c.5.!.y.a.v.a._.v.d...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.0.9././.2.3.:.1.4.:.5.0.:.4.9.!.0.!.y.a.v.a._.v.d...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.9.6.7.2.9.5.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_yava_vd.exe_6f219a76e5d1154d5faad29dbabe4df3f93d5d0_24266d0a_f6aa07c8-e3fd-4d3d-889a-b22b6501ce65\Report.wer

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9040944170456325
Encrypted:	false
SSDEEP:	96:VvL15s3hqdoA7JfPQXIDcQnc6rCcEhcw3r7+HbHg/opAnQPxVg7TFOy4tZrXOnmh:B15Z6056rQjxPZr31zuiFGZ24IO8SM
MD5:	828DAF8836DD8627366AF46B8583A9B9
SHA1:	1DC81B9181FB154DEDBE9CF339B142575056EF3B
SHA-256:	480A323950BABC847EAA4CF2D25B7C7E7DEB1B37DCD962FCAE0A791AC6C6684F
SHA-512:	3C43A7838AA00E28A714ACA540FCE624FD9A9893DBECCA1DA1AA0C32EE0354797EA44B5C96114EA80BE392F24FBC07477745E986BB551F968BF6D66D08D385EF
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.7.7.1.3.3.1.2.9.2.8.0.0.8.1.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.f.6.a.a.0.7.c.8.-.e.3.f.d.-.4.d.3.d.-.8.8.9.a.-.b.2.2.b.6.5.0.1.c.e.6.5.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.b.e.8.9.f.f.6.0.-.f.6.c.7.-.4.5.2.3.-.a.9.6.c.-.d.b.8.2.c.a.0.f.9.5.1.5.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.y.a.v.a._.v.d...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.d.c.0.-.0.0.0.1.-.0.0.1.4.-.1.8.4.2.-.6.d.f.e.9.7.4.5.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.9.b.0.7.8.b.f.6.4.5.c.5.8.1.7.f.e.a.9.5.0.8.e.2.5.1.e.f.7.e.5.4.0.0.0.0.f.f.f.f.!.0.0.0.0.f.8.e.7.7.3.f.1.0.4.f.c.f.d.6.d.f.4.8.e.e.2.1.5.9.1.c.e.8.8.9.0.f.d.8.9.4.2.c.5.!.y.a.v.a._.v.d...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.0.9././.2.3.:.1.4.:.5.0.:.4.9.!.0.!.y.a.v.a._.v.d...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.9.6.7.2.9.5.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_yava_vd.exe_be2440385a84e4d277b8a58444cedd7ca1a85ac_24266d0a_8e36f406-a365-4618-9ab1-8e5880c3f776\Report.wer

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9179908769484036
Encrypted:	false
SSDEEP:	192:61pZq0JsAnbcA/jxPZr3uzuiFGZ24IO8S:upZxJsAnbcA/jazuiFGY4IO8S
MD5:	9E970799C80357765F47814FEE1FB742
SHA1:	88D97BCBB8654C724810AE33612BC780376C67CC
SHA-256:	036FA6820C901E1CCEF834334C81FE44E9446AEA32C7342C058907EE86C1E5BA
SHA-512:	773C7303AE23D4C47EAA01D6924DEF070CFFFC850C3E1D3BDADED0E72891F664A523E80508533B3509C0FB4B01516805458526BF5D4D70FA48321B374AE729C0
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.7.7.1.3.3.1.7.4.2.8.8.3.7.9.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.8.e.3.6.f.4.0.6.-.a.3.6.5.-.4.6.1.8.-.9.a.b.1.-.8.e.5.8.8.0.c.3.f.7.7.6.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.b.8.6.9.b.d.5.7.-.c.f.6.a.-.4.8.4.9.-.9.7.f.0.-.2.e.3.0.d.8.2.a.4.e.9.d.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.y.a.v.a._.v.d...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.d.c.0.-.0.0.0.1.-.0.0.1.4.-.1.8.4.2.-.6.d.f.e.9.7.4.5.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.9.b.0.7.8.b.f.6.4.5.c.5.8.1.7.f.e.a.9.5.0.8.e.2.5.1.e.f.7.e.5.4.0.0.0.0.f.f.f.f.!.0.0.0.0.f.8.e.7.7.3.f.1.0.4.f.c.f.d.6.d.f.4.8.e.e.2.1.5.9.1.c.e.8.8.9.0.f.d.8.9.4.2.c.5.!.y.a.v.a._.v.d...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.0.9././.2.3.:.1.4.:.5.0.:.4.9.!.0.!.y.a.v.a._.v.d...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.9.6.7.2.9.5.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER1077.tmp.dmp

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Tue Dec 3 15:28:33 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	58096
Entropy (8bit):	2.114966870242625
Encrypted:	false
SSDEEP:	192:U6IyxOXw05FXNDsYrteODXw5jJg256OEKqioWsPL/H1Ym3cc72oWX2NizFGfP3:dIyxTuPDsYk5jJg25BoWsT/LcTPRA33
MD5:	1D283B97DA56BBB1335E0CFD38000483
SHA1:	775BBAA9730ED4392E68467D24F43353507412EA
SHA-256:	7423C9E39179CF63E905CBFC4248F3F10CD9E644E675CFC076200138FB532E7C
SHA-512:	E43EA20DD91D06D842B3C9A3C69546C89615EC44C0E382C78FB1AB86CE3CC0DA9141BA07E818C690CB7FB78F4655128C05BB3260C8B91BF603B0FD84A5D6094D
Malicious:	false
Preview:	MDMP..a..... ........#Og........................(...............02..........T.......8...........T...........X...............$...........................................................................................eJ..............GenuineIntel............T............#Og.............................0..2...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER123E.tmp.WERInternalMetadata.xml

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8348
Entropy (8bit):	3.700934100198333
Encrypted:	false
SSDEEP:	192:R6l7wVeJXo6HWT6YWW6sKoGgmfcLypBt89boFsfT4m:R6lXJY6S6Y/6dgmfcL/oefJ
MD5:	EF85561C76241B2C9E8ED5D5107AB148
SHA1:	7BFA06AEE29E9E47154746BFBDBD9BEC632D9FEF
SHA-256:	0D38F6692139D84BF8F1AA441E39CC74874A0B30549A908462AA4AC9BC1FE908
SHA-512:	FB6B6C9ED8A3DA6BAF0202D39EB42BFB96CD5AC731F17FAC038BD9906398C13B6E57E131C05156D7FEDD435132AC41064EA63424B8A297B65027B90A561F69AB
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.3.5.2.0.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER127D.tmp.xml

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4604
Entropy (8bit):	4.476409157682252
Encrypted:	false
SSDEEP:	48:cvIwWl8zsZKJg77aI9LEVWpW8VY5Ym8M4JYs4FNE+q8fSbNHpN9d:uIjfCI7Nh7V9J4EhBpN9d
MD5:	8971038D7FE8CDFC9F0E98992CDC740B
SHA1:	778DB512C436A5974B0FB609CF8BE469570E3980
SHA-256:	1FB0110CC12BD0B90B1897862D154C767730B99155A900563284FBC5232062FF
SHA-512:	87269BF2DD4907C7393274F34B2BCED5D47C874BF68640813E891350AED516632E72AE167702F82684153C71350B19CF9EAF24F3784F331083A685A53D550898
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="615271" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER1C7E.tmp.dmp

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Tue Dec 3 15:28:36 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	63298
Entropy (8bit):	2.0277410193244867
Encrypted:	false
SSDEEP:	192:lrRXGkXeZ9GCKcZODXw5n8sYQRirY/3XzOEKqnPTE1hhqcc7OYX+TQ3PrQI:l0Z9xYk5n8sYUiM/XJPKqcbYO0jQI
MD5:	BF786D40E5861447440FB62769D8B180
SHA1:	5A831CE91171FE8DE2C316B2A32FD6BCF5C1EF11
SHA-256:	0C919784676C29BE5828B1B5A2C10A393129721087E5AC5CA59C418DDE94B25B
SHA-512:	07DD7F20D34B6F5601C4A7CA21EC6DD986E2EB54E7428D8B27B3D38FD2410B5FCED60DDD621ACFA6BD5A0DA7B2BAFF291BC31FD03FB3AB638F30623AC4D29A09
Malicious:	false
Preview:	MDMP..a..... ........#Og............$...............,...........>6..........T.......8...........T...........p...............,...........................................................................................eJ..............GenuineIntel............T............#Og.............................0..2...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER1DB7.tmp.WERInternalMetadata.xml

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8350
Entropy (8bit):	3.700628921268028
Encrypted:	false
SSDEEP:	192:R6l7wVeJXV6y6YWI6sKoGgmfcLypBa89bVFsf0qHm:R6lXJl6y6Yh6dgmfcLWVefW
MD5:	5A211256FB6F6453BED945F6DC34FDF5
SHA1:	4C533007F95C1E8CF5F86E00BBE4084EE51556F9
SHA-256:	94D0D0D0DC57DE1F317E56F4DC9BAE66C4C1DD55A8F630A0BD0EC1D8BE2FA7B2
SHA-512:	F538ABBA0BA6873227913E65787855B06D489D0C4B85056940667FEA8FAFB60CF5D6A018042B52796866D089F5F8EB8250E3570DB6AEFCB2B4788C02127755EF
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.3.5.2.0.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER1E54.tmp.xml

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4604
Entropy (8bit):	4.4760905478282025
Encrypted:	false
SSDEEP:	48:cvIwWl8zsZKJg77aI9LEVWpW8VY4oYm8M4JYs4Fn+q8fSbNHpN9d:uIjfCI7Nh7VjFJ+hBpN9d
MD5:	E58C1D3B2B8BC3FF3E0A6D8234F3DDC3
SHA1:	6A6313E675D5493C4BD79C7C9D363675ADEC5777
SHA-256:	9AD4C19EA7D999662F2E1DC8A9029D45696C849EE1EBE29F7B916C83BA38006E
SHA-512:	2AF130054C586CFE68628FF86C737A3146EDFE7C5034F1BA6294B6CD897CB73BCB511EB70B0A82D36487C95F1450E975F8E3316DD9D12E74952BE38C30C3E36F
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="615271" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER1F0E.tmp.dmp

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Tue Dec 3 15:28:36 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	24984
Entropy (8bit):	2.4303857704061462
Encrypted:	false
SSDEEP:	96:5g8oaxSX6us0UMLwXgnzAWYZj4tIXTzIpOi7oQnXa2cWwF4v86E+DfxOXUwiWIkF:loajp7XyTYcIXTMOOHXwHs5fCUaCEuu
MD5:	E570C39EBA47C404396E8AC98D9581B2
SHA1:	1C99788ABCBDD106031EC6A6B56BE20EA60F6A56
SHA-256:	F5653E1339D6162E79DA9CEAEBB06E73786DA825F2851AEDE54E365C7DE7A11E
SHA-512:	6591D158E88B4899FF240205446212F41489BC3B68FDDE6B1A221CFEBCA169674AB06C359CDBA9923168411D4F2B9F063C62DC6D84CB45F0758F348157B8954E
Malicious:	false
Preview:	MDMP..a..... ........#Og............4...........x...<.......d....$..........T.......8...........T................J......................................................................................................eJ......8.......GenuineIntel............T............#Og............................. ..2...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER1FAB.tmp.WERInternalMetadata.xml

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8308
Entropy (8bit):	3.692206965313147
Encrypted:	false
SSDEEP:	192:R6l7wVeJW8656Y9iSUIygmfla+wypDN89bVBMnsfuHm:R6lXJt656Y4SUIygmflmlVBMsf/
MD5:	7565B38F6C7C654CDF908F19131F9B46
SHA1:	C40F8A201260A174B66710DAEFA781DB1630B9E5
SHA-256:	2D820C6F2EAB5D9FEDF48EC22C67AA1F2848D163DC60C3A92ED07AF378763510
SHA-512:	2FAC0702172DBD77F7D84552886D3786BD17D5F492B8F80BA73FB1E5F8C70508D0888863C32D9FDA90F69ABB15481FB6C45EFE4A44356B70BFA68F92A6BA24E3
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.3.0.8.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER1FCB.tmp.xml

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4558
Entropy (8bit):	4.432555879632186
Encrypted:	false
SSDEEP:	48:cvIwWl8zsZKJg77aI9LEVWpW8VYAYm8M4JYsNjFR+q8fYPwWNHpRd:uIjfCI7Nh7V0J52WBpRd
MD5:	97E1B0D6F838BD15A9BF28F1A6CF6AFE
SHA1:	3BD45B8F61403840B8416FEFB8E9219284B1521F
SHA-256:	66A7F8EB12801E2AF33D7508EA812D18CDC596036A71274BFF45CF8671F61358
SHA-512:	257DEE11D882A817B363BABB35CA1A08F4AA17CFE0103C8FF58ACD8D0E0BD3EB56C282F88E462496B085A54B8CED71BD19F43040868589E04A466085C1DC813C
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="615271" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER220B.tmp.dmp

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Tue Dec 3 15:28:38 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	68990
Entropy (8bit):	1.970753497098745
Encrypted:	false
SSDEEP:	384:/eyivQdO9INk5jJpS3sAw0BXP2qcEeT6IAo:/2IA9Ck5dUvw0FjoV5
MD5:	6C9A52E9D97D467CF193E8C02ABF14C4
SHA1:	9C7599E8888465F069275697D4F47C0FE9FEC63D
SHA-256:	4FBD6DE3193C5DEB375BA378858818BA93F6920E96648C8C21B8C8345978B889
SHA-512:	54B9F7349D7BBB877F10AD944416E813849F041232980126D518EE28AA80F5985264137B9D19774117073BBBB425A4248615B17428772438827BE533E2A13B33
Malicious:	false
Preview:	MDMP..a..... ........#Og............T...............\...........:9..........T.......8...........T...........................\...........H...............................................................................eJ..............GenuineIntel............T............#Og.............................0..2...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2597.tmp.WERInternalMetadata.xml

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8350
Entropy (8bit):	3.7013879889843717
Encrypted:	false
SSDEEP:	192:R6l7wVeJX46L6YWw6sKoGgmfMaAjAaypB089brFsfs5m:R6lXJI6L6Yp6dgmfMaAjAaUref/
MD5:	1F07C850B989453B8F9BB83A7B51116C
SHA1:	2A717A799F2E8E2403095B15828BDDC3C47CC879
SHA-256:	DD66552CAEB5A51385B1ACC9829F5B34A75A2D45283EABE2C605142723450FDD
SHA-512:	3609410CA85436F2725B52B426F344A7CD32D7B58008DE7566DC13C8BEEF3697BAF94E35D62F37327BE264DEABB78225B3BDB60350097C8612243CED8574183C
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.3.5.2.0.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER25F5.tmp.xml

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4604
Entropy (8bit):	4.473712296742772
Encrypted:	false
SSDEEP:	48:cvIwWl8zsZKJg77aI9LEVWpW8VYcYm8M4JYsQFk+q8fqbNHpN9d:uIjfCI7Nh7VAJJ5BpN9d
MD5:	2D83F59E63651AC698C59BB840F6AC03
SHA1:	BA45CEEE517566EFF5D1D4E875CE10A42C69E5BE
SHA-256:	75286D1C716E9CEC168155F2854F3E94802F038F54C8ACAF583B2B3229461137
SHA-512:	9C563B37CBB9C6EC288F353F90AA1AE30FD9A3D0911D6DFF07AD77EC65E58954FAC28131D74E4290363FA5498851EAF1102CA2D861A1FA201ADB7F8D89A2849D
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="615271" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2893.tmp.dmp

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Tue Dec 3 15:28:39 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	63396
Entropy (8bit):	2.0292292939068344
Encrypted:	false
SSDEEP:	192:2hRXGkXeZ93mODXw5X8X3OEKqD9psTVNypPTERhhqcc7raXnNQ3PrXE2:C0Z9hk5X8X9PsZNypP2qcCa3ujXE2
MD5:	8445EEFD1F4C92C4452AD8C84D462B7A
SHA1:	D405F4A6B4EB78B03DC145CDE3A303A69A2AD03F
SHA-256:	C0F28B40A98EE60D6BB3342C86237F823F6DF18F0AE4A0F81FF65E276F5BB0FF
SHA-512:	D8FBDD88F5ABD31847723B0A7524B1A71B2DC8B2BCBB09DF170E41F6514D8E367EB05E6D0129411D5A33940943A1BF0411175A171723D580E9C5226D16B8EE3D
Malicious:	false
Preview:	MDMP..a..... ........#Og............$...............,...........>6..........T.......8...........T...........................,...........................................................................................eJ..............GenuineIntel............T............#Og.............................0..2...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2911.tmp.WERInternalMetadata.xml

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8350
Entropy (8bit):	3.700301505539002
Encrypted:	false
SSDEEP:	192:R6l7wVeJXj6c6YWF6sKoGgmfcLypBT89biFsfT+2m:R6lXJz6c6Ys6dgmfcLxiefTW
MD5:	54220628EE6CB69BC62642BA0E5B40A8
SHA1:	1566642A331169345327D5F9A3DE56F3CBC41467
SHA-256:	C8C5A4B02F2C876B56AAF38776B2F5526A425E52EE39589DD458547302179F5B
SHA-512:	84609C0690CA00B2E85C2635485445C81FF0F6282FBDBCCBBCA62C2E8034A180BF6A311312522454EB4A00B6FA3A1887AB606472E6BD728F114CB424E9BC732D
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.3.5.2.0.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2941.tmp.xml

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4604
Entropy (8bit):	4.477929969485828
Encrypted:	false
SSDEEP:	48:cvIwWl8zsZKJg77aI9LEVWpW8VYWYm8M4JYs4FD+q8fSbNHpN9d:uIjfCI7Nh7V2JmhBpN9d
MD5:	E4B7566806796F8996877D91DEA54E00
SHA1:	CCB797D9C23434D5C698F3905B7743B5CC31DA90
SHA-256:	36E03E92B0DC0411E967C0BACA615218EA2CCAC5180C1CDA8F2789219A2A969E
SHA-512:	37A75986645221630EB2EF246E9F6B0E5E86EACD92DD2D174E8C958FC443749DC73A95B0EA076CE6524B352E1DBF768B5F972B166443B4FE7FD35E3D08D3F23B
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="615271" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2CBA.tmp.dmp

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Tue Dec 3 15:28:40 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	83370
Entropy (8bit):	2.1071481449307345
Encrypted:	false
SSDEEP:	384:doi0a0IBk5HIXsKSX4Sfb+EARYKzDP2P4qceTt4Fkb:do1jIBk5HIXnSj+Eivzy1Zikb
MD5:	9898764388311E1E84420B61CF6FB4DC
SHA1:	0427CB2AC71C48D3992FF2B767BA79B6DF1785E8
SHA-256:	69A1FA0261A7A84661B5E033DDC918FED5BB14711DBB353B3FFAF8C10A65F9C4
SHA-512:	CA66EE54E4FEF539691596C411A96CD700AAE7AB5B863DFEAD305D03B6A17F101A3BC7150497E7D6894452F93DAD4A5672AC850FC6462932361D08175D3F9786
Malicious:	false
Preview:	MDMP..a..... ........#Og.........................................>..........T.......8...........T............%... ......................................................................................................eJ......, ......GenuineIntel............T............#Og.............................0..2...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3007.tmp.WERInternalMetadata.xml

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8350
Entropy (8bit):	3.702025012369004
Encrypted:	false
SSDEEP:	192:R6l7wVeJXS68X6YWU6sKoGgmfcLypBM89bdFsfn/m:R6lXJi68X6YN6dgmfcLMdef+
MD5:	7BC623D43D0DF1655D06653928A319ED
SHA1:	DD503E65DA4566DBDF38B86485802F223C9A0DAE
SHA-256:	8A8D5455EC608A5BD900CF82FCAF2AFFEDB54F8B94FF926E911BE549B6319144
SHA-512:	2DBCC1DDCDA634D996DA3360E6EF7CF62F9E8108ECA66C534FBBE3824BC3586D3A603B9998C61BF2AA385B3BCDA73EEAE93064A9A04A73A9C5E76DDE5C6A557F
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.3.5.2.0.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3046.tmp.xml

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4604
Entropy (8bit):	4.473657205653749
Encrypted:	false
SSDEEP:	48:cvIwWl8zsZKJg77aI9LEVWpW8VYYPYm8M4JYs4FDDEI+q8fSbNHpN9d:uIjfCI7Nh7VLSJQhBpN9d
MD5:	FEE0B0827B512D2EBC397F4299AF1B3D
SHA1:	48EF60A6BCF7B869E9D127264BADFD8D08FBD98F
SHA-256:	5C603F86ACED4030AE9ABD4316EEFB91EC43C8EDD7E023C083E2386D328AC077
SHA-512:	B8422037FB9B1F2BC7F12470F293D2EB05DBED4F82B37350AB716D609017B5B803F684F34AB9978AE4DF2E3324F4E94BCD04982154548C0791C40C8097C03B92
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="615271" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER32D4.tmp.dmp

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Tue Dec 3 15:28:41 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	83514
Entropy (8bit):	2.14288799902023
Encrypted:	false
SSDEEP:	384:Dj/0a0CSk5n9t4jSfpstygA9YuzaP2P4qc0wJv/5e:Djcj9k5n9t4jSRMFCTzb1ws
MD5:	A912267542337095891E65D7ED647194
SHA1:	3A528D1907BA85CE56ED18D66290686ADB759384
SHA-256:	B5290C1A924BF491FE855194493364F3A17C3591FF7E3CC11CDD408739B0480C
SHA-512:	30D48788248543D9E79527DA5CB5EB6210312FA82452DAB7199190799AB2E5C8B53DB45179E1ACC2634D5CCDCF1185609A2CEEAE5DEBA7766C3EFA586734B3D3
Malicious:	false
Preview:	MDMP..a..... ........#Og.........................................>..........T.......8...........T............%... ......................................................................................................eJ......, ......GenuineIntel............T............#Og.............................0..2...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER33A0.tmp.WERInternalMetadata.xml

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8350
Entropy (8bit):	3.702330264290132
Encrypted:	false
SSDEEP:	192:R6l7wVeJXy68GD6YWu6sKoGgmfcLypB989bdFsf9/m:R6lXJC68y6YH6dgmfcLvdefo
MD5:	7826FB8C3DBB5A63E4DDD4067914643B
SHA1:	44879F225F344C7CD708F7E1880108CE9E398F94
SHA-256:	0171285F529AEC7E483D3F05B85D4C59F120F746CEEA7FFBCF456D9A8D9E473C
SHA-512:	BAF1AB4E7C8451E64BE83F09A7BAE77E640D37E8342C532EB6E5B36F2A1B0FA43B70580F2386F2D145BDC6B2CB03A3C08C9349B5F5B379690B75C6938112C676
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.3.5.2.0.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER33E0.tmp.xml

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4604
Entropy (8bit):	4.4756846381811295
Encrypted:	false
SSDEEP:	48:cvIwWl8zsZKJg77aI9LEVWpW8VYGYm8M4JYs4FTgf+q8fSbNHpN9d:uIjfCI7Nh7VyJ6gfhBpN9d
MD5:	5FC76C9C32D6C6AE0FFFE39D6E067C80
SHA1:	BADCF3BCFBE414C1EF47ACDE474C519E399D7FFD
SHA-256:	5E0E89A724B00200D7288AD5EB376C50D211281AA9C80F54508168A0AB6B41E8
SHA-512:	10D6556C7AA12B999AE27E52CB0C34001F9BB92BA187A8FF5A6ED0178A3EF7E27AA7BCAE705D617C61E3D5EBC10F1688EA588E1A6861814D2DE068183F5CE235
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="615271" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3D06.tmp.dmp

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Tue Dec 3 15:28:44 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	92934
Entropy (8bit):	1.941596436204058
Encrypted:	false
SSDEEP:	384:n+myiKU+xAk53N2ujP63Yyj72PzXs7Xw8qc/qwRYs9xfb1+7mw7oX6AwFmT:n+mLTnk53NTjiRjC7Tx6oF
MD5:	BEEEC09B5F7530A8ADCBA150FD0CDEDE
SHA1:	5B86D2C10212272AFFF5A8464EF1B2262C8545B1
SHA-256:	20BC09461BE5D2B8772888FE48E6B8999155D595C742C3986FD5946A4D5CA661
SHA-512:	7B38190B67E2BA7C380E4E8F254BDE4C15B421F5D6636BF5B34498678E0916F1D5D5E9AC6A59DB118E2D337385F0F20CBDF7D05EB9DE61C04591F3E13222525B
Malicious:	false
Preview:	MDMP..a..... ........#Og.........................................D..........T.......8...........T........... '...C......................................................................................................eJ....... ......GenuineIntel............T............#Og.............................0..2...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3EEB.tmp.WERInternalMetadata.xml

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8352
Entropy (8bit):	3.704035355314841
Encrypted:	false
SSDEEP:	192:R6l7wVeJXw636YWnn6sKoGgmfcLypB089bwFsfTwm:R6lXJA636Ykn6dgmfcL8wefB
MD5:	470D0F93B4934F178AF4EC7080C19877
SHA1:	0697A7D64E4FFDE4F835332804339CE3B39DB6A5
SHA-256:	B4D786A7684C155D888AB94CF518363DC8F2080575681D80CDD3C5A56F200BF6
SHA-512:	B8C91491368D92D5F8DB609B7FE92B815B8E5BDAE5954B4CEF136D3E516371730F48FA83675129D3BE706D2DCBDC7F8471B9F09A3711A75797046A4FC40CE7F1
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.3.5.2.0.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3F3A.tmp.xml

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4604
Entropy (8bit):	4.472820931686653
Encrypted:	false
SSDEEP:	48:cvIwWl8zsZKJg77aI9LEVWpW8VYXYm8M4JYs4Fvm+q8fSbNHpN9d:uIjfCI7Nh7VPJnhBpN9d
MD5:	A59053F0BE7F510B21263B1700EBC3E8
SHA1:	518C97E7380AE01287214B28874A01DF6DE224D6
SHA-256:	850F1E7BB61790920B282DC5DE5C7B7669ABDC5AE5141247FA744B69118E30F4
SHA-512:	0BA35E8FBFE6701B6DDFAB4DF995994DF73C0EDC55C0B266F2995DFF1B5DB69B00DB63C9A1B82C3DEF90CB6AF0D27F2F811715EEB17CF64224C89B9F1B61C085
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="615271" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER8D6.tmp.dmp

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Tue Dec 3 15:28:31 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	59240
Entropy (8bit):	2.111828969798869
Encrypted:	false
SSDEEP:	192:OAC60DXS7XZz6c4oSODXw5NOGOEKZsWfsOf5Nr1Ym3cc747MkTChms:060Kzj4otk5NOXsWfs6NXcx7Mk9
MD5:	5EA53FF0CC07E547A5EF90B6CE63CFB9
SHA1:	22B836885E8709267BCF9D9C626159117E306A3F
SHA-256:	8595F21A767B3370B351B556A0BA7092A1185B1A3871787A28A3177842F3F8F8
SHA-512:	7090959DDB88216865D59E2A2CA84272D2E6229CE78D2A21601A51C4E1A6AD1974F061DAE90C89CD8C74554F402F70B1F30257759DA81DB0B053ADBE88A7F72A
Malicious:	false
Preview:	MDMP..a..... ........#Og....................................t....1..........T.......8...........T...............`.......................................................................................................eJ......<.......GenuineIntel............T............#Og.............................0..2...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER993.tmp.WERInternalMetadata.xml

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8350
Entropy (8bit):	3.6983820874632722
Encrypted:	false
SSDEEP:	192:R6l7wVeJXY61t6YWe6sKoGgmfcLypBg89baFsfRem:R6lXJI6f6Yn6dgmfcLQaefR
MD5:	32AFA5550D1AF7E7193D8AA20479CC3A
SHA1:	40EE12F571F0E111AE8D9EC1A3ED683BC6AD86AD
SHA-256:	FDFBE6F2C8E2F27CEEA878B1429E6AC576C51E86EDAF79E6E38B69CA44B708DE
SHA-512:	CBD71DF2CEA835F8F0F0A704DF9876972D8DAF65E5995ADA657F306DDC16B4DB0A6B7748E57C94E0F96909E126AC425F3F0BD80E1D9A98A1E626C2F567FF48D1
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.3.5.2.0.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERA20.tmp.xml

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4604
Entropy (8bit):	4.476262652562879
Encrypted:	false
SSDEEP:	48:cvIwWl8zsZKJg77aI9LEVWpW8VY/Ym8M4JYs4FMHe+q8fSbNHpN9d:uIjfCI7Nh7VjJZHehBpN9d
MD5:	FC5A13B638ED3340B08A2E409C7317A1
SHA1:	94BE3B063A6F13A21A0BD5DAB78ED907D8224B3C
SHA-256:	FA2034D672679CC59E3EDBC38E3AD4EEEECB1196AE89ABC25A1A48F9417A6625
SHA-512:	513E99463CF57C140C019CBA63A4DE7FD0AB0C292C7D539F22128EB58EF85F459F4003C4AC2AC7D49D7D21ABBFB18068EE3BBC09793DA5362B8388FB84112FD6
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="615271" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD19A.tmp.dmp

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Tue Dec 3 15:28:18 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	77102
Entropy (8bit):	2.3295306692474314
Encrypted:	false
SSDEEP:	768:WyxzE0JkfiUX3Nx2LTtix41Z6MhJuWu21llPp:BEmU4Tsa3/Blx
MD5:	30609B782A02DB06848ABA70E0949637
SHA1:	1048CFB930947F15207C08A84F8D5627735F116A
SHA-256:	034057BE6C92F1B409DC3590AEA6F60EBF9419E05F788195EBBC69ED2C206552
SHA-512:	C1A08B804B31FE4E3D34DF31198B5F7CDAE4C5C6C8E640325D55FFAB11494DDE9350384981A856CE6FEFE81FC88962FAD3754F0490EE857B371615FDB275C477
Malicious:	false
Preview:	MDMP..a..... ........#Og............$...............,...........z8..........T.......8...........T............+..6.......................................................................................................eJ......`.......GenuineIntel............T............#Og.............................0..2...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD6AC.tmp.WERInternalMetadata.xml

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8366
Entropy (8bit):	3.7035916588017557
Encrypted:	false
SSDEEP:	192:R6l7wVeJ2V6uTe6Y9cSU9cbgmfvLypBr89bJ9sfYjm:R6lXJU6b6YWSU9cbgmfvLpJ2fB
MD5:	615ABF404F7EFE6128B9F183BD27722C
SHA1:	9F38E45282ACBEB769A3004763DBB8A6C4A9C263
SHA-256:	2C0E96678FBC35B806D8B1C2FD19E31F97063E78A32895C1BB99855B53E0A21E
SHA-512:	78E01A506AE9962E5B02883E8D16BD93C5C6CE97D0D9AF462C1E44E11150B04DDFA0B13BFDBB09C29FB75DA16CFFF17CAD44E3BEC2C8DD32F52C2FF318E85F06
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.1.5.4.4.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD6FB.tmp.xml

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4619
Entropy (8bit):	4.499920821347055
Encrypted:	false
SSDEEP:	48:cvIwWl8zsZsuJg77aI9LEVWpW8VYeYm8M4JIs4FUR+q8MSBVO4kw81d:uIjfCkI7Nh7V2JhmO4kw81d
MD5:	051746D5D0E929862E1BFDD1869AAAD4
SHA1:	E9C5069A89D2ED238C4E4F0A5EF1E3CB4C0E82C2
SHA-256:	5C7EA8865690AE9F32468502B8D1C92E3762547F0621FA7BCACAB20B41A4C7D5
SHA-512:	93F64D3D855E66DE23B7B60290E9A4FFD74C2C0D3BEC708F9740C40FD5127BED48B8E8D45CF8A2F8058E454420B0EBA6C5C1B863B323475F1AF92D7CD486AFE4
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="615270" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD9D7.tmp.dmp

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Tue Dec 3 15:28:19 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	78754
Entropy (8bit):	2.3758548711487535
Encrypted:	false
SSDEEP:	768:ENzE0skfaoXOFNsU2Itix41Z6MhJuWu2St2:wEiD6sa3/Mt2
MD5:	74C9FEF35BB6D9F2FF83ACB392EE890A
SHA1:	7568507E72C7C0D81751940A1A8D0CAA2CB35696
SHA-256:	0FA6A1EA3DC9934871ABDE124C141080E18CDE42CFE764CED6375D2451D75916
SHA-512:	C363C584BFC43E6A2D3AED15F40ADA2970B28FC2C86179D6586ACE743E69B82DB835FD9DAC40AB83B14F47958873B4F9A6A95EACB725263AD2B296E562501FB8
Malicious:	false
Preview:	MDMP..a..... ........#Og............$...............,...........z8..........T.......8...........T............+..........................................................................................................eJ......`.......GenuineIntel............T............#Og.............................0..2...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERDAB3.tmp.WERInternalMetadata.xml

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8366
Entropy (8bit):	3.7027290869494385
Encrypted:	false
SSDEEP:	192:R6l7wVeJ2c6ZTe6Y9sSU9+uVgmfvLypBt89bA9sfsgm:R6lXJ9606Y2SU9+MgmfvL/A2f6
MD5:	5CCF5A0431BA6203325432837C270ABB
SHA1:	888161DCCA11290C5916C69C0A7D63B9ED61DFB3
SHA-256:	733B960658DEE54FB99626707005E192FF337BF7909AD3A950B28DD6D58B7AB4
SHA-512:	1F463995C706AE0ABC210C2A3D7D66198C75DC4E8C4AA07137EF248E2F84299F3B6620BD72B9B56B2481A82C1640ECA32D544448496F7B502060483CECFC68E7
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.1.5.4.4.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERDAD3.tmp.xml

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4619
Entropy (8bit):	4.501109396440826
Encrypted:	false
SSDEEP:	48:cvIwWl8zsZKJg77aI9LEVWpW8VYCYm8M4JIs4FTC5+q8MSBVO4kw81d:uIjfCI7Nh7V6Jd5mO4kw81d
MD5:	B846D29003EE3D1D995FFFA02FFE351E
SHA1:	145564128A464C91E01E07823155F98A24395A05
SHA-256:	F77EE9C7CCAD7954C692CEEEBC9954BE57B3EA6E837B3D6C415675676C137418
SHA-512:	0B491A87EA4AEF1DABE2AC09A30BE6C799592FEC3B47C1267BB652D69157101174EB129ED74AACACBE7775103E6FC45959F1439749982221239AE9E43A5A61E8
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="615271" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERDCB5.tmp.dmp

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Tue Dec 3 15:28:19 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	84294
Entropy (8bit):	2.362968097001878
Encrypted:	false
SSDEEP:	768:WdotUkf1PXTUwNwZbibixo1Z6MhJulnu2+to:PDIbbiGq3sYto
MD5:	1C9885EBB721C9ABC60A95D9F469C1CE
SHA1:	5D8AC0906CB88FE878EFA549A5D99EFEB09FA341
SHA-256:	14CEDF9AF770FB461938AD7EAE5F81E3EBF6FD3136B899B0E0E04D964F31C421
SHA-512:	26F4C661C3CEC3495FF7450C8C3A63C643F676E33038B7B1ABCEE901E9F45494657D7F5C514E10B494088F6648A790BAC9B50E7869B5735A529BC4E1CD028274
Malicious:	false
Preview:	MDMP..a..... ........#Og............T...............\.......D....<..........T.......8...........T............,..^...........x...........d...............................................................................eJ..............GenuineIntel............T............#Og.............................0..2...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERDD53.tmp.WERInternalMetadata.xml

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8366
Entropy (8bit):	3.7014328625588204
Encrypted:	false
SSDEEP:	192:R6l7wVeJ2x6J76Y9hSU9TSVgmfvLypBG89bA9sfD0gm:R6lXJw6F6Y7SU9TwgmfvL6A2fO
MD5:	603E43BBD0D46BB7E0DC44E1C84BB91D
SHA1:	1B63C10C2B1F85831103EC1C996A81F32875D277
SHA-256:	6DE3606923C4836BFC6DE39C410EBD1DBF838E66C11011343E7B12941971FD6C
SHA-512:	3EF5384A76216FF63C128756A7A05AF724C4AD5795C8CB394EA32CAC5559F1A558EE4B10DB063617A6C9DFED98B08A95C952850EEF3C2FB1BF4FC3958B67D4CB
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.1.5.4.4.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERDD83.tmp.xml

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4619
Entropy (8bit):	4.500247580987624
Encrypted:	false
SSDEEP:	48:cvIwWl8zsZKJg77aI9LEVWpW8VYXYm8M4JIs4FQ+q8MSBVO4kw81d:uIjfCI7Nh7VTJxmO4kw81d
MD5:	55C4359CB2E08E106E7A6F15AA945C52
SHA1:	C369E28218081A9DDDD0A854B7F17850DD724037
SHA-256:	E8F50FF29AE1CA9AA5CE48FDDE1591C611D4C57FE0A83038E2D8110A97127688
SHA-512:	274BAC0C83049A694674A6EC7D92759D07306B0F957469E632402A12F4B323828588E759C21F3F39FAFA98BA4EFADFBEBA473E3AA3DE2CC52F1C3CF29B77A992
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="615271" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE188.tmp.dmp

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Tue Dec 3 15:28:21 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	91128
Entropy (8bit):	2.100789020500974
Encrypted:	false
SSDEEP:	384:cuBEjKIkf5suHXT+gcauDA4PPU42sJNG2El0x+LDUx4Xfo:cuyjKIkf5lXTdcauA4Pr2+G2l+L24vo
MD5:	4603A16F1581FD7DA42A6D18F52FED02
SHA1:	444458C9B8C86D035EF929E7468475B47D221066
SHA-256:	B0E58FE309054E82084B4876EAD14DF3C7A8EA844795A878A56EF82DFB1AFA91
SHA-512:	653C39002510A7174270E7666B2324C8700101D5FCBED16C2DEDBDE7394A6F497EB06C2D9D50337F4E8DF1B025C303FC7375A71DA203858A16C1676DF81DC435
Malicious:	false
Preview:	MDMP..a..... ........#Og.........................................A..........T.......8...........T................5......................................................................................................eJ......\ ......GenuineIntel............T............#Og.............................0..2...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE215.tmp.WERInternalMetadata.xml

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8366
Entropy (8bit):	3.7032872408475495
Encrypted:	false
SSDEEP:	192:R6l7wVeJ2Xh6V6Y93SU9SGgmfvLypBL89b79sf7pm:R6lXJsh6V6YdSU9SGgmfvLZ72fY
MD5:	8F627AAB5FDF6898F6D0E99ED2B897C9
SHA1:	F8E1FC4EF5C465D97B600B3EEF95C2B6F0D5082A
SHA-256:	30C503745D98AA875226D5797A0E1EC435C52FB51A78D3C2A8D92C346EBD6CAD
SHA-512:	854B9D9A5D019D2E218A9F497FE3FC0608732A91A1C2ADD593CB97D6C60820BDA39A28DED6FD3CE053E0907924E6C62E9532688341E4AD101BE00DCD34FD099D
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.1.5.4.4.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE245.tmp.xml

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4619
Entropy (8bit):	4.499112958953283
Encrypted:	false
SSDEEP:	48:cvIwWl8zsZKJg77aI9LEVWpW8VYWovYm8M4JIs4Fq+q8MSBVO4kw81d:uIjfCI7Nh7VHDJnmO4kw81d
MD5:	219CFDEDABF90356BE213A922B29D199
SHA1:	3A7A012846FBFAE77FF6A2E5EAA049F2146E10C1
SHA-256:	7446BE840697438D628CAF6F5AA391C0555B368836F4E1A30ADE255F62AEEBF4
SHA-512:	E60384AABA14C2663B9F3A46330D437E24733412619016529C6C78757DA4D71DC01CFDAEFD37744CB4A6FF1CA74615F3DECFF1A5C5611F14FC711ED736E8E273
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="615271" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE495.tmp.dmp

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Tue Dec 3 15:28:21 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	95244
Entropy (8bit):	2.0110875006916427
Encrypted:	false
SSDEEP:	384:gcOxuBfj5DkfbYiHXlDfZcaXDAvsy9m2BG2EPhE7uTqTGgaHIboPMTb/tgaA:gjxUL5DkfbNXl1cazAvhDBG2p7hgf
MD5:	F3913E81A80BBDE7240FC112BE2FBDD9
SHA1:	C9597E6C881D356CAB5372244D8B0C5063E9ECDB
SHA-256:	BC6318145B1B341C042FEE8FE1A073823EEB74F4087247CC2920698B60E7C6BA
SHA-512:	1F333FD23E59870CADA318F615A89B79D412A5E7E89883037943D46CE9F0004E2127A7ACEA2F52F58074D318B8D232405DFF3BE839B8086B0C3521A11C8AA796
Malicious:	false
Preview:	MDMP..a..... ........#Og.........................................D..........T.......8...........T............-...F......................................................................................................eJ....... ......GenuineIntel............T............#Og.............................0..2...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE5DE.tmp.WERInternalMetadata.xml

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8366
Entropy (8bit):	3.703992056433316
Encrypted:	false
SSDEEP:	192:R6l7wVeJ2L6826Y9PSU97NgmfvLypBO89bA9sfiAm:R6lXJq6826YFSU97NgmfvLyA2fU
MD5:	D03F57ADE39E5F3EF15BE72012B1BBC9
SHA1:	DE183BAAB21FE2A992CE9A0E9CEAAB815E4F692C
SHA-256:	F4D7240BA4A5B0D3C1648727BB7EC44CB236A1FCACDC692BAB957E1FB4734ABE
SHA-512:	CD6DBFB3A67D72C963FDF39131F4DF2E64F0C0BA64FBBD4BFDD0B58B07F0F465E524B4C799E526DB3C59F7828B8C2C4A0CDE082E11819FA4D6F883A3B96C6CDB
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.1.5.4.4.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE60E.tmp.xml

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4619
Entropy (8bit):	4.498894745135956
Encrypted:	false
SSDEEP:	48:cvIwWl8zsZKJg77aI9LEVWpW8VYSYm8M4JIs4FOq+q8MSBVO4kw81d:uIjfCI7Nh7VGJ/qmO4kw81d
MD5:	CAC4A32695E31730BCCDBC273E9C0A2B
SHA1:	8AD38EFACC3A908BBEDA4A5A6D2CA0EBE6B8E15F
SHA-256:	5B837239E88A81F50BE18CA2696F008F313B779F91F36F0F462A01B9A5DC694F
SHA-512:	0485E36B961D234D1EEC4BD8949212A19E3AD8E918D9CFBDAD90899E4CBD013B93B90CD5DEE768DF6D95A236BEC1DBE334015FF30E09AC38D3DB311C5F2FBC8E
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="615271" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE88D.tmp.dmp

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Tue Dec 3 15:28:22 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	94820
Entropy (8bit):	2.0227147313677922
Encrypted:	false
SSDEEP:	384:aE0Bfj5TFkfhx7UOxHXlDeLGsmVaTDAum2seG2E+jvec/QY5HtjSbjvDbnSHvnvM:aEGL5TFkf/jXlIGla/AuDseG2Cjz
MD5:	11F105E747731F107A89241D33E47233
SHA1:	C9624FFB3CE929C86C21F86314CD0653121C3A74
SHA-256:	874D70FEE697CCBF2616D5F79AAA192DEF3BD58549CA958A38196EC6DCF0648A
SHA-512:	D2BDD283AD1AE79914E08A776F6C95B66855246033FB80204A49AE24F3992D4687E6E5597954CE701B4DC7403FF300FBD84542B87CAB88E9258E0A4AC51DF7CD
Malicious:	false
Preview:	MDMP..a..... ........#Og.........................................D..........T.......8...........T............-...D......................................................................................................eJ....... ......GenuineIntel............T............#Og.............................0..2...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WEREA14.tmp.WERInternalMetadata.xml

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8368
Entropy (8bit):	3.7049010425704902
Encrypted:	false
SSDEEP:	192:R6l7wVeJ2jB68P6Y9qSU9mdgmfvLypB089bJ9sfeDm:R6lXJYB68P6YgSU9mdgmfvLUJ2f7
MD5:	1A62F6843DEB8E286F89638F68CC32E4
SHA1:	D45B204249B11C19AD22CED48076E026ADD95E55
SHA-256:	3C59986F2E3DDA0AD47509B452123CE6765E6B75529F7A4ED56FA4FEF61ECC9B
SHA-512:	00B43BAD77C4D759EC5A73ACE244B32DC99E5C4E4FE2D8EB3FFF925454DB9F4F236064B3013569A5F83937CC5C66BE1476C75E84327FB5AF7AAFB16AC1AC858D
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.1.5.4.4.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WEREA63.tmp.xml

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4619
Entropy (8bit):	4.500105586803633
Encrypted:	false
SSDEEP:	48:cvIwWl8zsZKJg77aI9LEVWpW8VYSPYm8M4JIs4FPd+q8MSBVO4kw81d:uIjfCI7Nh7V3SJ0mO4kw81d
MD5:	D346C9E4FAF9A9E6277F00700895B572
SHA1:	9C0B4263A5876C82444F56337B5AA7523C784978
SHA-256:	E4AF59CD5D6CBCE722BC09F8C38E869722C9F8DCB72FB79DAC4233191AFDBC66
SHA-512:	EB086C041F783C1D5946A6DE774ABB8DBAC3BEE5C78C66969C7DA2092887C9A730DDC6AF8834271DC5B533AE2E33BED9D19809CE6FF0533D88A48667ED236D04
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="615271" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WEREDEC.tmp.dmp

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Tue Dec 3 15:28:24 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	103634
Entropy (8bit):	2.210681098408713
Encrypted:	false
SSDEEP:	768:LQL50kfHskXlXIkMtH7AuDsRG2wtMA6/e+:wek6dtHc6MqtMJ
MD5:	8F7700D0A1DF7F708840FCF340A93E38
SHA1:	F5E8102A7F4690449DA3D6CA15691AD458756103
SHA-256:	8790D8E68E56B0AC8DDD8286A0C788A51D6B5FB627D227D64AC0A0E33B851EA0
SHA-512:	6B320CBF8FEBC07193FE3317485F8C4ABB38BF7E5F14F79D93A82985910022528389CD4A4A5A1F00030189B7DDDB1404B8AFA34FE55F8B0D75E5662D99F60A5C
Malicious:	false
Preview:	MDMP..a..... ........#Og.........................................D..........T.......8...........T...........@/...e......................................................................................................eJ....... ......GenuineIntel............T............#Og.............................0..2...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WEREEB8.tmp.WERInternalMetadata.xml

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8368
Entropy (8bit):	3.703340364779308
Encrypted:	false
SSDEEP:	192:R6l7wVeJ296ek6Y9tSU9vggmfvLypBT89bW9sfmym:R6lXJk6ek6YnSU9vggmfvLBW2fa
MD5:	D39720176F8CCEE67ACBBE11AC4A3A38
SHA1:	1EB8B95AFEDAF2949FC4151CCF3BED2BC6FC7C6D
SHA-256:	62C88F2CF1E2B17728EC7A47D183C6D04FD0BDC048BAD0E7FE1C78B4AE63C58C
SHA-512:	317F6CBAC0ABCFD108011331567863B991C426BCC8EB28FA95173B629D8A7EFFDAA1A8A430E3D114484B9C0281B81FECD6F425722AFB84DACAA7CF398CEEDDCB
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.1.5.4.4.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WEREF26.tmp.xml

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4619
Entropy (8bit):	4.498934585724307
Encrypted:	false
SSDEEP:	48:cvIwWl8zsZKJg77aI9LEVWpW8VYXYm8M4JIs4F7MO+q8MSBVO4kw81d:uIjfCI7Nh7VXJWMOmO4kw81d
MD5:	24320A2D01017608B1D182169B78073A
SHA1:	5AE2890533DF24F2E715E82C3D282EA0A4FE6256
SHA-256:	B4D965A64A0748FB830227C99F19336A0F3BD77831654B04C9CBB59E5A37A77A
SHA-512:	0F0F63B6F9D499F9E4BF9875EB3C20253DE9A4D24A0FCDD2565D2C07B6684328675E5CB28B07BE43813127C020140C8849D15664730B6A8CA6CD5F689101EA92
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="615271" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERF30C.tmp.dmp

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Tue Dec 3 15:28:25 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	39086
Entropy (8bit):	2.5377839500656973
Encrypted:	false
SSDEEP:	192:McN2XSbI07XWhXed0hXHNNODXwfw2pNaBYW5rWjG+ult/tvI/HyB1Pu5b24zePyd:bBI0S80lNAkfXaBYW5UePYH4RQxz
MD5:	F33A86072C780D9B7B0E031E0E535E38
SHA1:	CE4AD4C4D8C7752DABE3C253806C6CE451873CA0
SHA-256:	8F0983C9086771CADB6887168685EE34C9AC97E3A9478DCBA0F6BAE604A999AB
SHA-512:	BE10EE47895E5C98C6AC5C4CF2307ADFE7BB9CBE818AF6031F3478D0FC1515B923BFE5C60393C8035BC90F79E8B5C3480B4E38A0932F7707B956DA047570790A
Malicious:	false
Preview:	MDMP..a..... ........#Og............4...........T...<.......T..../..........T.......8...........T...........(3...e........... ..........\|"..............................................................................eJ.......#......GenuineIntel............T............#Og.............................0..2...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERF3B9.tmp.WERInternalMetadata.xml

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8328
Entropy (8bit):	3.6942740956862687
Encrypted:	false
SSDEEP:	192:R6l7wVeJ2e6ECIe6Y9hlSU9wqgmfdn6rypDZ89bf9sf0k1m:R6lXJX6F6YLlSU9wqgmfd+Zf2f+
MD5:	8BED9D606EB5882ACE9854517920122E
SHA1:	3DBFA7921CC6B123792668735A1D2E54AE25CA2B
SHA-256:	2D3C38117D4E81B7353CC1D5DAE3A9FB3B0605749ECB42CE81BF7A15F58985B4
SHA-512:	56B640B76C89FD92E8F955EB31888D35E9D95E694A48FD0FE4273BC4E4714E402D91838FA23F1F45CFD532920B0C62387A19978F43CBAC874BE9FBE34A946E81
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.1.5.4.4.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERF437.tmp.xml

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4579
Entropy (8bit):	4.465739301965919
Encrypted:	false
SSDEEP:	48:cvIwWl8zsZKJg77aI9LEVWpW8VYrYm8M4JIsMjFXM+q8MZP0VO4kw81d:uIjfCI7Nh7VLJdqO4kw81d
MD5:	16F29BBC40537F1B2DF0A1AC1E8B2C7B
SHA1:	BDE9AF6DEB6E4F49AC307266053C24B2D8A00DAB
SHA-256:	7E357E0C4992A2B6C24D9F7B4F5AB8142F85A70C12482F9C3F5544081EA38797
SHA-512:	504D1C9D506B5CDE605FC85FD63FAFB4036D32F74AB229A09254C20C862378893C3C290D038CD632EA162E189E5BF5EE889C98DC8890BC5179F8E87153E62281
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="615271" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\json[1].json

Process:	C:\Users\user\AppData\Roaming\yava\yava_vd.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	963
Entropy (8bit):	5.013758486871551
Encrypted:	false
SSDEEP:	12:tkluJnd6UGkMyGWKyGXPVGArwY307f7aZHI7GZArpv/mOAaNO+ao9W7iN5zzkw7x:qluNdVauKyGX85jvXhNlT3/7AcV9Wro
MD5:	A0B25AA7ACE7B58B8A68A3B043CBD1A2
SHA1:	557B3E91B19FF73B980577D21B0759ACFB694334
SHA-256:	FF65B6A6CAF43C5830DA137836E99CC4F2DC511116EC72A8F180A17FCCB17526
SHA-512:	581BF3DEEA3713D383A87024CEA8C3B913FE1138C3D5A9D9D50854EB12DF8D8FFF3239ECB5DC21A24CD337DB7CE4655E6EB373B9524E6BBF160EAB31323CE894
Malicious:	false
Preview:	{. "geoplugin_request":"8.46.123.228",. "geoplugin_status":200,. "geoplugin_delay":"2ms",. "geoplugin_credit":"Some of the returned data includes GeoLite2 data created by MaxMind, available from <a href='https:\/\/www.maxmind.com'>https:\/\/www.maxmind.com<\/a>.",. "geoplugin_city":"New York",. "geoplugin_region":"New York",. "geoplugin_regionCode":"NY",. "geoplugin_regionName":"New York",. "geoplugin_areaCode":"",. "geoplugin_dmaCode":"501",. "geoplugin_countryCode":"US",. "geoplugin_countryName":"United States",. "geoplugin_inEU":0,. "geoplugin_euVATrate":false,. "geoplugin_continentCode":"NA",. "geoplugin_continentName":"North America",. "geoplugin_latitude":"40.7123",. "geoplugin_longitude":"-74.0068",. "geoplugin_locationAccuracyRadius":"20",. "geoplugin_timezone":"America\/New_York",. "geoplugin_currencyCode":"USD",. "geoplugin_currencySymbol":"$",. "geoplugin_currencySymbol_UTF8":"$",. "geoplugin_currencyConverter":0.}

C:\Users\user\AppData\Roaming\yava\yava_vd.exe

Process:	C:\Users\user\Desktop\E84Ddy7gSh.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	466432
Entropy (8bit):	7.204088809656108
Encrypted:	false
SSDEEP:	6144:sPm7KDoBlJL4vhsEAC7rWzLKmVn4RIM0EeNXWizh/Kkc6k4qHVWO1XO/gvJ/j:IELksjq0KmFbEeJN1Kkc6xqHVlVj
MD5:	60E18D4606431A33C406C1AD21DDC4E2
SHA1:	F8E773F104FCFD6DF48EE21591CE8890FD8942C5
SHA-256:	7FCE076AE6458C561DCB1E5CD6A1DE47AA114D5758DC791F0A94402AC4A9F2EE
SHA-512:	00C74A249BE8AC164BE201161ACEB35E272F007E65EA6D740043BA89A55A69B7A01283D50FD446E774DF05F869D9D6418F8D82FFF5422133A36BEBC2F8FAF22E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 68%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............o..o..o..=..o..=..o..=...o....o..o...o..=..o..=..o..=..o..Rich.o..........................PE..L..../e......................r.....h.............@..........................Pw.....C=......................................T...<.....u.@...........................................................@...@............................................text............................... ..`.rdata... ......."..................@..@.data...\|.o.........................@....voguxu.......u.....................@....tls.....3....u..4..................@....duhasid.(...Pu..(...(..............@....rsrc...@.....u......P..............@..@........................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\yava\yava_vd.exe:Zone.Identifier

Process:	C:\Users\user\Desktop\E84Ddy7gSh.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Windows\appcompat\Programs\Amcache.hve

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.46813687236089
Encrypted:	false
SSDEEP:	6144:MIXfpi67eLPU9skLmb0b4nWSPKaJG8nAgejZMMhA2gX4WABl0uNCdwBCswSb8:xXD94nWlLZMM6YFHw+8
MD5:	39714129D0ADF7A8A042F6579FF1DCFF
SHA1:	FB1D90791F9FFED049BF718CDFA98F9C3192F631
SHA-256:	BC8B5C6E1842FB7DB1BCEB7FC066BA1DFCA94FA2CD4AC807FEC338143E2208E2
SHA-512:	AB40F798920DF29D3C896E3AD321AF1A8C07D4351F71908274D9178E0639E5F4891989E1D1B910C12D91501C180E1EA38E1561A0F477AB188ABC80F56AC26E7F
Malicious:	false
Preview:	regf=...=....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm.m...E...............................................................................................................................................................................................................................................................................................................................................B..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.204088809656108
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	E84Ddy7gSh.exe
File size:	466'432 bytes
MD5:	60e18d4606431a33c406c1ad21ddc4e2
SHA1:	f8e773f104fcfd6df48ee21591ce8890fd8942c5
SHA256:	7fce076ae6458c561dcb1e5cd6a1de47aa114d5758dc791f0a94402ac4a9f2ee
SHA512:	00c74a249be8ac164be201161aceb35e272f007e65ea6d740043ba89a55a69b7a01283d50fd446e774df05f869d9d6418f8d82fff5422133a36bebc2f8faf22e
SSDEEP:	6144:sPm7KDoBlJL4vhsEAC7rWzLKmVn4RIM0EeNXWizh/Kkc6k4qHVWO1XO/gvJ/j:IELksjq0KmFbEeJN1Kkc6xqHVlVj
TLSH:	40A4CF12A2FB2911F7B34B314EBAD6A4266FB9235EE4725F3204663F09712A1C533707
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............o...o...o...=...o...=...o...=...o.......o...o...o...=...o...=...o...=...o..Rich.o..........................PE..L...../e...

File Icon


Icon Hash:	0819234d010dc951

Static PE Info

General

Entrypoint:	0x401668
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x652F8FEB [Wed Oct 18 07:57:31 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	eb87f6f93a30d1ccddb20207cf8c00c9

Entrypoint Preview

Instruction
call 00007F178525383Ch
jmp 00007F1785250AFDh
mov edi, edi
push ebp
mov ebp, esp
sub esp, 00000328h
mov dword ptr [004513C8h], eax
mov dword ptr [004513C4h], ecx
mov dword ptr [004513C0h], edx
mov dword ptr [004513BCh], ebx
mov dword ptr [004513B8h], esi
mov dword ptr [004513B4h], edi
mov word ptr [004513E0h], ss
mov word ptr [004513D4h], cs
mov word ptr [004513B0h], ds
mov word ptr [004513ACh], es
mov word ptr [004513A8h], fs
mov word ptr [004513A4h], gs
pushfd
pop dword ptr [004513D8h]
mov eax, dword ptr [ebp+00h]
mov dword ptr [004513CCh], eax
mov eax, dword ptr [ebp+04h]
mov dword ptr [004513D0h], eax
lea eax, dword ptr [ebp+08h]
mov dword ptr [004513DCh], eax
mov eax, dword ptr [ebp-00000320h]
mov dword ptr [00451318h], 00010001h
mov eax, dword ptr [004513D0h]
mov dword ptr [004512CCh], eax
mov dword ptr [004512C0h], C0000409h
mov dword ptr [004512C4h], 00000001h
mov eax, dword ptr [00450008h]
mov dword ptr [ebp-00000328h], eax
mov eax, dword ptr [0045000Ch]
mov dword ptr [ebp-00000324h], eax
call dword ptr [000000DCh]

Rich Headers

Programming Language:

[C++] VS2008 build 21022
[ASM] VS2008 build 21022
[ C ] VS2008 build 21022
[IMP] VS2005 build 50727
[RES] VS2008 build 21022
[LNK] VS2008 build 21022

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x4e754	0x3c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x2758000	0x1cd40	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x4e488	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x4e440	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x4d000	0x180	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x4b50f	0x4b600	0db0b2fd4778658c9d8e89ea3d69f8f2	False	0.9515702736318408	data	7.936561536852126	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x4d000	0x201a	0x2200	e848fcdca79a56defd5334508ba260df	False	0.36178768382352944	data	5.45893366550017	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x50000	0x26fff7c	0x1400	402422ccc4cc7ed585838cf6dd57a491	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.voguxu	0x2750000	0x400	0x400	0f343b0931126a20f133d67c2b018a3b	False	0.0166015625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0x2751000	0x33fd	0x3400	5c5e82152a1b2e04e3c351b6be64f3a1	False	0.0029296875	data	0.001137551124542444	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.duhasid	0x2755000	0x2800	0x2800	1276481102f218c981e0324180bafd9f	False	0.00322265625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x2758000	0x1cd40	0x1ce00	22834ce058508ffaef843e4cb4629898	False	0.4853219696969697	data	5.455867827182318	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x27589d0	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	Turkish	Turkey	0.5719616204690832
RT_ICON	0x2759878	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	Turkish	Turkey	0.6371841155234657
RT_ICON	0x275a120	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	Turkish	Turkey	0.6941244239631337
RT_ICON	0x275a7e8	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	Turkish	Turkey	0.7521676300578035
RT_ICON	0x275ad50	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216	Turkish	Turkey	0.5154564315352697
RT_ICON	0x275d2f8	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096	Turkish	Turkey	0.6172607879924953
RT_ICON	0x275e3a0	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2304	Turkish	Turkey	0.6225409836065574
RT_ICON	0x275ed28	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024	Turkish	Turkey	0.7526595744680851
RT_ICON	0x275f208	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	Turkish	Turkey	0.7515991471215352
RT_ICON	0x27600b0	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	Turkish	Turkey	0.6845667870036101
RT_ICON	0x2760958	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	Turkish	Turkey	0.5869815668202765
RT_ICON	0x2761020	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	Turkish	Turkey	0.740606936416185
RT_ICON	0x2761588	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216	Turkish	Turkey	0.6459543568464731
RT_ICON	0x2763b30	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2304	Turkish	Turkey	0.6827868852459016
RT_ICON	0x27644b8	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024	Turkish	Turkey	0.6843971631205674
RT_ICON	0x2764988	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Turkish	Turkey	0.39418976545842216
RT_ICON	0x2765830	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Turkish	Turkey	0.5573104693140795
RT_ICON	0x27660d8	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	Turkish	Turkey	0.6192396313364056
RT_ICON	0x27667a0	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Turkish	Turkey	0.6365606936416185
RT_ICON	0x2766d08	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Turkish	Turkey	0.42917448405253283
RT_ICON	0x2767db0	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	Turkish	Turkey	0.42418032786885246
RT_ICON	0x2768738	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Turkish	Turkey	0.4671985815602837
RT_ICON	0x2768c08	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Turkish	Turkey	0.2801172707889126
RT_ICON	0x2769ab0	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Turkish	Turkey	0.3677797833935018
RT_ICON	0x276a358	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	Turkish	Turkey	0.3790322580645161
RT_ICON	0x276aa20	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Turkish	Turkey	0.37427745664739887
RT_ICON	0x276af88	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Turkish	Turkey	0.2594398340248963
RT_ICON	0x276d530	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Turkish	Turkey	0.27696998123827393
RT_ICON	0x276e5d8	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	Turkish	Turkey	0.2872950819672131
RT_ICON	0x276ef60	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Turkish	Turkey	0.3280141843971631
RT_STRING	0x276f5f8	0x9e	data			0.5949367088607594
RT_STRING	0x276f698	0x48a	data			0.45266781411359724
RT_STRING	0x276fb28	0x4ca	data			0.4363784665579119
RT_STRING	0x276fff8	0x688	data			0.4354066985645933
RT_STRING	0x2770680	0x6e6	data			0.43261608154020387
RT_STRING	0x2770d68	0x7aa	data			0.42252803261977573
RT_STRING	0x2771518	0x71a	AmigaOS bitmap font "e", fc_YSize 26880, 19712 elements, 2nd " ", 3rd "p"			0.4317931793179318
RT_STRING	0x2771c38	0x89a	data			0.4150772025431426
RT_STRING	0x27724d8	0x6ba	data			0.4262485481997677
RT_STRING	0x2772b98	0x578	data			0.4421428571428571
RT_STRING	0x2773110	0x87e	data			0.41030358785648574
RT_STRING	0x2773990	0x890	data			0.42244525547445255
RT_STRING	0x2774220	0x5bc	data			0.44618528610354224
RT_STRING	0x27747e0	0x4e4	data			0.4488817891373802
RT_STRING	0x2774cc8	0x76	data			0.6440677966101694
RT_GROUP_ICON	0x2764920	0x68	data	Turkish	Turkey	0.7019230769230769
RT_GROUP_ICON	0x276f3c8	0x76	data	Turkish	Turkey	0.6779661016949152
RT_GROUP_ICON	0x275f190	0x76	data	Turkish	Turkey	0.6610169491525424
RT_GROUP_ICON	0x2768ba0	0x68	data	Turkish	Turkey	0.7211538461538461
RT_VERSION	0x276f440	0x1b4	data			0.5894495412844036

Imports

DLL

Import

KERNEL32.dll

GetConsoleAliasExesLengthA, DeleteVolumeMountPointA, OpenJobObjectA, ReadConsoleA, InterlockedDecrement, GlobalSize, SetDefaultCommConfigW, InterlockedCompareExchange, GetComputerNameW, SetEvent, GetNumaAvailableMemoryNode, FreeEnvironmentStringsA, GetModuleHandleW, GetConsoleAliasesLengthA, SetCommState, GetConsoleMode, GetConsoleWindow, ReadConsoleOutputW, GetVersionExW, GetStringTypeExW, HeapDestroy, GetFileAttributesA, GetNumaProcessorNode, GetBinaryTypeA, DisconnectNamedPipe, LCMapStringA, GetLastError, GetProcAddress, MoveFileW, SetStdHandle, SearchPathA, LoadLibraryA, LocalAlloc, WritePrivateProfileStringA, QueryDosDeviceW, GetModuleFileNameA, GetModuleHandleA, BuildCommDCBA, FatalAppExitA, GetShortPathNameW, SetCalendarInfoA, FindAtomW, GetTimeFormatW, PulseEvent, HeapAlloc, Sleep, ExitProcess, GetCommandLineA, GetStartupInfoA, TerminateProcess, GetCurrentProcess, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, DeleteCriticalSection, LeaveCriticalSection, EnterCriticalSection, HeapFree, VirtualFree, VirtualAlloc, HeapReAlloc, HeapCreate, WriteFile, GetStdHandle, TlsGetValue, TlsAlloc, TlsSetValue, TlsFree, InterlockedIncrement, SetLastError, GetCurrentThreadId, InitializeCriticalSectionAndSpinCount, GetEnvironmentStrings, FreeEnvironmentStringsW, WideCharToMultiByte, GetEnvironmentStringsW, SetHandleCount, GetFileType, QueryPerformanceCounter, GetTickCount, GetCurrentProcessId, GetSystemTimeAsFileTime, RtlUnwind, GetCPInfo, GetACP, GetOEMCP, IsValidCodePage, HeapSize, GetLocaleInfoA, MultiByteToWideChar, LCMapStringW, GetStringTypeA, GetStringTypeW

ADVAPI32.dll

ClearEventLogW

Possible Origin

Language of compilation system	Country where language is spoken	Map
Turkish	Turkey

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-03T16:28:34.929805+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.4	49734	198.23.227.212	32583	TCP
2024-12-03T16:28:50.463184+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49752	178.237.33.50	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 3, 2024 16:28:30.012937069 CET	49734	32583	192.168.2.4	198.23.227.212
Dec 3, 2024 16:28:30.133028984 CET	32583	49734	198.23.227.212	192.168.2.4
Dec 3, 2024 16:28:30.133126974 CET	49734	32583	192.168.2.4	198.23.227.212
Dec 3, 2024 16:28:34.446923971 CET	49734	32583	192.168.2.4	198.23.227.212
Dec 3, 2024 16:28:34.567051888 CET	32583	49734	198.23.227.212	192.168.2.4
Dec 3, 2024 16:28:34.835768938 CET	32583	49734	198.23.227.212	192.168.2.4
Dec 3, 2024 16:28:34.929805040 CET	49734	32583	192.168.2.4	198.23.227.212
Dec 3, 2024 16:28:35.028218031 CET	32583	49734	198.23.227.212	192.168.2.4
Dec 3, 2024 16:28:35.117258072 CET	49734	32583	192.168.2.4	198.23.227.212
Dec 3, 2024 16:28:35.124397993 CET	49734	32583	192.168.2.4	198.23.227.212
Dec 3, 2024 16:28:35.247972965 CET	32583	49734	198.23.227.212	192.168.2.4
Dec 3, 2024 16:28:35.248059034 CET	49734	32583	192.168.2.4	198.23.227.212
Dec 3, 2024 16:28:35.369424105 CET	32583	49734	198.23.227.212	192.168.2.4
Dec 3, 2024 16:28:35.634967089 CET	32583	49734	198.23.227.212	192.168.2.4
Dec 3, 2024 16:28:35.820352077 CET	49734	32583	192.168.2.4	198.23.227.212
Dec 3, 2024 16:28:35.826847076 CET	32583	49734	198.23.227.212	192.168.2.4
Dec 3, 2024 16:28:36.007884026 CET	49734	32583	192.168.2.4	198.23.227.212
Dec 3, 2024 16:28:37.461409092 CET	49734	32583	192.168.2.4	198.23.227.212
Dec 3, 2024 16:28:37.582102060 CET	32583	49734	198.23.227.212	192.168.2.4
Dec 3, 2024 16:28:49.003109932 CET	49752	80	192.168.2.4	178.237.33.50
Dec 3, 2024 16:28:49.123615026 CET	80	49752	178.237.33.50	192.168.2.4
Dec 3, 2024 16:28:49.123744011 CET	49752	80	192.168.2.4	178.237.33.50
Dec 3, 2024 16:28:49.124042034 CET	49752	80	192.168.2.4	178.237.33.50
Dec 3, 2024 16:28:49.244146109 CET	80	49752	178.237.33.50	192.168.2.4
Dec 3, 2024 16:28:50.463073969 CET	80	49752	178.237.33.50	192.168.2.4
Dec 3, 2024 16:28:50.463184118 CET	49752	80	192.168.2.4	178.237.33.50
Dec 3, 2024 16:28:50.502876043 CET	49734	32583	192.168.2.4	198.23.227.212
Dec 3, 2024 16:28:50.622834921 CET	32583	49734	198.23.227.212	192.168.2.4
Dec 3, 2024 16:28:51.502242088 CET	80	49752	178.237.33.50	192.168.2.4
Dec 3, 2024 16:28:51.502305031 CET	49752	80	192.168.2.4	178.237.33.50
Dec 3, 2024 16:28:59.793692112 CET	32583	49734	198.23.227.212	192.168.2.4
Dec 3, 2024 16:28:59.851716995 CET	49734	32583	192.168.2.4	198.23.227.212
Dec 3, 2024 16:29:00.216393948 CET	49734	32583	192.168.2.4	198.23.227.212
Dec 3, 2024 16:29:00.337452888 CET	32583	49734	198.23.227.212	192.168.2.4
Dec 3, 2024 16:29:30.041019917 CET	32583	49734	198.23.227.212	192.168.2.4
Dec 3, 2024 16:29:30.087930918 CET	49734	32583	192.168.2.4	198.23.227.212
Dec 3, 2024 16:29:30.734889984 CET	49734	32583	192.168.2.4	198.23.227.212
Dec 3, 2024 16:29:30.855194092 CET	32583	49734	198.23.227.212	192.168.2.4
Dec 3, 2024 16:30:00.294353962 CET	32583	49734	198.23.227.212	192.168.2.4
Dec 3, 2024 16:30:00.351924896 CET	49734	32583	192.168.2.4	198.23.227.212
Dec 3, 2024 16:30:00.673379898 CET	49734	32583	192.168.2.4	198.23.227.212
Dec 3, 2024 16:30:00.794569016 CET	32583	49734	198.23.227.212	192.168.2.4
Dec 3, 2024 16:30:30.578289986 CET	32583	49734	198.23.227.212	192.168.2.4
Dec 3, 2024 16:30:30.633268118 CET	49734	32583	192.168.2.4	198.23.227.212
Dec 3, 2024 16:30:30.944405079 CET	49734	32583	192.168.2.4	198.23.227.212
Dec 3, 2024 16:30:31.064932108 CET	32583	49734	198.23.227.212	192.168.2.4
Dec 3, 2024 16:30:38.461777925 CET	49752	80	192.168.2.4	178.237.33.50
Dec 3, 2024 16:30:38.792440891 CET	49752	80	192.168.2.4	178.237.33.50
Dec 3, 2024 16:30:39.445842981 CET	49752	80	192.168.2.4	178.237.33.50
Dec 3, 2024 16:30:40.742723942 CET	49752	80	192.168.2.4	178.237.33.50
Dec 3, 2024 16:30:43.336479902 CET	49752	80	192.168.2.4	178.237.33.50
Dec 3, 2024 16:30:48.523916006 CET	49752	80	192.168.2.4	178.237.33.50
Dec 3, 2024 16:30:58.898916960 CET	49752	80	192.168.2.4	178.237.33.50
Dec 3, 2024 16:31:00.859508038 CET	32583	49734	198.23.227.212	192.168.2.4
Dec 3, 2024 16:31:00.914549112 CET	49734	32583	192.168.2.4	198.23.227.212
Dec 3, 2024 16:31:01.340029001 CET	49734	32583	192.168.2.4	198.23.227.212
Dec 3, 2024 16:31:01.460362911 CET	32583	49734	198.23.227.212	192.168.2.4
Dec 3, 2024 16:31:31.558078051 CET	32583	49734	198.23.227.212	192.168.2.4
Dec 3, 2024 16:31:31.602144003 CET	49734	32583	192.168.2.4	198.23.227.212
Dec 3, 2024 16:31:32.246922016 CET	49734	32583	192.168.2.4	198.23.227.212
Dec 3, 2024 16:31:32.367665052 CET	32583	49734	198.23.227.212	192.168.2.4
Dec 3, 2024 16:32:01.977418900 CET	32583	49734	198.23.227.212	192.168.2.4
Dec 3, 2024 16:32:02.024116039 CET	49734	32583	192.168.2.4	198.23.227.212
Dec 3, 2024 16:32:02.362095118 CET	49734	32583	192.168.2.4	198.23.227.212
Dec 3, 2024 16:32:02.482736111 CET	32583	49734	198.23.227.212	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 3, 2024 16:28:48.853251934 CET	63349	53	192.168.2.4	1.1.1.1
Dec 3, 2024 16:28:48.993839025 CET	53	63349	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 3, 2024 16:28:48.853251934 CET	192.168.2.4	1.1.1.1	0x36f	Standard query (0)	geoplugin.net	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 3, 2024 16:28:48.993839025 CET	1.1.1.1	192.168.2.4	0x36f	No error (0)	geoplugin.net		178.237.33.50	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

geoplugin.net

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49752	178.237.33.50	80	3520	C:\Users\user\AppData\Roaming\yava\yava_vd.exe

Timestamp	Bytes transferred	Direction	Data
Dec 3, 2024 16:28:49.124042034 CET	71	OUT	GET /json.gp HTTP/1.1 Host: geoplugin.net Cache-Control: no-cache
Dec 3, 2024 16:28:50.463073969 CET	1171	IN	HTTP/1.1 200 OK date: Tue, 03 Dec 2024 15:28:50 GMT server: Apache content-length: 963 content-type: application/json; charset=utf-8 cache-control: public, max-age=300 access-control-allow-origin: * Data Raw: 7b 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 72 65 71 75 65 73 74 22 3a 22 38 2e 34 36 2e 31 32 33 2e 32 32 38 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 73 74 61 74 75 73 22 3a 32 30 30 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 64 65 6c 61 79 22 3a 22 32 6d 73 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 63 72 65 64 69 74 22 3a 22 53 6f 6d 65 20 6f 66 20 74 68 65 20 72 65 74 75 72 6e 65 64 20 64 61 74 61 20 69 6e 63 6c 75 64 65 73 20 47 65 6f 4c 69 74 65 32 20 64 61 74 61 20 63 72 65 61 74 65 64 20 62 79 20 4d 61 78 4d 69 6e 64 2c 20 61 76 61 69 6c 61 62 6c 65 20 66 72 6f 6d 20 3c 61 20 68 72 65 66 3d 27 68 74 74 70 73 3a 5c 2f 5c 2f 77 77 77 2e 6d 61 78 6d 69 6e 64 2e 63 6f 6d 27 3e 68 74 74 70 73 3a 5c 2f 5c 2f 77 77 77 2e 6d 61 78 6d 69 6e 64 2e 63 6f 6d 3c 5c 2f 61 3e 2e 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 63 69 74 79 22 3a 22 4e 65 77 20 59 6f 72 6b 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 72 65 67 69 6f 6e 22 3a 22 4e 65 77 20 59 6f 72 6b 22 2c 0a 20 20 22 67 65 [TRUNCATED] Data Ascii: { "geoplugin_request":"8.46.123.228", "geoplugin_status":200, "geoplugin_delay":"2ms", "geoplugin_credit":"Some of the returned data includes GeoLite2 data created by MaxMind, available from <a href='https:\/\/www.maxmind.com'>https:\/\/www.maxmind.com<\/a>.", "geoplugin_city":"New York", "geoplugin_region":"New York", "geoplugin_regionCode":"NY", "geoplugin_regionName":"New York", "geoplugin_areaCode":"", "geoplugin_dmaCode":"501", "geoplugin_countryCode":"US", "geoplugin_countryName":"United States", "geoplugin_inEU":0, "geoplugin_euVATrate":false, "geoplugin_continentCode":"NA", "geoplugin_continentName":"North America", "geoplugin_latitude":"40.7123", "geoplugin_longitude":"-74.0068", "geoplugin_locationAccuracyRadius":"20", "geoplugin_timezone":"America\/New_York", "geoplugin_currencyCode":"USD", "geoplugin_currencySymbol":"$", "geoplugin_currencySymbol_UTF8":"$", "geoplugin_currencyConverter":0}

Target ID:	0
Start time:	10:28:12
Start date:	03/12/2024
Path:	C:\Users\user\Desktop\E84Ddy7gSh.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\E84Ddy7gSh.exe"
Imagebase:	0x400000
File size:	466'432 bytes
MD5 hash:	60E18D4606431A33C406C1AD21DDC4E2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000000.00000002.2314536540.0000000002D07000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000000.00000002.2314578868.0000000002D4B000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000000.00000003.1977291270.00000000048A0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000000.00000003.1977291270.00000000048A0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000000.00000003.1977291270.00000000048A0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000000.00000003.1977291270.00000000048A0000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: REMCOS_RAT_variants, Description: unknown, Source: 00000000.00000003.1977291270.00000000048A0000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM, Description: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003), Source: 00000000.00000003.1977291270.00000000048A0000.00000004.00001000.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000000.00000002.2313081255.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000000.00000002.2313081255.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000000.00000002.2313081255.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000000.00000002.2313081255.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Author: unknown Rule: REMCOS_RAT_variants, Description: unknown, Source: 00000000.00000002.2313081255.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Author: unknown Rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM, Description: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003), Source: 00000000.00000002.2313081255.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Author: ditekSHen Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000000.00000002.2314933519.0000000004820000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000000.00000002.2314933519.0000000004820000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000000.00000002.2314933519.0000000004820000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000000.00000002.2314933519.0000000004820000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000000.00000002.2314933519.0000000004820000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Target ID:	3
Start time:	10:28:16
Start date:	03/12/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 1544 -s 1072
Imagebase:	0x610000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	5
Start time:	10:28:18
Start date:	03/12/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 1544 -s 1080
Imagebase:	0x610000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	7
Start time:	10:28:19
Start date:	03/12/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 1544 -s 1132
Imagebase:	0x610000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	9
Start time:	10:28:20
Start date:	03/12/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 1544 -s 1140
Imagebase:	0x610000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	11
Start time:	10:28:21
Start date:	03/12/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 1544 -s 1176
Imagebase:	0x610000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	13
Start time:	10:28:22
Start date:	03/12/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 1544 -s 1204
Imagebase:	0x610000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	15
Start time:	10:28:23
Start date:	03/12/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 1544 -s 1080
Imagebase:	0x610000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	16
Start time:	10:28:24
Start date:	03/12/2024
Path:	C:\Users\user\AppData\Roaming\yava\yava_vd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\yava\yava_vd.exe"
Imagebase:	0x400000
File size:	466'432 bytes
MD5 hash:	60E18D4606431A33C406C1AD21DDC4E2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000010.00000002.4401266733.0000000002D07000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000010.00000002.4401297367.0000000002D4C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000010.00000003.2101181064.0000000002FC0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000010.00000003.2101181064.0000000002FC0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000010.00000003.2101181064.0000000002FC0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000010.00000003.2101181064.0000000002FC0000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: REMCOS_RAT_variants, Description: unknown, Source: 00000010.00000003.2101181064.0000000002FC0000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM, Description: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003), Source: 00000010.00000003.2101181064.0000000002FC0000.00000004.00001000.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000010.00000002.4399861671.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000010.00000002.4399861671.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000010.00000002.4399861671.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000010.00000002.4399861671.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Author: unknown Rule: REMCOS_RAT_variants, Description: unknown, Source: 00000010.00000002.4399861671.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Author: unknown Rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM, Description: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003), Source: 00000010.00000002.4399861671.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Author: ditekSHen Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000010.00000002.4401153670.0000000002C40000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000010.00000002.4401153670.0000000002C40000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000010.00000002.4401153670.0000000002C40000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000010.00000002.4401153670.0000000002C40000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000010.00000002.4401153670.0000000002C40000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Antivirus matches:	Detection: 68%, ReversingLabs
Reputation:	low
Has exited:	false

Target ID:	18
Start time:	10:28:25
Start date:	03/12/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 1544 -s 972
Imagebase:	0x610000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	21
Start time:	10:28:29
Start date:	03/12/2024
Path:	C:\Users\user\AppData\Roaming\yava\yava_vd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\yava\yava_vd.exe"
Imagebase:	0x400000
File size:	466'432 bytes
MD5 hash:	60E18D4606431A33C406C1AD21DDC4E2
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000015.00000002.2340121187.0000000002F6F000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000015.00000003.2171817670.0000000004940000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000015.00000003.2171817670.0000000004940000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000015.00000003.2171817670.0000000004940000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000015.00000003.2171817670.0000000004940000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: REMCOS_RAT_variants, Description: unknown, Source: 00000015.00000003.2171817670.0000000004940000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM, Description: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003), Source: 00000015.00000003.2171817670.0000000004940000.00000004.00001000.00020000.00000000.sdmp, Author: ditekSHen Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000015.00000002.2340091843.0000000002F2A000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000015.00000002.2338776222.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000015.00000002.2338776222.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000015.00000002.2338776222.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000015.00000002.2338776222.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Author: unknown Rule: REMCOS_RAT_variants, Description: unknown, Source: 00000015.00000002.2338776222.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Author: unknown Rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM, Description: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003), Source: 00000015.00000002.2338776222.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Author: ditekSHen Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000015.00000002.2340023233.0000000002E50000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000015.00000002.2340023233.0000000002E50000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000015.00000002.2340023233.0000000002E50000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000015.00000002.2340023233.0000000002E50000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000015.00000002.2340023233.0000000002E50000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Has exited:	true

Target ID:	22
Start time:	10:28:30
Start date:	03/12/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 3520 -s 704
Imagebase:	0x610000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	24
Start time:	10:28:32
Start date:	03/12/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 3520 -s 740
Imagebase:	0x610000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	27
Start time:	10:28:35
Start date:	03/12/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 3520 -s 728
Imagebase:	0x610000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	28
Start time:	10:28:36
Start date:	03/12/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 6308 -s 524
Imagebase:	0x610000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	30
Start time:	10:28:37
Start date:	03/12/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 3520 -s 796
Imagebase:	0x610000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	32
Start time:	10:28:38
Start date:	03/12/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 3520 -s 804
Imagebase:	0x610000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	33
Start time:	10:28:39
Start date:	03/12/2024
Path:	C:\Users\user\AppData\Roaming\yava\yava_vd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\yava\yava_vd.exe"
Imagebase:	0x400000
File size:	466'432 bytes
MD5 hash:	60E18D4606431A33C406C1AD21DDC4E2
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000021.00000002.2367559880.0000000002DDA000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000021.00000002.2367590433.0000000002E1F000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000021.00000002.2367461787.0000000002D20000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000021.00000002.2367461787.0000000002D20000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000021.00000002.2367461787.0000000002D20000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000021.00000002.2367461787.0000000002D20000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000021.00000002.2367461787.0000000002D20000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000021.00000002.2366150598.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000021.00000002.2366150598.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000021.00000002.2366150598.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000021.00000002.2366150598.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Author: unknown Rule: REMCOS_RAT_variants, Description: unknown, Source: 00000021.00000002.2366150598.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Author: unknown Rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM, Description: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003), Source: 00000021.00000002.2366150598.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Author: ditekSHen Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000021.00000003.2264223239.0000000003110000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000021.00000003.2264223239.0000000003110000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000021.00000003.2264223239.0000000003110000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000021.00000003.2264223239.0000000003110000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: REMCOS_RAT_variants, Description: unknown, Source: 00000021.00000003.2264223239.0000000003110000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM, Description: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003), Source: 00000021.00000003.2264223239.0000000003110000.00000004.00001000.00020000.00000000.sdmp, Author: ditekSHen
Has exited:	true

Target ID:	35
Start time:	10:28:39
Start date:	03/12/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 3520 -s 760
Imagebase:	0x610000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	37
Start time:	10:28:41
Start date:	03/12/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 3520 -s 744
Imagebase:	0x610000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	39
Start time:	10:28:42
Start date:	03/12/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 3520 -s 744
Imagebase:	0x610000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true